tag: Docker · 23 items
- Platform/SRE — Act: The Minimus registry goes offline October 22, 2026; audit all Dockerfiles, Helm charts, and Kubernetes manifests for Minimus base image references and complete migration to Docker Hardened Images before that date to prevent broken image pulls in production.
- CI/CD — Act: Any pipeline pulling from the Minimus registry will break after October 22, 2026; inventory all build Dockerfiles and CI base-image references now and migrate to Docker Hardened Images using the provided migration path and Docker’s free migration assistance before the deadline.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Demonstrates a pattern for running isolated AI agents inside GitHub Actions using Docker Sandboxes; worth evaluating as an emerging CI workflow design, but no concrete migration or deadline exists.
- Leader — Skip
- Platform/SRE — Learn: Docker’s extended security coverage and source-built images could reduce CVE surface on base images, but no EOL date or forced migration anchor exists — worth evaluating at next image refresh cycle.
- CI/CD — Learn: Policy enforcement moving to developer machines and provenance guarantees through customized images are worth tracking for supply-chain hardening plans, but no deadline or breaking change makes this actionable now.
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found)
- Platform/SRE — Learn: Pre-GA beta of Docker’s new VM manager; worth monitoring for potential performance and stability gains in local dev environments, but no production infra surface yet.
- CI/CD — Learn: Could eventually affect Mac/Windows runner performance if Docker VMM matures to GA, but it’s pre-GA with no pipeline action to take today.
- Leader — Skip
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Plan: Two regressions introduced in 29.7.0 — image pulls rejecting hardlink targets and file-permission failures on older kernels — are fixed in 29.7.2; if you upgraded to 29.7.x recently, schedule a patch to 29.7.2 to restore stable image pull behavior.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: Docker Sandboxes offers a managed isolation layer for AI agent workloads, which may influence how platform teams design compute sandboxing; no GA production-readiness signals or EOL pressure make this worth evaluating rather than acting on now.
- CI/CD — Learn: Disposable sandboxed environments could inform future pipeline isolation strategies for AI-assisted CI steps, but no concrete deprecation, supply-chain, or pipeline-breaking change warrants action today.
- Leader — Skip
- Platform/SRE — Plan: Two confirmed regressions patched: image pulls failing for layers with implicit parent directories, and CopyToContainer rejecting valid symlink paths like /var/run. Schedule an upgrade to 29.7.1 if running 29.7.x in production.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Plan: Upgrade Docker Engine to v29.7.0 to patch CVE-2026-17106 (go-archive archive-traversal fix) and resolve two daemon panic bugs in container network cleanup paths; the CVE is not KEV-listed so no hard deadline, but schedule this within the current sprint.
- CI/CD — Skip
- Leader — Skip
- Signals: CVE-2026-17106 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Skip
- CI/CD — Learn: Docker shell sandboxes offer a pattern for isolating build or testing environments; worth evaluating if pipeline isolation or reproducibility is a current concern.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Skip
- Leader — Learn: A widely-discussed retrospective on Docker’s evolution as a company and ecosystem is worth reading to calibrate vendor-risk and build-vs-buy thinking around container tooling strategy.
- Platform/SRE — Skip
- CI/CD — Learn: A developer tool switching container runtimes from Apple Containers to Docker may be relevant if your macOS-based build environments use NanoClaw, but no pipeline action is required without more detail on breaking changes.
- Leader — Skip
- Platform/SRE — Plan: Docker removing the cost barrier for hardened, minimal base images makes it practical to standardize on them across cluster workloads, reducing CVE surface without budget justification. Evaluate adopting Docker Hardened Images as the default base-image standard in your next quarterly planning cycle.
- CI/CD — Plan: Hardened base images are directly relevant to build-time and artifact supply-chain security; with the free tier now available, it’s worth scheduling a migration of pipeline build images and application Dockerfiles to hardened variants as a supply-chain hardening step.
- Leader — Learn: Docker making a previously premium security feature free reshapes the container security tooling landscape and is useful context for evaluating whether to formalize a hardened-image standard in the golden path, but no immediate strategic decision is required.
