01 May 2026
Docker
A Virtual Agent team at Docker: How the Coding Agent Sandboxes team uses a fleet of agents to ship faster
I work on Coding Agent Sandboxes, aka "sbx" at Docker. The project provides secure, microVM-based isolation for running AI coding agents like Claude Code, Gemini, Codex, Docker Agent and Kiro. Agents get full autonomy inside a sandbox (their own Docker daemon, network, filesystem) without touching your host system. Over the past couple of weeks, we...
01 May 2026 1:00pm GMT
30 Apr 2026
Docker
From Security Blocked to Prod Ready: ClickHouse on Docker Hardened Images
In November 2025, a team self-hosting Langfuse, an open-source LLM observability platform, on Kubernetes uploaded their ClickHouse image to AWS ECR as part of their production preparation. They found that the pipeline scanner had returned three critical vulnerabilities - not in ClickHouse, but in the base image. Their security team saw the findings and blocked...
30 Apr 2026 3:55pm GMT
23 Apr 2026
Docker
Trivy, KICS, and the shape of supply chain attacks so far in 2026
Catching the KICS push: what happened, and the case for open, fast collaboration In the past few weeks we've worked through two supply chain compromises on Docker Hub with a similar shape: first Trivy, now Checkmarx KICS. In both cases, stolen publisher credentials were used to push malicious images through legitimate publishing flows. In both...
23 Apr 2026 3:32pm GMT