Pimp My IDE / garage dispatchBack to the garage
October 7, 2026 / agent runtimes / package custody

Inspect the agent before the agent inspects your repo.

Docker Agent packages models, tools, skills, permissions, sandboxes, and budgets in one declarative file. That is useful. It also makes the file an executable operating policy.

Readable YAML is not the same as a bounded run.

The agent file is now a package.

Docker Agent defines an agent in YAML or HCL. One file can name models, instructions, tools, Model Context Protocol servers, retrieval sources, permissions, hooks, skills, and sub-agents. The command runs as a Docker CLI plugin or as a standalone binary.[1]

Version 1.149.0 landed on October 7. It adds public GitHub repository URLs as skill sources. It also adds an evaluator backend, routes evaluators through the models gateway, and fixes service-tier pricing based on the tier the provider actually served.[2]

Once an agent file can carry tools, policy, and dependencies, review it like runnable infrastructure.

Start with custody, not syntax.

Docker Agent can push an agent file to an OCI-compatible registry and run it by tag or digest. Its signing flow authenticates the YAML bytes and the published reference. The documentation also states what the signature does not cover. Several manifest annotations remain outside that proof.[6]

A tag is convenient, but it can move. Pin the digest when rollback protection matters. Record the source before opening the tool lane. A signed file proves who held a key. It does not prove that the file deserves access to your repository.

Policy and isolation do different jobs.

The permissions system has strict, balanced, restricted, and autonomous safety modes. Deny rules take priority over allow rules. The restricted mode fails closed for unattended work, but Docker's documentation says it is defense in depth rather than a security boundary.[3]

The sandbox path runs the agent in a Docker sandbox virtual machine. A local sandbox mounts the current working directory read-write. Other configuration paths can be read-only, but files exposed through any mount remain available to the agent. The sandbox narrows placement. The permission rules decide which tools may act.[4]

That split matters. A safe-looking policy on the host does not create isolation. A sandbox with a broad writable mount does not create a narrow task.

Put a real meter on the run.

Docker Agent can cap cost, cumulative tokens, and working time. Named budgets form shared pots across every agent that references the name. The run-wide budget also includes sub-sessions and compaction calls.[5]

The limits are checked between turns. A call or tool already in flight can overshoot before the runtime stops. Cost limits also depend on pricing data. An unpriced model contributes no amount unless the configuration supplies custom pricing.

A budget is a stop condition, not a forecast. Save the configured ceiling and the observed termination record. Do not turn a zero-dollar counter from an unpriced model into a free-run claim.

Use this intake card.

  1. Record the source URL, revision, tag, and digest.
  2. Read the agent file before running it. List every tool, skill source, hook, model route, and writable path.
  3. Choose the execution host and sandbox route. Name each mount and allowed network host.
  4. Set user-owned safety defaults. Treat author-declared defaults as untrusted input.
  5. Set cost, token, and working-time ceilings with room for one in-flight turn.
  6. Run one denied action and one allowed read before the real workload.
  7. Save the exact config, runtime version, result, stop reason, and cleanup proof.
AGENT MANIFEST INTAKE
SOURCE=[URL + REVISION]
ARTIFACT=[TAG + DIGEST]
EXECUTION_HOST=[HOST OR SANDBOX]
WRITABLE_PATHS=[EXACT PATHS]
NETWORK_ALLOWLIST=[EXACT HOSTS]
SAFETY_MODE=[STRICT / BALANCED / RESTRICTED]
DENY_TEST=[COMMAND + RESULT]
BUDGET=[COST + TOKENS + WORKING TIME]
RUNTIME_RECEIPT=[VERSION + RESULT + STOP REASON]
STATUS=[TEMPLATE ONLY / RUN NOT VERIFIED]
Interactive makeover / manifest customs bay

Build the run card before opening the gate.

Traditional purpose replaced: a preflight checklist beside a terminal. Better version: four native controls light one connected inspection bus and produce a copyable run card. The final state means the template has all sections. It does not mean the agent passed them.

Pin sourceChoose placementBound authoritySet meter

Inspection switches

Select the sections your intake will require. These switches draft a card. They do not inspect a real agent file.

Required intake sections

Run card press

Every selected switch joins the same bus. Missing sections stay visible in the card.

Inspection bus0 of 4 selected
Customs verdict0 of 4 sections selected
Sources read / October 7, 2026

Source log

Open the evidence boundary
  1. docker/docker-agent on GitHub, read October 7, 2026. The README documents the standalone binary, Docker CLI plugin, YAML agent definition, tool sources, providers, and Apache 2.0 license.
  2. Docker Agent 1.149.0 release, published October 7, 2026. The release notes document GitHub repository skill loading, evaluator routing, pricing fixes, and TUI changes.
  3. Docker Agent permissions documentation, read October 7, 2026. It defines rule order, safety modes, user and author defaults, and the boundary between restricted mode and isolation.
  4. Docker Agent sandbox documentation, read October 7, 2026. It documents virtual-machine placement, mount behavior, network allowlists, cloud workspace behavior, and cleanup limits.
  5. Docker Agent budget documentation, read October 7, 2026. It documents cost, token, and working-time ceilings, shared named budgets, termination records, and turn-boundary overshoot.
  6. Docker Agent distribution documentation, read October 7, 2026. It documents OCI distribution, signing, digest pinning, authenticated fields, and limits of manifest annotations.
  7. Hacker News item 49996259, resolved through the official API and read October 7, 2026. It was the discovery route. Product claims above come from Docker's repository, release, and documentation.

Evidence boundary: the Linux AMD64 binary for version 1.149.0 was downloaded from the release. Its SHA-256 digest matched the digest returned by the GitHub Releases API. The version command reported version 1.149.0 and commit bf4169cdd31229d52385410c52c3dcc59b497858. The help command completed. No model was called, no agent file was run, no sandbox was created, and no registry artifact was pushed or pulled. The customs bay is an original teaching component. It drafts an intake card and does not inspect Docker Agent configuration.