Docker has published a Secure Software Factory reference architecture that builds on the earlier Agent Baseline specification. The new document maps the baseline’s security outcomes onto the end‑to‑end workflow of AI‑driven code generation, testing, and hand‑off, giving engineers a ready‑made blueprint for protecting autonomous agents in a software‑factory context.
Applying Agent Baseline Outcomes to the Factory
The Agent Baseline defines three core questions for any AI agent: what is it operating, does it stay within approved boundaries, and can its actions be proven and stopped if needed. The Secure Software Factory paper translates these questions into concrete checkpoints at each stage of the pipeline – from request intake through design, assembly, build, and verification. The central premise is that the more autonomy an agent receives, the less it can be trusted to self‑police; therefore, controls must be enforced by the surrounding environment rather than the agent itself.
Architectural Primitives Introduced
The architecture recommends a set of primitives that can be combined to satisfy the baseline outcomes:
- Identity and access controls that limit which credentials, tools, and dependencies an agent can reach.
- Supply‑chain safeguards that treat AI‑generated skills as software components, subject to the same verification steps as traditional code.
- Network segmentation that restricts outbound destinations based on the task’s declared needs.
- Runtime isolation provided by
Docker Sandboxes, which are isolated MicroVMs that deterministically constrain file system, network, and credential exposure. - Orchestration hooks that inject verification steps and audit logging before an agent’s output proceeds to the next stage.
Docker Sandboxes are highlighted as the mechanism that delivers the “Constrain” outcome of the baseline, ensuring that an agent cannot exceed the explicit boundaries defined for its task.
Maturity Model for Incremental Adoption
The reference includes a three‑level maturity model. Level 1 establishes basic isolation and credential scoping; Level 2 adds supply‑chain verification and network controls; Level 3 introduces full audit trails and human‑in‑the‑loop accountability for each stage. Teams can adopt the model at the level that matches their current risk posture and evolve upward as confidence and tooling improve.
Related CloudNinjas coverage: security.
What This Means For Practitioners
For AI engineers, cloud/platform engineers, DevOps/SRE staff, and security specialists, the Secure Software Factory provides a concrete checklist:
- Map each agent task to a sandbox definition that enumerates allowed files, network endpoints, and secrets.
- Integrate identity checks and supply‑chain validation into the CI/CD pipeline, treating generated code and tool descriptors as first‑class artifacts.
- Instrument the workflow with immutable logs that capture who authorized each step and what the agent actually did.
- Adopt the maturity model incrementally, starting with isolation and expanding to full audit and human review as the organization’s risk tolerance evolves.
By anchoring controls in the execution environment rather than the agent’s internal logic, teams can grant agents the autonomy needed for rapid delivery while retaining the ability to stop or roll back actions that deviate from policy. The reference architecture also offers a shared vocabulary for cross‑team discussions, reducing the need to reinvent security models for each new AI‑enabled workflow.