- Platform/SRE — Learn: Interesting pattern for edge/air-gapped deployments needing maps or geocoding without external API dependencies; worth evaluating if the platform serves such use cases.
- CI/CD — Skip
- Leader — Skip
- Platform/SRE — Learn: A practical explainer on BuildKit capabilities that may inform how the platform team configures build infrastructure, but no operational change is required.
- CI/CD — Learn: Worth reading for pipeline engineers looking to better leverage BuildKit features like cache mounts, multi-platform builds, or secrets handling, but nothing actionable without a specific gap to address.
- Leader — Skip
- Platform/SRE — Learn: A retrospective research article on Docker’s evolution over ten years may offer useful context on container ecosystem design decisions, but requires no operational action.
- CI/CD — Skip
- Leader — Learn: A decade-long academic retrospective on container adoption can inform strategic thinking about platform direction and the longevity of container-based infrastructure investments.
- Platform/SRE — Plan: Five CVEs fixed in Docker Engine including a command injection via git bundle checkout and a directory traversal that can wipe /tmp — no KEV listing or known active exploitation, but the severity warrants scheduling an upgrade to 29.6.2 this sprint.
- CI/CD — Plan: If Docker Engine runs on self-hosted CI runners or build hosts, the git-bundle command injection (CVE-2026-15793) and local-source upload bypass (CVE-2026-15789) are directly relevant to build-time workloads; plan to update runner environments to Docker 29.6.2.
- Leader — Skip
- Signals: CVE-2026-15788 — CISA KEV: not listed, EPSS n/a · CVE-2026-15789 — CISA KEV: not listed, EPSS n/a · CVE-2026-15791 — CISA KEV: not listed, EPSS n/a
- Platform/SRE — Learn: A case study on AI agent risk in production environments; useful for thinking about isolation and least-privilege patterns when AI tooling has infra access, but no operational change required.
- CI/CD — Learn: Relevant to teams integrating coding agents into build/deploy pipelines; the scoped-identity and sandboxed-execution patterns are worth evaluating before granting agents pipeline credentials.
- Leader — Learn: A concrete incident narrative illustrating the risk of ungoverned AI agent access to production systems; useful context for setting policy on AI tooling permissions before broader rollout.
- Platform/SRE — Learn: A high-engagement discussion on the trade-offs of plain Compose vs Kubernetes for smaller production workloads; worth reading to inform architecture decisions for teams with simpler needs.
- CI/CD — Skip
- Leader — Learn: Useful framing for build-vs-buy and complexity trade-off decisions when evaluating whether teams should adopt Kubernetes or stick with simpler orchestration for their scale.
- Platform/SRE — Plan: New Docker 29 installs default to the containerd image store rather than the classic overlay store, which changes image management behavior. Audit IaC and provisioning scripts that stand up Docker nodes to verify compatibility with the new default before rolling out Docker 29 to new infrastructure.
- CI/CD — Plan: Ephemeral CI runners provisioned fresh on Docker 29 will silently get containerd-backed image storage, which can alter layer-caching behavior and multi-platform build handling. Test existing build and image-export workflows against the new default before adopting Docker 29 runner images.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Bit-for-bit reproducible base images reduce supply-chain risk; worth following as a model if your pipelines use Arch-based images or if you’re evaluating reproducible build practices more broadly.
- Leader — Skip
- Platform/SRE — Learn: Pre-GA self-hosted sandbox tool using Docker without Kubernetes; worth monitoring as a lightweight alternative to cluster-based preview environments, but not GA so no action warranted.
- CI/CD — Learn: Pre-GA project that could inform preview-environment pipeline design without K8s overhead; evaluate once it reaches a stable release.
- Leader — Skip
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Learn: Interesting look at microVM isolation internals beneath Docker Sandbox; no production operational change needed, but useful context for teams evaluating lightweight VM-based sandboxing for workloads.
- CI/CD — Learn: Relevant background for teams considering Docker Sandbox as an isolated build or test environment; relies on an undocumented API so not actionable yet.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Worth evaluating if mobile CI is on the roadmap; this pattern runs Android emulators in containers with noVNC access and video recording, potentially replacing heavier mobile device farm setups.
- Leader — Skip