Skip to content
Today
Sign in

project

Docker

Container build and runtime tooling whose Dockerfile layer cache, COPY --from=builder behaviour, and cache-invalidation documentation are central to the post.

Sign in to follow

Known aliases

  • container
  • DinD
  • Docker API
  • Docker build
  • docker CLI
  • docker.com
  • docker compose
  • dockerd
  • Docker daemon
  • Docker Desktop
  • Docker Engine
  • Dockerfile
  • Dockerfiles
  • Docker Hub
  • Docker image
  • docker images
  • Docker Inc
  • Docker Inc.
  • Docker, Inc.
  • Docker-in-Docker
  • docker run
  • docker.sock
  • Docker socket
  • docker stats
  • Docker Swarm
  • runc

Relationships

No evidence-backed relationships are recorded.

Current stories

build1 publisher

Docker Sandbox kit confines a DeepAgents agent to one local model port

DeepAgents runs in a four-file Docker Sandbox kit whose agent can reach only a local Model Runner on port 12434, with no cloud keys. The egress policy is careful work, and exact reproduction still rests on what PyPI serves when each sandbox is created.

Publishers:dev.to

Reality

Evidence45
Adoption
Insufficient
Hype gap+15
Incentives
Insufficient
Confidence40
build1 publisher

Portainer's Community Edition stops at 2.45 LTS

Portainer says 2.45 LTS ends its Community Edition line and 3.0 ships Kubernetes-first, with free use only through 3 Nodes Free. Docker-host operators now pick a fixes-only 2.x, an account-licensed 3.x or another tool, with no forced deadline yet.

Publishers:dev.to

Reality

Evidence45
Adoption
Insufficient
Hype gap+10
Incentives55
Confidence40
security3 publishers

CARBONATO botnet infects Docker hosts, prioritizing theft of AI provider API keys

CARBONATO, a Docker botnet running since October 2024, hijacks hosts on open port 2375 and steals keys from 14 AI providers to fund its own LLM gateway. ThreatDown found the crew's own container registry exposed, handing defenders 4.3 GB of its toolchain.

Publishers:bleepingcomputer.comscworld.comsecurityaffairs.com

Perspective Coverage

3 publishers
Builder
Builder 33%
Operator
Operator 57%
Investor
Investor 10%

Reality

Evidence60
Adoption
Insufficient
Hype gap+20
Incentives35
Confidence60
build1 publisher

systemd's mstack mounts a single-layer stack writable by default

systemd's mstack mounted a single-layer directory writable by default in a dev.to test, and one written line overwrote a read-only file with exit code 0. Anyone shipping a one-layer stack in a unit file has to prove read-only with a test write.

Publishers:dev.to

Reality

Evidence45
Adoption
Insufficient
Hype gap+30
Incentives
Insufficient
Confidence35
build1 publisher

Binding a dev server to 0.0.0.0 hands it to everyone on the LAN

A developer scanned their own MacBook from a second machine on the same network. The parts macOS ships were invisible; the exposure that stayed open was the dev servers they had left running, wider than they thought.

Publishers:dev.to

Reality

Evidence50
Adoption
Insufficient
Hype gap+5
Incentives65
Confidence55
build1 publisher

Spoofed admin headers hit Traefik's catchall 500 times out of 500

Traefik 3.6's release material says child routers cannot be called directly. A test on 3.6.25 sent the exact header a child router matches, on a path outside the parent prefix, 500 times, and none of it reached the admin service.

Publishers:dev.to

Reality

Evidence62
Adoption
Insufficient
Hype gap+12
Incentives22
Confidence58

Earlier coverage

  1. Opening a stranger's repo in OpenAI Codex handed its author commands on the host

    Security · September 20, 2026 · 1 publisher

  2. Portop resolves a busy port by matching socket inodes against every process's open files

    Build · September 19, 2026 · 1 publisher

  3. Residential proxy pools are pushing edge defence down to the TCP handshake

    Build · September 19, 2026 · 1 publisher

  4. A sleeping laptop expired a 30-second HTTP budget by half an hour

    Build · September 18, 2026 · 1 publisher

  5. searxng-gateway starts its paid providers before it knows whether SearXNG failed

