Highlights

• Host services inside the sandbox. New host-port@1 exposes a specific host loopback TCP or UDP service at a sandbox loopback endpoint, with explicit host address-family selection. It grants that service without granting general network egress. (#138)
• Docker Engine and registry authentication. New dockerd@1 requests an in-sandbox engine with elevation, private persistent storage, and automatic or Kit-managed startup. New docker-auth@1 lets Docker-compatible clients authenticate to declared registries through opaque, run-scoped placeholders while real credentials and issued tokens stay outside the sandbox. (#191, #201)
• BuildKit secret inputs. Kit authors can declare args.<name>.buildSecret and supply private build credentials through standard Docker --secret inputs and Dockerfile secret mounts. Secret values bypass ordinary argument resolution and descriptor interpolation; passing them through --build-arg is rejected. (#197)
• Safer approval prompts and validation. Permission-surface identities now use the full SHA-256 of capability configs. Approval prompts visibly escape control and invisible characters. Validation finds escaped argument references, keeps inspecting strings alongside large numbers, and reports cross-entry findings once per pair. (#169, #178, #179, #180)
• Configurable inventory budgets. Library consumers can use fetch.InventoryLimits and fetch.LayerValidatorWithLimits to accommodate larger images with explicit finite budgets while retaining blob verification, extraction safety, and cross-Kit collision checks. The default validator's limits are unchanged. (#192)
• Persistent sessions, memory, and environment composition. New host-mounted session mixins retain agent sessions, self-hosted Mem0 Kits provide shared memory with stable project scopes, and the bundled sbxenv skill helps compose environments and manage version and digest pins. (#126, #193, #194)
• Updated workloads and security dependencies. New Ubuntu and UBI workloads include Docker Engine; UBI certificate paths are bridged for sandbox trust. Agent and ACP defaults are refreshed, and dependency updates address security advisories in both Go modules. (#186, #188, #189, #190, #196, #198, #199, #200, #204)
• Frontend annotation guidance. Publishing documentation and export tests clarify when Kit annotations appear on image indexes and how readers fall back to the platform manifest. Explicit --provenance=mode=min requests index annotations for single-platform attested exports. (#183, #184)

Compatibility

• schemaVersion remains 3. This remains an early-draft milestone: buildSecret extends the unfinished argument grammar in place, and descriptors using it require matching readers because older strict readers reject the field. Existing descriptor fields are neither renamed nor removed. Secret availability is enforced by required=true on the recipe's secret mount; secret inputs cannot be supplied or re-exported through a published set.
• host-port@1, dockerd@1, and docker-auth@1 are new capability types. Runtimes must implement their contracts before advertising support; normal required/optional selection rules apply. dockerd@1 requires engine binaries in the composed image and owns /var/lib/docker, so a composition cannot also declare a volume or host mount at or below that path. docker-auth@1 grants neither network access nor a Docker engine or socket.
• Permission-lock migration: entries for capabilities represented by a config digest now use the full SHA-256. Locks recorded with the previous short digest report those entries as widened once on the next gated update. Older binaries reading a lock written by this version report those entries as widened on every gated update.
• Runtime conformance adapters claiming docker-auth@1 must accept create --docker-auth-config <absolute-path> and support the suite's synthetic credential bindings, HTTPS routes, and CA. Adapters claiming host-port@1 must reach the suite-owned host loopback services with the requested endpoint semantics. This release does not assert conformance of a live Docker Sandboxes runtime.
• The library and frontend remain separate Go modules, released together under the root tag. See m.11 for module packaging and m.10 for earlier draft contract and API changes.

Artifacts

• kit-tck binaries for Linux, macOS, and Windows on amd64 and arm64, with checksums.txt, attached to this release.
• Frontend image: docker/sandbox-kit:3.0.0-m.12 for linux/amd64 and linux/arm64, with SBOM and provenance attestations.
• Floating frontend tag: docker/sandbox-kit:3 has not been promoted to this milestone and still points to m.11. Pin docker/sandbox-kit:3.0.0-m.12 to use this release's frontend.
• Go module: go get github.com/docker/sandbox-kit-spec/[email protected].

Full changelog: v3.0.0-m.11...v3.0.0-m.12.

Go module packaging issue: Go module proxies reject this tag because spec/nul.go uses a Windows-reserved filename. Use v3.0.0-m.10 for Go module consumers. Floating docker/sandbox-kit:3 has not been promoted to this milestone.

