They also propose a specification for a runtime - declarative credentials, network policies https://www.docker.com/blog/docker-sandbox-kit-spec/