Docker Sandbox Kit Spec: Packaging AI Agent Permissions as OCI Images

Docker has contributed its Sandbox Kit Specification to the CNCF to standardize AI agent permissions as OCI images, enabling portable, reviewable permission sets alongside AI workloads. The spec v3 integrates permissions into OCI manifests, allowing controlled access to hosts, credentials, and network policies for AI agents, with Docker Sandboxes as the first conforming runtime.