Highlights

• Inline agent guidance. New agent-context@2 keeps complete composed guidance inline and materializes it at every selected discovery destination. Optional selection and published sets preserve content and dependency order. Examples offer optional @1 and @2 alternatives during the runtime rollout; default fetch consumers and preview prefer an available @2 alternative. (#113, #133, #142)
• Instance-owned volumes. Matching volume requests merge. Block storage survives restart, recreation, workload replacement, and temporary removal of its declaration; removing the sandbox instance deletes its storage. Incompatible settings refuse recreation before changing the container or storage. (#111)
• Agent sessions and ACP. agent-interactive-sessions@1 describes interactive session discovery and launch. acp@1 describes Agent Client Protocol adapter launches, with examples for Codex, Claude Code, OpenCode, Gemini CLI, and Cursor. Desktop hooks report session titles and state, and headless prompts retain their argument boundaries. (#102, #106, #112, #115, #116)
• Public integration contracts. Capability selectors receive SelectionTarget with the consumed reference and declaration path. Fetch offers opt-in expanded-descriptor capture before selection. The new load package shares the loader contract without importing a registry client, and spec.InstanceKeyOf / spec.ArityOf expose capability identity and arity. Existing fetch loader aliases remain available. (#121, #141, #149, #150)
• Port address families. port@1 accepts family: ipv4, ipv6, or dual; an omitted family defaults to IPv4 after composition. Conflicting explicit families refuse composition. (#140)
• Stricter descriptor validation. Validation rejects NUL in every string and map key, including opaque capability configs and JSON-backed Go values. Argument references, config field names, deferred identities, and duplicate declarations are checked consistently through publication and create-time expansion. (#151, #154, #155, #159)
• Frontend publication corrections. Recipe-built Kits discard inherited descriptors while preserving payloads and guidance. Multi-platform sets retain only package name/version inventory shared by every member platform. Companion builds preserve registry cache imports. (#135, #143, #147)
• Refreshed examples and security dependencies. Agent and development-tool pins are refreshed, portable build fixes are included, Go is raised to 1.26.10, and the eBPF replacement covers all selected versions. (#142, #161)

Compatibility

• Breaking Go API change: selectors now use func(context.Context, spec.SelectionTarget, spec.Descriptor, spec.Capability) spec.CapabilityDecision. Direct selection becomes spec.SelectCapabilities(ctx, reference, descriptor, selector). Callers invoking selectors returned by spec.Supported must also pass the target.
• agent-context@1 remains supported. @2 accepts inline content and rejects contentFile; selecting both versions together refuses composition. Runtimes must choose one supported alternative before composing the updated example guidance.
• This remains an early-draft milestone. Maintainer-approved in-place contract changes include volume reconciliation and lifetime, the port@1 family field and default, and stricter reference/NUL validation. The new declarationBlocks item field preserves original declaration boundaries through set publication. Older strict readers reject newly introduced fields; consumers need matching specification and implementation versions. schemaVersion remains 3.
• Runtime implementations must implement the updated contracts before advertising support. The conformance suite exercises these contracts against its fake adapter; this release does not assert conformance of a live Docker Sandboxes runtime.

Artifacts

• kit-tck binaries for Linux, macOS, and Windows on amd64 and arm64, with checksums.txt, attached to this release.
• Frontend image: docker/sandbox-kit:3.0.0-m.9 for linux/amd64 and linux/arm64, with SBOM and provenance attestations.
• Floating frontend tag: docker/sandbox-kit:3 has not been promoted to this milestone.
• Go module: unavailable from module proxies because spec/nul.go is a Windows-reserved filename. Use v3.0.0-m.10 instead.

Full changelog: v3.0.0-m.8...v3.0.0-m.9.

Highlights

• Independent library dependencies. The BuildKit frontend now lives in a separate Go module. Public library consumers no longer inherit BuildKit or containerd runtime/API requirements; containerd 2.3 consumers retain their selected versions. Public package paths and APIs, including assemble, fetch, and load, are unchanged. (#165)
• Updated examples. Agent and ACP adapter version defaults were refreshed, including Claude Code, Claude ACP, Codex ACP, and the Cursor template. All 36 example Kits were published and verified after m.10. (#163)

Compatibility

• schemaVersion remains 3; this milestone changes no descriptor grammar, capability contract, or conformance duties.
• cmd/kit-tck remains in the root module. Root v3.* tags continue publishing the library, kit-tck, and frontend image together.
• The frontend is distributed as an image. Versioned go install of cmd/frontend from the root module is no longer supported; use the image or build from a repository checkout. The nested frontend module has no separate release tags.
• This remains an early-draft milestone. See m.10 for the earlier draft contract and API changes.

