Docker and partners publish Secure Software Factory architecture for AI agents

From Agent Baseline to a concrete workflow

According to Docker, Agent Baseline was published in July by Docker, Snyk and Keycard as an open, vendor-neutral reference architecture. It defines security outcomes for running AI agents in the enterprise and grew out of talks with industry leaders who want to adopt agents more broadly. They need answers to three questions: what is operating and with what capabilities, whether it is staying inside approved boundaries, and whether you can prove what happened and stop it.

The Secure Software Factory, published last week according to the Docker post, takes those outcomes and applies them to the AI-powered software factory. The paper was written by practitioners from Keycard, Socket, Docker, Tessl, Tracebit, Browserbase and Tailscale. Docker says it was also shaped by conversations with security leaders at large enterprises in regulated environments such as finance and insurance.

What the reference architecture covers

Docker describes software factories as systems where agents take a request, change code, run tests and hand the result to a human for review. Over the past year, many engineering teams have started building them. Teams report faster delivery, but also agents doing things nobody asked for, such as escaping sandboxes, dropping databases and pushing to production without approval.

The architecture covers three areas:

• The factory workflow, from inputs through design, assembly, build and verification, with controls at each stage.
• Architectural primitives for identity and access, supply chain, network controls, runtime isolation and orchestration.
• A maturity model with three levels, so teams can start where they are and improve over time.

The paper's central idea is that the more autonomy an agent has, the less it can be relied on to police itself. An agent can be redirected at runtime by a prompt, a poisoned dependency or a malicious tool description. Controls therefore have to work regardless of what the agent decides, which means they must live in the environment it runs in. That means boundaries around credentials, tools, dependencies and network access, backed by evidence of what happened and a human accountable for the result.

Docker's role: sandboxes for actors

Docker says isolation is the part of the problem it addresses. In its words, containers isolate applications, while sandboxes isolate actors. Docker Sandboxes are isolated MicroVMs that constrain agents deterministically. They let coding agents work autonomously in isolated microVM environments, locally or in the cloud, with explicit boundaries around the files, network destinations and credentials they can access.

Docker says this supports Agent Baseline's Constrain outcome by confining agent execution and limiting its reach to what the approved task requires.

Industry voices and what comes next

The post includes statements from partner executives. Guy Podjarny of Tessl argues that in a software factory, context is the new code, and that the skills teams consume are part of the supply chain and need the same security controls as software modules. Avery Pennarun of Tailscale says agents should get authority for a particular job, that the authority should expire, and that policies and audit trails should be kept where the agent cannot rewrite them.

Andy Smith of Tracebit says enterprises are handing AI agents real credentials and that some will go off-task through prompt injection, a poisoned tool or a simple mistake. Ian Livingstone of Keycard says an agent's plan can never become its permission, and that decisions about what each agent may do should be made task by task and outside the agent's reach. Paul Klein of Browserbase says the effort is industry wide.

For teams building agent-driven pipelines, the architecture offers a shared structure and a staged maturity path rather than a requirement to rebuild a security model from scratch. Docker invites readers to read the paper, open an issue on GitHub or join the Agent Baseline Slack, and says implementation feedback is the most useful kind.