Docker 将 AI Agent 权限打包为 OCI 镜像的 Sandbox Kit 规范捐给 CNCF
原标题：Docker Sandbox Kit Spec: Packaging AI Agent Permissions as OCI Images
AI 摘要
Docker 宣布将 Sandbox Kit 规范捐赠给 CNCF，该 Apache 2.0 规范已到 v3，把 AI agent 及其工具、所需主机、凭证和卷的带类型清单打包成普通 OCI 镜像。Kit 只声明权限，由宿主运行时决定是否授予，Docker Sandboxes 是首个符合规范的运行时。Docker 称已与 AWS、Box、Datadog、Snyk 等合作构建 Kits，但规范是否被 CNCF 接受及成熟度尚未公布。
正文节选
Docker has announced that it is bringing the Sandbox Kit Specification to the CNCF, aiming to make what an AI agent may access as portable as the agent itself. The Apache 2.0 spec, now at v3, packages an agent, its tools, and a typed list of the hosts, credentials, and volumes it requests into an ordinary OCI image. Docker announced the move at WeAreDevelopers on September 24. Agents such as Claude Code and Codex install packages, call APIs, and use credentials on a user's behalf. The grants tha