Artifacts

• kit-tck binaries for Linux, macOS, and Windows on amd64 and arm64, with checksums.txt, attached to this release.
• Frontend image: docker/sandbox-kit:3.0.0-m.11 for linux/amd64 and linux/arm64, with SBOM and provenance attestations.
• Floating frontend tag: docker/sandbox-kit:3 explicitly promoted to the same image digest as this milestone.
• Go module: go get github.com/docker/sandbox-kit-spec/[email protected].

Full changelog: v3.0.0-m.10...v3.0.0-m.11.

Highlights

• Inline agent guidance. New agent-context@2 keeps complete composed guidance inline and materializes it at every selected discovery destination. Optional selection and published sets preserve content and dependency order. Examples offer optional @1 and @2 alternatives during the runtime rollout; default fetch consumers and preview prefer an available @2 alternative. (#113, #133, #142)
• Instance-owned volumes. Matching volume requests merge. Block storage survives restart, recreation, workload replacement, and temporary removal of its declaration; removing the sandbox instance deletes its storage. Incompatible settings refuse recreation before changing the container or storage. (#111)
• Agent sessions and ACP. agent-interactive-sessions@1 describes interactive session discovery and launch. acp@1 describes Agent Client Protocol adapter launches, with examples for Codex, Claude Code, OpenCode, Gemini CLI, and Cursor. Desktop hooks report session titles and state, and headless prompts retain their argument boundaries. (#102, #106, #112, #115, #116)
• Public integration contracts. Capability selectors receive SelectionTarget with the consumed reference and declaration path. Fetch offers opt-in expanded-descriptor capture before selection. The new load package shares the loader contract without importing a registry client, and spec.InstanceKeyOf / spec.ArityOf expose capability identity and arity. Existing fetch loader aliases remain available. (#121, #141, #149, #150)
• Port address families. port@1 accepts family: ipv4, ipv6, or dual; an omitted family defaults to IPv4 after composition. Conflicting explicit families refuse composition. (#140)
• Stricter descriptor validation. Validation rejects NUL in every string and map key, including opaque capability configs and JSON-backed Go values. Argument references, config field names, deferred identities, and duplicate declarations are checked consistently through publication and create-time expansion. (#151, #154, #155, #159)
• Frontend publication corrections. Recipe-built Kits discard inherited descriptors while preserving payloads and guidance. Multi-platform sets retain only package name/version inventory shared by every member platform. Companion builds preserve registry cache imports. (#135, #143, #147)
• Refreshed examples and security dependencies. Agent and development-tool pins are refreshed, portable build fixes are included, Go is raised to 1.26.10, and the eBPF replacement covers all selected versions. (#142, #161)

Compatibility

• This milestone also corrects the Windows-reserved source filename that prevented v3.0.0-m.9 from being packaged by Go module proxies. Use v3.0.0-m.10 for Go module consumers.

• Breaking Go API change: selectors now use func(context.Context, spec.SelectionTarget, spec.Descriptor, spec.Capability) spec.CapabilityDecision. Direct selection becomes spec.SelectCapabilities(ctx, reference, descriptor, selector). Callers invoking selectors returned by spec.Supported must also pass the target.

• agent-context@1 remains supported. @2 accepts inline content and rejects contentFile; selecting both versions together refuses composition. Runtimes must choose one supported alternative before composing the updated example guidance.

• This remains an early-draft milestone. Maintainer-approved in-place contract changes include volume reconciliation and lifetime, the port@1 family field and default, and stricter reference/NUL validation. The new declarationBlocks item field preserves original declaration boundaries through set publication. Older strict readers reject newly introduced fields; consumers need matching specification and implementation versions. schemaVersion remains 3.

• Runtime implementations must implement the updated contracts before advertising support. The conformance suite exercises these contracts against its fake adapter; this release does not assert conformance of a live Docker Sandboxes runtime.

