Seneste nyt om platform og orkestrering
Kubernetes BlogIn this SIG Architecture spotlight we talked with Janet Kuo (Google) and Yuan Tang (TensorScale AI) about the journey of AI Conformance in Kubernetes, from the initial Working Group to the integration SIG Architecture as a subproject. IntroductionsFrederico Muñoz and Kirti Goyal (FK): Hi Janet, Yuan, and thank you for the opportunity to learn a bit more about AI Conformance. Can you tell us a bit about yourselves and how you got involved in Kubernetes? Janet Kuo: I'm a Senior Staff Software Engineer at Google and have been a Kubernetes maintainer since 2015, joining the community just as we were racing toward the 1.0 launch. I started my journey writing the core workload controllers that standardized how applications are orchestrated on Kubernetes. Today, I lead SIG Apps as a Co-chair & TL, and also lead the AI Conformance program
29 October , 2026DockerOver the past year, almost every conversation I’ve had with a partner has ended in the same place. Their customers are moving AI agents out of the lab and into production, and the moment they do, the question changes. It stops being “Can we build this?” and becomes “Can we trust it, secure it, and govern it?” The partners who can answer that second set of questions are the partners customers keep. Today, we are launching the Docker Navigator Partner Program to help you become that partner. This post explains what we’ve built, why we built it around AI governance, and how you can get the most from it
28 October , 2026Kubernetes BlogWe are excited to announce that the Kubernetes community now has a Workload Conformance Working Group. The working group is writing a shared standard for how workloads behave at runtime on Kubernetes. To get it right, we need input from the people who build those workloads and from the people who run the clusters they're deployed on. Why workloads need a shared standardCertified Kubernetes tests the cluster, and Kubernetes AI Conformance tests whether a cluster can run AI and ML workloads. Nothing comparable exists for the workloads themselves, so cluster operators still check each application by hand before routine maintenance or a Kubernetes upgrade
27 October , 2026DockerTwo security events landed side by side this week, PHP2Shell and the eMudhra certificate compromise. Both reached the same place, the foundation their applications are built on. PHP2Shell is a pair of critical flaws in the PHP engine itself, CVE-2026-109618 and CVE-2026-109619. They let an unauthenticated request become code execution on the server, on any PHP application, however careful its own code is, and PHP runs about 69% of the websites whose server-side language is known. The eMudhra compromise is a different kind of problem
23 October , 2026DockerSummary On Tuesday, October 20, 2026, Docker began tracking two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, commonly known as PHP2Shell. The vulnerabilities allow attackers to execute code remotely in PHP core, and they affect PHP packages going back to version 5.4: the supported versions 8.2 through 8.5, and the end-of-life versions 5.x, 7.x, 8.0, and 8.1. To address these vulnerabilities, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and advised anyone running PHP to update to the latest version immediately. Although this is a vulnerability in PHP itself, not in Docker’s systems, it nonetheless affects Docker users who build on PHP images and packages. In response, we have updated the Docker Hardened Images and Docker Official Images on Docker Hub, and advise customers to immediately update
22 October , 2026DockerEven security teams that have invested in a hardened base image often can’t say what’s running on top of it. In a recent survey of 250 North American DevSecOps leaders, 91% named visibility into container components as their single biggest blind spot. Not the base image, but everything layered onto it. And 90% said their teams still run lightly modified public images with little to no hardening. That gap is getting harder to ignore
22 October , 2026DockerYour sandboxed agents just got a team. The official BAND AI kit for Docker Sandboxes is now available at docker.io/bandhq/band-python-kit:latest. Docker Sandbox kits package everything an agent needs to run in a Docker Sandbox, so a single sbx create command gives you a ready-to-use agent environment. But an isolated agent is only half the story: real work means talking to people and to other agents. The BAND AI kit connects a sandboxed agent to the world
21 October , 2026DockerIn July, Docker, Snyk and Keycard published Agent Baseline, an open, vendor-neutral reference architecture that defines security outcomes for running AI agents in the enterprise. It grew out of conversations with industry leaders who want to adopt agents more broadly but need answers to three questions: What is operating, with what capabilities? Is it staying inside approved boundaries? Can you prove what happened and stop it? Agent Baseline gave the industry a shared frame of reference for secure agent adoption by defining the security outcomes for safely deploying agents in organizations. Last week, we published the Secure Software Factory reference architecture, which applies those outcomes to one of the most common agentic workflows: the AI-powered software factory. Enter the Secure Software Factory The Secure Software Factory was written by practitioners from Keycard, Socket, Docker, Tessl, Tracebit, Browserbase and Tailscale and shaped by conversations with security leaders at large enterprises in regulated environments such as finance and insurance. Over the past year, many engineering teams have started building software factories: systems where agents take a request, change code, run tests and hand the result to a human for review
21 October , 2026DockerWhat the 2026 Stack Overflow Developer Survey tells us about where trust goes next If you’ve followed Docker lately, you know we’re all-in on sandboxes. We’ve spent a ton of time talking about the difference between sandboxes and containers, and helping our customers and the industry as a whole understand when to use which. In fact, Docker president Mark Cavage dedicated his opening keynote at WeAreDevelopers World Congress North America to this exact topic, using live demos to show why sandboxes (and not containers) provide the level of isolation required to contain autonomous agents. To be clear: none of that means we suddenly think less of containers or the vital role they will continue to play in the software development process and ecosystem. We are Docker, after all
16 October , 2026