Express YourSelf !

Reference https://www.meetup.com/collabnix/events/316301263/

1. Contain, Forecast, Adjudicate: Three Agent Controls No Protocol Gives You

https://www.nasiko.com/

2. Securing Your Agentic Stack (Workshop) 

https://agentic.dockerworkshop.com/

https://agentic.dockerworkshop.com/#/labs/securing-the-agentic-stack-slides

https://agentic.dockerworkshop.com/#/labs/securing-the-agentic-stack

1. What it contains? What is software Artifact

SBOM

docker scout sbom --format spdx --output baseline.spdx.json catalog-service:baseline

2. From where it comes from?

Provenience

3. CI pipeline. Who approve image with vulnerabilities? Can I. verify attestation source

https://docs.docker.com/scout/deep-dive/advisory-db-sources/

match with SBOM

Now AIBOM term is emerging. https://www.ajeetraina.com/ai-bom-explained-why-your-sbom-stops-where-your-ai-system-starts

VEX: Vulnerability Exploitability eXchange 

In Docker Desktop, we can filter vulnerabilities based on fixable or not

SLSA

Level 1 to 3

FIPS 140 For US

4. Can it be restricted? Sandbox  

We need base image with near zero vulnerabilities.

All images shall be signed

Allow coding agent only what it needs.

"/rc" in Claude. Remote control. You will keep getting notifications in your mobile. 

AI Agent

local sandbox and cloud sandbox. SBX is running on microVM. Agent can change kernel also. So SBX runs on microVM instead of container.

Inside mircoVM also we run Docker engine and docker daemon 

Docker Hub have MCP policy, AI policy

Now we have SBX compose file with policy

MCP Toolkit

Hardened MCP servers

https://agentic.dockerworkshop.com/#/labs/securing-the-agentic-stack-slides/workshop-75

Docker hub

DHI Docker Hardening Images

Images and AI models also on 

3. Docker sbx kits: you explorations to contain AI Agents begins here

AI Agent

https://docs.docker.com/ai/sandboxes/customize/

https://docs.docker.com/ai/sandboxes/customize/kits/

https://hub.docker.com/search?type=sbx_kit

Tools

1. MIXIN kit

It has enhanced capabilities

build agent from scratch

2. Sandbox Kit

-------

Kit has spec.yaml file

Files are payload. it can have docker compose file. certificate file etc. Some will go to sandbox and other files remain on laptop

start from Mixin kit, as Sandbox kit has many definition

Now let's have customize AI agent. 

https://floci.io/ is like localstack. Cloud emulators 

floci CLI is inside sandbox

1. create shell sendbox

2. run docker compose

same can be done with spec.yaml file

We have DHI for langchain also. It can be inside sandbox

4. Beyond the Agent: Building AI Systems You Can Trust

If it hallucinate then workflow has problem or model has problem? 

5. The New Primitives of AI: YAML, OCI, and Agent Infrastructure

you write agent in your Jupiter Notebook

"It works on my notebook"

"docker agent"

oci artifacts