Artifacts

• kit-tck binaries for Linux, macOS, and Windows on amd64 and arm64, with checksums.txt, attached to this release.
• Frontend image: docker/sandbox-kit:3.0.0-m.10 for linux/amd64 and linux/arm64, with SBOM and provenance attestations.
• Floating frontend tag: docker/sandbox-kit:3 explicitly promoted to the same image digest as this milestone.
• Go module: go get github.com/docker/sandbox-kit-spec/[email protected].

Full changelog: v3.0.0-m.8...v3.0.0-m.10.

Highlights

• Host-shared storage. New com.docker.sandbox/host-mount@1 lets Kits request runtime-owned host directories shared across their sandboxes and retained after sandbox removal. Kits choose the container path and optional initial mode; runtimes choose the backing directory and mount mechanism. Sharing has its own permission surface, identity isolation, conflict validation, and conformance checks. An optional shared-cache example demonstrates the capability. (#101)

• Agent instruction discovery. agent-context@1 gains an optional absolute directory, allowing workloads, agent mixins, and sets to select locations their harnesses discover. Explicit mixin profiles override legacy workload defaults, conflicting profiles fail, and existing instructions outside runtime-managed sections are preserved. Updated examples cover Codex, Claude Code, Gemini CLI, OpenCode, Docker Agent, and Cursor. Codex ACP launches receive CODEX_HOME, and the repository environment stores Codex sessions separately for each sandbox. (#97)

• Capability selection decisions. Policy callbacks receive cancellation context and the owning Kit descriptor and return CapabilityDecision{Accepted, Message}. Selection records retain decision messages, required-rejection diagnostics explain refusals, and cancellation discards partial results. (#98)

• Reproducible OCI creation metadata. kit-tck validate accepts RFC 3339 org.opencontainers.image.created annotations derived from SOURCE_DATE_EPOCH, including conforming fractional seconds, offsets, lowercase separators, and leap seconds. Wall-clock creation timestamps remain prohibited by the specification. (#100)

Artifacts

• kit-tck binaries for Linux, macOS, and Windows on amd64 and arm64, with checksums.txt, attached to this release.
• Hub image: docker/sandbox-kit:3.0.0-m.8.
• Go module: go get github.com/docker/sandbox-kit-spec/[email protected].

Notes

• Breaking Go API change. Capability selectors now use func(context.Context, spec.Descriptor, spec.Capability) spec.CapabilityDecision instead of returning a boolean. SelectCapabilities takes context first; selectors returned by Supported use the same new callback signature. Descriptor and capability arguments are passed by value, with nested maps and slices shared.

• Agent-context compatibility. Existing descriptors retain their previous discovery default. The new directory field extends agent-context@1 in place under the approved draft-versioning exception; older strict readers reject declarations using it. The external Docker Sandboxes runtime handler needs corresponding support before consuming the updated examples.

• Host-mount runtime support. Adding this capability requires no existing capability-version or schemaVersion bump. Required requests fail on runtimes without host sharing; optional requests can be skipped. The repository's sbx adapter does not yet advertise this capability. Its conformance checks were exercised against the fake adapter, not a live Docker Sandboxes runtime.

• Conformance limits. Artifact validation checks creation-timestamp syntax but cannot determine whether its source was SOURCE_DATE_EPOCH or the wall clock. Cross-Kit reattachment of retained private volumes also remains explicitly waived because the adapter cannot express that operation.

• Milestone frontend tag. This prerelease publishes the exact version tag and leaves floating docker/sandbox-kit:3 unchanged.

Full changelog: v3.0.0-m.7...v3.0.0-m.8.

Highlights

• Dependency security fixes. Upgrade containerd to v2.3.6 for CVE-2026-53493 and replace the repository's transitive eBPF requirement with v0.22.0 for CVE-2026-10722. The dev-tools mixin now permits HTTPS access to vuln.go.dev and api.osv.dev for dependency scanners.

• Atomic capability groups and environment references. Kits can group requests into required or optional features: rejecting an optional member omits the whole feature, including its hooks, files, and context. Capability entries gain human-readable names and source attribution. ${{ kit.env.NAME }} references expand from the final container environment during assembly.

• SSH agents, Git identity, and long-running workloads. New capabilities request phase-scoped SSH agent access with authentication/signing bounds, runtime-provided Git name and email defaults, and sandboxes that remain running after clients disconnect. The Docker Sandboxes TCK adapter claims SSH-agent and Git-identity support and retains selection decisions.

