---
title: "OCI"
description: "1 posts about OCI, summarised, each linking to the original."
---

# OCI
> 1 posts about OCI, summarised, each linking to the original.

## Articles

### [From Dockerfile to Kit: the Docker Sandboxes Kit Specification](https://yomu.fyi/post/from-dockerfile-to-kit-the-docker-sandboxes-kit-specification.md)
- Company: [Docker](https://yomu.fyi/company/docker.md)
- Author: Jin Kim
- Published: Sep 24, 2026
- Type: Announcement

The Docker Sandbox Kit Specification v3 defines how an agent declares the networks, credentials, and volumes it needs, so these grants travel with the artifact rather than living in shell history or dashboards. A Kit is an ordinary OCI image whose manifest carries a descriptor annotation vnd.docker.sandbox.kit.descriptor, so it builds with docker buildx, pulls with docker pull, and gets scanned and signed by existing tooling. Capability types like network-policy@2 and credential@1 are versioned independently, and each normative statement in the specification is covered by a conformance check or a written waiver. Two Kit types exist: a workload supplies the root filesystem, while a mixin adds overlays such as a CLI with its network rule; the runtime rejects required capabilities it cannot satisfy. Composition uses strict provides/requires resolution, so authority changes appear as diffs, and a conforming runtime can gate upgrades that widen the grant set.