    Build · September 18, 2026 · 1 publisher

  6. Chromium's user-namespace sandbox survives the hardening that kills its setuid helper

    Build · September 18, 2026 · 1 publisher

  7. Junie /demo builds the app and drives the UI so the reviewer watches instead of clicking

    Build · September 18, 2026 · 1 publisher

  8. CVE-2026-77179 let sandboxed agent code write anywhere the macOS host account could

    Security · September 17, 2026 · 1 publisher

  9. LocalStack's March image ties every CI run to a registered account's auth token

    Build · September 16, 2026 · 1 publisher

  10. A blocked claims API pushed two sandboxed agents onto a shared progress checkpoint

    Build · September 16, 2026 · 1 publisher

  11. One column in ollama ps separates a driver fault from a VRAM shortfall

    Build · September 16, 2026 · 1 publisher

  12. IntelliJ IDEA 2026.2 changes the log expression on a running server without a redeploy

    Build · September 16, 2026 · 1 publisher

  13. Fifteen deliberate primary kills put Redis Sentinel failover at down-after plus two seconds

    Build · September 16, 2026 · 1 publisher

  14. Strix's agent read Baseten's image config and found a live GitHub admin token from March 2023

    Build · September 15, 2026 · 1 publisher

  15. Postgres walks all 110,659 pages of a 1.2 GB table to answer OFFSET 9999980 LIMIT 20

    Build · September 15, 2026 · 1 publisher

  16. A singleton cron must list its tenants before a tenant filter has anything to bind to

    Build · September 15, 2026 · 1 publisher

  17. Keewano's $12M agent database asks for a second copy of your event stream

    Product · September 15, 2026 · 1 publisher

  18. Redis 8.10 converts hashes to the compact encoding only on HIMPORT or an RDB reload

    Build · September 15, 2026 · 1 publisher

  19. A build target greps a fake version string out of both binaries to prove the ldflags symbol exists

    Build · September 14, 2026 · 1 publisher

  20. Background Agents hands the task to a second model when one tool call fails three times

    Build · September 14, 2026 · 1 publisher

  21. xz refuses to unpack a PHP extension when Docker's seccomp answers Landlock with EACCES

    Build · September 14, 2026 · 1 publisher

  22. A WhatsApp line sat dead for 86 hours behind a container Docker called healthy

    Build · September 13, 2026 · 1 publisher

  23. Debian 13 boots as an Apple container machine only after a Dockerfile supplies /sbin/init

    Build · September 13, 2026 · 1 publisher

  24. Refusal-stripped open-source agents broke five of a researcher's own accounts in five hours

    Security · September 13, 2026 · 1 publisher

  25. A missing dollar sign made a redeploy hook stop a container that never existed

    Build · September 12, 2026 · 1 publisher

  26. Replacing node objects with integer indexes lifts a PHP LRU to 13.1 million ops/sec

    Build · September 12, 2026 · 1 publisher

  27. Docker Bake prints the resolved build configuration before it builds anything

    Build · September 11, 2026 · 1 publisher

  28. Adding NATS JetStream to a Jepsen-style harness took zero changes to the checker

    Build · September 11, 2026 · 1 publisher

  29. Unexplained pending pulls showed up an hour before the antivirus found the fake font

    Build · September 10, 2026 · 1 publisher

  30. Dropping curl, git and vim explains 74 MB of a 385 MB Docker image cut

    Build · September 10, 2026 · 1 publisher

  31. One Docker log fixture carries the entire margin in a thirty-run local-model benchmark

    Build · September 10, 2026 · 1 publisher

  32. Alby's cloud guides told wallet owners to open the port its takeover flaw needs

    Security · September 9, 2026 · 1 publisher

  33. A pull request comment triggered a trusted workflow that published ten malicious npm versions

    Build · September 8, 2026 · 1 publisher

  34. KVM's bare metal requirement turns Firecracker CI runners into a bin packing problem you own

    Build · September 7, 2026 · 1 publisher

  35. Two agent sandboxes ship an unauthenticated shell endpoint on every interface

    Build · September 6, 2026 · 1 publisher

  36. A UDP socket carries Frag Gap from inside a container into host kernel memory

    Build · September 6, 2026 · 1 publisher

  37. Postgres 18 hands the audit row to the statement that overwrote the balance

    Build · September 6, 2026 · 1 publisher

  38. Free memory climbed while one request hit 56 seconds during a package-update spike on a $0 n8n box

    Build · September 6, 2026 · 1 publisher

  39. One Self-Hosted Setup Cuts a $198 Platform Bill to a $24 Droplet

    Build · September 3, 2026 · 1 publisher

  40. GitGuardian finds a Shai-Hulud variant sweeping 469 credential paths across CI/CD and AI configs

    Security · September 3, 2026 · 1 publisher