• Bundled agent skills and unified discovery. Mixins can ship skills through agent-skill@1, with an optional discovery-name override. agent-skills@1 exposes bundled skills and available host-shared skills at an agent's discovery directory; missing or disabled host sharing no longer prevents startup. Credentials can use one configuration for both install and runtime phases.

• Runtime assembly APIs. fetch.Assemble loads, resolves, and assembles Kits in one call, with configurable loaders, capability selection, container overrides, progress, and layer validation. Resolution exposes per-Kit environment exports and published descriptors. Custom loaders can supply built images for local paths or Git URLs while preserving those references as Kit identities.

• Validation and conformance. Validation reports multiple errors with field paths, locations, and source excerpts. Layer judging verifies compressed and uncompressed digests, bounds inventory, and checks collisions across resolved filesystems. Overlay checks better match containerd extraction and avoid stalls on crafted layers. Runtime coverage adds groups, environment precedence, bundled skills, credential phases, SSH agents, and Git identity.

• Examples and development tooling. Add dev-tools, Git-over-SSH, Git signing, optional-cache, and bundled-skill examples. Refresh agent and ACP versions, including Codex 0.159.2, Codex ACP 2.0.1, and Gemini CLI 0.62.0. Codex Kits ship the complete CLI package, accept model/reasoning arguments, register the MCP gateway correctly, and preserve active and archived transcripts across repository sandbox recreation.

Artifacts

• kit-tck binaries for Linux, macOS, and Windows on amd64 and arm64, with checksums.txt, attached to this release.
• Hub image: docker/sandbox-kit:3.0.0-m.7 (does not move floating :3).
• Go module: go get github.com/docker/sandbox-kit-spec/[email protected].

Notes

• eBPF version for Go module consumers. The eBPF fix uses a replace directive for repository builds. Go module consumers do not inherit dependency replacements; consumers whose selected module graph includes github.com/cilium/ebpf v0.16.0 need to upgrade it to v0.22.0 or add the same replacement to their own main module.

• This milestone includes breaking Go API changes. fetch.Client.Assemble and AssemblePartial are replaced by Resolve and ResolvePartial, returning fetch.Resolved. Argument exports are available as Resolved.ContainerEnv and each resolve.Unit.Env, and should be applied at container creation. The new package-level fetch.Assemble returns an image, resolved declarations, and container settings.

• Typed image assembly. assemble.Merge returns *assemble.Image instead of *assemble.Merged. Merged.ConfigJSON and its stored manifest are removed; use Image.Config, Image.Manifest(), and Image.WriteMetadata().

• Layer validation is opt-in. LoadedKit.OpenLayer becomes LayerLoader. Set fetch.Options.LayerValidator to fetch.DefaultLayerValidator to retain built-in integrity, safe-extraction, resource-limit, and collision checks. A nil validator skips layer reads; callers remain responsible for those checks before using the image.

• Selection source fields. KitSelection.Original and Raw become PublishedDescriptor and PublishedBytes, retaining the unexpanded published declarations and exact source bytes. Use Resolved.Kits for expanded, selected declarations.

• Credential phase lists. Credential.Phase changes from string to spec.Phases ([]string). Scalar descriptor spelling remains valid; phase: [install, runtime] requires an updated reader. This intentionally extends credential@1 in place under the approved versioning exception.

• Agent-skills semantics change. agent-skills@1 now declares bundled-skill discovery with optional host sharing, while mode bounds host-store access only. Runtimes implementing the previous contract need updating. Users of development builds must replace the removed agent-skills-directory@1 capability and AgentSkillsDirectoriesOf reader with agent-skills@1 and AgentSkillsOf. The existing @1 version is retained under the approved versioning exception.

• Descriptor compatibility. No existing descriptor field is renamed or removed. New capability name, group, and source forms require updated strict readers. schemaVersion remains 3 under the approved exception for the unfinished draft; this prerelease does not promote the floating frontend tag.

Full changelog: v3.0.0-m.6...v3.0.0-m.7.

Highlights

• fetch assembles a kit from registry references. Consumers can resolve published kits (and indexes) without a source tree: platform ranking, nested-index walks, create-phase env exports, and a hard refusal of indexes that set artifactType. Import as github.com/docker/sandbox-kit-spec/v3/fetch.

