Person
Chief technology officer of the Cloud Native Computing Foundation.
Docker published its Sandbox Kit Specification v3 under Apache 2.0, packaging an AI agent's permissions and tools as an ordinary OCI image. Grants that developers now keep in shell history and run flags can be pinned by digest and reviewed like any other image change.
Reality
Docker's new Cloud Sandboxes run AI agents unattended for hours in microVMs on Docker-hosted compute that scales from 1 to 16 vCPUs. Teams that adopt it move agent secrets and policy enforcement into Docker's cloud, on isolation claims that so far come only from Docker.
Reality
Docker released its Sandbox Kit Spec under Apache 2.0 and is taking it to CNCF, with nine named vendors already shipping Kits for their own tools. Enforcement still belongs to the runtime. In the post, that runtime is Docker Sandboxes.
Reality
Backstage's catalog is now something coding agents call at runtime, and the AiResource kind added in v1.54 records which tools a given agent may use. Platform teams still have to work out what checks that record.
Reality
Sixteen of the 67 enhancements in the Garhwal release are stable, and the report names exactly one change that takes effect without anyone enabling it. HPE, meanwhile, consolidated its Terraform providers.
Reality