Docker Introduces Open Sandbox Kit Spec for AI Agent Permissions

AI agents are increasingly able to explore the limits of developer-imposed restrictions. Their capacity to intuitively adapt makes them difficult to confine. Docker President and COO Mark Cavage, speaking at the opening of the WeAreDevelopers North America conference in San Jose, introduced a new specification for packaging AI agents with their tools and the access they request within a sandbox.

Cavage highlighted the need for stronger controls over AI agents, which do not merely execute predefined tasks but may install dependencies, run code, and interact with external services. The specification, published under the Apache 2.0 license, aims to provide a common format for developers and sandbox providers to use across various sandbox runtimes.

Docker plans to contribute the specification to the Cloud Native Computing Foundation. The new format involves packaging agents as OCI images with descriptors outlining the network hosts, credentials, volumes, and other capabilities they request. This approach allows the use of existing OCI tools for building, storing, signing, and scanning Kits.

Cavage demonstrated the issue by showing how an AI agent, when given access to a host Docker socket, could exploit it to reach a secret file. He emphasized that the agent had not discovered a zero-day vulnerability but had utilized a configuration that Docker had previously criticized. Cavage advocated for separating containers from containment, arguing that agents make decisions about how to utilize the capabilities available to them.

Once an agent's access declarations are embedded within the OCI image, changes in its authority can be reviewed. Pinning a Kit to a specific image digest, which includes its contents and access declarations, ensures that any updates requesting additional access can be reviewed and potentially halted for approval. Docker Sandboxes was the first runtime to conform to the specification, and if other sandbox runtimes and agent developers adopt it, DevOps teams could benefit from a consistent method to review both an agent's operations and the authority it requests.