• kit-tck inspect, and kit is now validate. Inspect reads a kit without judging it (descriptor and staged recipe); validate is the conformance verb. Descriptor-only inspect skips layer reads. Overlay judging models the applier for home owners and dangling links, and skips overlay checks where the source cannot walk them.

• Build stamps. Both binaries and every kit the frontend publishes carry the tag and commit (internal/version); kit-tck version, the report header, frontend progress, and vnd.docker.sandbox.kit.built-by all agree.

• Companion sub-solve fidelity. Caller build options forward into dockerfile.v0 the way BuildKit expects: reserved control and gateway attributes stay out of the way, FROM args and stage aliases match dockerfile.v0, --target and platform targeting work, mixin external bases load through named-context lookup, and --no-cache never leaks into the lower stage.

• Schema accepts ${{ kit.args.* }} in capability configs. Remaining constrained fields that authors already parameterized at the top level can use the same kit-arg refs in config.

• Builder kit exposes BuildKit to host buildx. Opt-in TCP publish (buildkitExpose), kit-arg port/size, default engine-store volume 20 GiB.

• Authoring skills ship as a kit, with create/migrate guidance aligned to stable sbx (Kits v3 in local and cloud). README get-started leads with published docker/* v3 images (sbx/* remains v2).

• Examples. Expanded agent kits (including Codex ACP set / Claude ACP wrapper fixes), Alpine workload example, and shared skills store wiring for Claude.

Artifacts

• kit-tck binaries (linux/darwin/windows, amd64/arm64) attached to this release
• Hub image: docker/sandbox-kit:3.0.0-m.6 (does not move floating :3)

Notes

• CLI rename: kit-tck kit → kit-tck validate. Update scripts and docs that still call kit.
• go get github.com/docker/sandbox-kit-spec/[email protected]

Highlights

• com.docker.sandbox/sbx@1 names what an agent sandbox needs and makes both halves checkable. A workload declaring it says the host launches the agent rather than letting the image entrypoint be PID 1, and that the host honors the identity the image config states instead of assuming one. Config-less and singleton, with no permission surface — it asks the host to run the workload a particular way and to read what the image already declares.

  The kit owes a /bin/sh and a /bin/bash the declared user can actually execute, a non-empty user in the image config, and that user resolving in /etc/passwd to a uid, gid and home. Occupying the path is not enough: a FIFO, a device node, or bits that leave the declared user out resolve at publish and then fail at the first hook. The host owes the four duties on the other side, which the runtime suite judges. Two new kit checks, sbx-platform-floor and sbx-persistent-env, judge the kit's half from the artifact alone — so a kit that cannot be operated this way is caught at publish rather than at first launch.

• A workload's provides now says what its image actually carries. Publishing reads the package databases out of the content and states one entry per installed package under the reserved deb/ and apk/ namespaces (§9.6). This replaces a fiction: a version: fallback answers for names an author chose, and applying it to inherited software published [email protected] — a kit's release number wearing the name of a shell.

  deb/[email protected]     deb/[email protected]        deb/[email protected]
  deb/[email protected]   deb/[email protected]         deb/[email protected]       ... one per package
  

  The version published is the upstream core and never the distribution's wrapping, so an epoch, a Debian revision, a binNMU, a backport suffix and an apk release all come off. Fewer than three parts stays as it is rather than being padded — binutils really is 2.44. A prerelease is dropped rather than promoted, because dpkg sorts 1.69~deb13u1 below 1.69 and stating 1.69 would claim a release the content has not reached. Entries are stated only where every platform agrees, so an architecture-specific package is dropped rather than asserted for all of them. Derivation is workload-only: a mixin's layers are a delta, and a set carries its kits' entries through the union rather than re-deriving. A new derived-provides check holds every published entry back to the database that shipped beside it.

• An adapter that drives Docker Sandboxes through the conformance contract, at tck/adapters/sbx (task tck:runtime:sbx). Running a real runtime against the suite is also what found the defects the rest of this release fixes — in the suite and the pages as often as in the runtime, which is the point of writing one.

• kit-tck kit me/sbx-kit:1.0.0 works. References are normalized the way docker pull normalizes them, so Hub shorthand reaches Hub instead of failing on a DNS lookup for a host that was never one. A reference pinned by both a tag and a digest resolves the digest.

• The sbx@1 floor reports every gap, not the first. An image with no declared user used to report that and stop, leaving its missing shells to be discovered one rebuild at a time.

