A v3 descriptor and the image manifest that carries it
Left: the nine top-level entries of the kit.yaml of the hello kit, from the syntax line to the capabilities list, each with a note on what it becomes. Right: what the local registry returned for m101/hello-kit:v1, an OCI image index with no annotations and the linux/arm64 image manifest. The manifest carries four vnd.docker.sandbox.kit annotations, the descriptor as JSON with 402 derived deb provides, schema-version 3, the network-policy@2 capability, and built-by sandbox-kit 3.0.0-m.8, plus four org.opencontainers.image keys, the OCI config, and 16 layers with the sources staged at /usr/share/sandbox/kit/kit. Teal lines connect each descriptor row to the annotation or layer it becomes.
KIT.YAML OF HELLO-KIT, AS WRITTEN
WHAT THE REGISTRY RETURNED
hello-kit/kit.yaml
# syntax=docker/sandbox-kit:3
dispatches the frontend, sandbox-kit 3.0.0-m.8
schemaVersion: "3"
REQUIRED, exactly the string "3" (kitspec 4)
kind: workload
workload, mixin, or set (kitspec 4)
displayName: hello-kit
becomes org.opencontainers.image.title
description: A shell workload with one
network grant, in the v3 descriptor form.
becomes org.opencontainers.image.description
version: "1.0.0"
becomes org.opencontainers.image.version
licenses: [Apache-2.0]
becomes org.opencontainers.image.licenses
build: |
FROM docker/sandbox-templates:shell
COPY HELLO.md /home/agent/HELLO.md
the recipe of the layers (kitspec 3.2)
capabilities:
- type: com.docker.sandbox/network-policy@2
config:
runtime:
allow:
- example.com
a list of type and config (kitspec 7)
OCI image index, tag v1
application/vnd.oci.image.index.v1+json
linux/arm64 and an attestation manifest
annotations: none
platform manifest, linux/arm64
application/vnd.oci.image.manifest.v1+json
annotations
vnd.docker.sandbox.kit.descriptor
kit.yaml as JSON, plus 402 deb/ provides
vnd.docker.sandbox.kit.schema-version
"3"
vnd.docker.sandbox.kit.capabilities
com.docker.sandbox/network-policy@2
vnd.docker.sandbox.kit.built-by
docker/sandbox-kit 3.0.0-m.8, 129be2ff
org.opencontainers.image.*
title hello-kit, version 1.0.0,
licenses Apache-2.0, description
config
application/vnd.oci.image.config.v1+json
16 layers
shell template, HELLO.md, and sources
staged at /usr/share/sandbox/kit/kit
docker buildx build -f fixtures/kits/hello-kit/kit.yaml --builder m101-builder
-t m101-registry:5000/m101/hello-kit:v1 --push fixtures/kits/hello-kit
With the default docker driver, the same push kept no annotation (28-manifest-docker-driver.json).
The index carries none of the eight, although kitspec 9.3 promotes them there (28-index.json).