docker
Your Agent's Permissions Belong in an OCI Image
Docker's open Sandbox Kit Spec v3 puts an AI agent's network rules, credentials, and tools inside an ordinary OCI image, and the diff becomes the security review. Here is why that beats both containers and IAM roles pasted into CI.