• Claude Code 2.1.274 and claude-agent-acp 0.79.0 in the claude kits, and task kit:build resolves a version override from every argument source rather than only the first.

Artifacts

• kit-tck binaries (linux/darwin/windows, amd64/arm64) attached to this release
• Hub image: docker/sandbox-kit:3.0.0-m.5 (does not move floating :3)

Notes

• Normative statements moved this time. sbx@1 is a new capability page with nine anchored statements, §9.6 is new, and §5.1 gained a MUST: a namespace anyone defines is reverse-DNS, and the single-label space is reserved — deb/ and apk/ live there. The capability-name charset now admits dots and pluses, because a package name is a capability name and Debian ships libstdc++6 and containerd.io.
• The kit suite went from 12 checks to 15. As RELEASES.md says, a suite that gains a check can fail an artifact that passed the previous tag, and that is intended: the check reflects a duty the specification already stated. A workload declaring sbx@1 is the one most likely to notice.
• Rebuilding a workload kit changes its published descriptor, which now carries its package inventory. Nothing is required of authors, but a kit that listed tool names with no versions of their own should drop them — examples/shell/shell.yaml shows the shape.
• go get github.com/docker/sandbox-kit-spec/[email protected]
• First release tag carrying a signature; m.1 through m.4 are annotated but unsigned.

Highlights

• kit-tck reports what a run judged, not only what it found. Findings are grouped by severity under a tally that accounts for every check, and each names the statement it judged with a link into the specification — SPEC-v3 §9.3 and lifecycle@1/install-once resolve to the section and the anchored statement that state them. The pages are embedded and resolved through the same anchors the coverage guard holds the suites to, so a renamed section fails a test rather than shipping a dead link.

  kit-tck dev · kit · /tmp/motd-broken broken
  
    failed
      ✗ schema-version-annotation vnd.docker.sandbox.kit.schema-version is "2", descriptor says "3"
                                  [SPEC-v3 §9.3]
      ✗ oci-annotations           org.opencontainers.image.created must not be emitted [SPEC-v3 §9.3]
    12 checks · 3 failed · 9 passed
  
  ✗ does not conform
  

  New flags: --verbose lists the checks that passed, --format json is the run as data with each finding carrying its spec URL, and --color auto|always|never settles what the terminal and NO_COLOR otherwise decide. Identical per-platform reports collapse to the platforms that share them. Fixes: a flag after the reference (kit-tck kit <ref> -v) was ignored, a bad flag printed two usage blocks, and the verdict went to stderr while its findings went to stdout.

• task kit:build and task kit:push resolve their tag from the kit itself, refreshing an upstream-tracked descriptor from the vendor's latest release first, so a published tag cannot name a version the kit did not install. TAG still pins a build, a --build-arg version= override outranks the descriptor and the tag follows it, and an unreachable upstream falls back to what the descriptor records. The upstream map that versions:check carried inline now lives in hack/kit-version.sh, with task versions:update as the same refresh without a build.

• Claude Code 2.1.273 and claude-agent-acp 0.78.0 land in the claude kits, and the set names them by the versions they now publish as.

• The README no longer opens by asking for a local docker build of the frontend: docker/sandbox-kit:3 is on Docker Hub, so BuildKit pulls it when it reads the # syntax= line.

Artifacts

• kit-tck binaries (linux/darwin/windows, amd64/arm64) attached to this release
• Hub image: docker/sandbox-kit:3.0.0-m.4 (does not move floating :3)

Notes

• No normative statement moved. The conformance checks, their ids, and their verdicts are unchanged — this release changes how a run is written down, not what it judges.
• go get github.com/docker/sandbox-kit-spec/[email protected]

Highlights

• Adopt Go module path github.com/docker/sandbox-kit-spec/v3 so v3.* tags are importable:

  go get github.com/docker/sandbox-kit-spec/[email protected]
  

  Import packages as github.com/docker/sandbox-kit-spec/v3/spec (and siblings).

• Document that schema-3 frontend releases and the Go module major share the v3.* tag axis.

Artifacts

• kit-tck binaries (linux/darwin/windows, amd64/arm64) attached to this release
• Hub image: docker/sandbox-kit:3.0.0-m.3 (does not move floating :3)

Breaking for Go consumers

• Requires updating require / imports from github.com/docker/sandbox-kit-spec/... to github.com/docker/sandbox-kit-spec/v3/....