CuraDevOps

tag: Container-Security · 4 items

Plan Defender for Cloud adds GA support for Azure Container Apps posture
2026-09-02 · Azure Updates · source ↗ #azure#container-security#cloud-security
  • Platform/SRE — Plan: If your platform runs Azure Container Apps, this GA feature lets you consolidate posture management under Defender for Cloud rather than operating a separate security toolchain; evaluate enabling it this quarter.
  • CI/CD — Skip
  • Leader — Learn: Extends unified container security posture to serverless workloads on Azure — worth noting if your org is standardizing on Defender for Cloud as the security management plane.
  • Signals: GA announcement
Learn archived Docker promotes zero-CVE base images with extended security coverage
2026-08-18 · Docker Blog · source ↗ #supply-chain#container-security#docker
  • Platform/SRE — Learn: Docker’s extended security coverage and source-built images could reduce CVE surface on base images, but no EOL date or forced migration anchor exists — worth evaluating at next image refresh cycle.
  • CI/CD — Learn: Policy enforcement moving to developer machines and provenance guarantees through customized images are worth tracking for supply-chain hardening plans, but no deadline or breaking change makes this actionable now.
  • Leader — Skip
  • Signals: deprecation mentioned (no explicit date found)
Plan Docker Engine (Moby) v25.0.17 patches three container CVEs
2026-08-17 · Releases: moby · source ↗ #moby#container-security#cve
  • Platform/SRE — Plan: Three symlink/mount CVEs in the Docker engine (none KEV-listed, EPSS 0.00) warrant scheduling a patch to Moby 25.0.17 this sprint; also note that containerd 1.7 — vendored in this release — reaches EOL 2026-09-01, so any org running containerd 1.7 directly must plan a runtime upgrade within 15 days.
  • CI/CD — Skip
  • Leader — Skip
  • Signals: containerd 1.7 reaches EOL in 15d (2026-09-01) · major release (25.0) · CVE-2024-40635 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-41567 — CISA KEV: not listed, EPSS 0.00 · CVE-2026-41568 — CISA KEV: not listed, EPSS 0.00
Plan archived Docker Hardened Images now free for all developers
2026-07-22 · HN (docker) · source ↗ #container-security#supply-chain#docker
  • Platform/SRE — Plan: Docker removing the cost barrier for hardened, minimal base images makes it practical to standardize on them across cluster workloads, reducing CVE surface without budget justification. Evaluate adopting Docker Hardened Images as the default base-image standard in your next quarterly planning cycle.
  • CI/CD — Plan: Hardened base images are directly relevant to build-time and artifact supply-chain security; with the free tier now available, it’s worth scheduling a migration of pipeline build images and application Dockerfiles to hardened variants as a supply-chain hardening step.
  • Leader — Learn: Docker making a previously premium security feature free reshapes the container security tooling landscape and is useful context for evaluating whether to formalize a hardened-image standard in the golden path, but no immediate strategic decision is required.