DevOps

For a small vehicle-rental business, the first technology problem is rarely advanced fleet analytics. It is usually much simpler: customers cannot see available vehicles, booking details are buried in WhatsApp, prices are quoted differently by different people, and the same car or bike may accidentally be promised twice. The best free vehicle rental management software for cars and bikes should solve those immediate problems without forcing a new operator to pay a large monthly subscription

Docker Captains are leaders from the developer community that are both experts in their field and are passionate about sharing their Docker knowledge with others. “From the Captain’s Chair” is a blog series where we get a closer look at one Captain to learn more about them and their experiences. Today we are interviewing Mohammad-Ali A’râbi, a Docker Captain based in the sunniest German city, Freiburg. He is the author of the book “Docker and Kubernetes Security,” a Best DevOps Book of the Y

Agents have moved from demos to daily work faster than almost anyone planned for. In our State of Agentic AI report, 60% of organizations already run AI agents in production, and yet 40% name security and compliance as the number-one thing holding them back from scaling further. That gap, between what teams have already shipped and what they can safely operate, is the real story of AI agents right now. But what is an AI agent, and why does the term suddenly stretch from a coding assistant to

Why Docker is excited to co-host the first WeAreDevelopers World Congress North America When we announced our partnership with WeAreDevelopers, AI agents were still mostly something developers experimented with. Today, they’re becoming part of everyday software development. That’s why the timing for this year’s WeAreDevelopers World Congress couldn’t be better. In the months since that announcement, the developer landscape has changed dramatically. If

We spent the week at AI Engineer World’s Fair in San Francisco, on stage and on the floor. Here’s what we heard, and where we think it lands for anyone building with agents. The SDLC is being rebuilt in public This week at AIE felt like a synthesis of what’s been playing out in developer tools for the last few years, for anyone who’s been watching. The software development lifecycle is reshaping itself into an AI-native SDLC, and the industry is naming the new jo

Think of sun-kissed golden sands, swaying palm trees, vibrant night markets, and the soothing sound of crashing waves. Yes, we are talking about Goa, India’s ultimate pocket-sized paradise. Whether you are searching for the best places to visit in Goa, looking for a thrill through water sports in Goa, or planning a peaceful retreat, this tiny coastal state offers something magical for every traveler. Planning a trip here can feel overwhelming because there is simply so much to see and do. Th

Selecting the right hospital for aesthetic procedures is a major life decision. Today, looking for the best cosmetic hospitals in the world frequently takes patients across international borders. The rise of globalized healthcare has made cosmetic surgery abroad a highly accessible path for individuals seeking world-class medical expertise, advanced clinical technologies, and cost-effective treatment options. Navigating international healthcare can feel overwhelming. This comprehensive patie

Introduction Order Management Systems (OMS) tools have become essential in the modern business environment, helping organizations streamline their operations, improve customer satisfaction, and boost overall efficiency. As companies move towards digital transformation, the demand for robust, scalable, and easy-to-integrate order management systems continues to grow. In 2026, businesses face the challenge of managing a fast-paced, omnichannel world. Customers expect seamless, real-time or

Wistia is a capable video marketing platform, but two patterns drive teams to start looking elsewhere. The first is pricing: the free tier is locked to a single user with Wistia branding on the player, and the next step up is the Business plan at $79 per month, with no mid-tier in between. The second is page performance: Wistia’s embed loads JavaScript bundles, CSS, and font resources at page render, and for teams running high-traffic landing pages or product pages with aggressive Core W

A few years ago, the most powerful AI tools in a developer’s workflow helped write code. Today, they can do much more. It’s increasingly common to hand an AI agent a task like: Read this repository, refactor the authentication service to match the new specification, run the test suite, and open a pull request if everything passes. The agent reads files, analyzes dependencies, executes commands, modifies code, and interacts with external systems. In many cases, it can complete meaningful c

Introduction For many years, software development and IT operations lived in separate, isolated silos, creating manual friction and delayed releases until DevOps emerged to bridge this gap through a culture of collaboration, automation, and continuous improvement. Today, the sheer volume of software, platforms, and methodologies on modern cloud-native landscape maps often leaves beginners feeling overwhelmed and attempting to master everything at once. However, learning tools in a logical se

Introduction Modern enterprise software development has evolved into a hyper-complex ecosystem where relying on a fragmented array of decoupled tools—like GitHub, Jenkins, Terraform, and Kubernetes—frequently leaves engineering executives blind to actual delivery maturity, systemic security vulnerabilities, and deployment bottlenecks. To bridge this gap, forward-thinking organizations are adopting a dedicated Software Delivery Governance Platform like SCMGalaxy OS, which acts as an overarchi

Introduction AI background removal tools have revolutionized how images are edited, allowing professionals and casual users alike to easily remove or replace backgrounds in photos. These tools, powered by artificial intelligence and machine learning, automatically detect and remove backgrounds, saving significant time compared to manual editing. Whether you’re an e-commerce seller, photographer, graphic designer, or social media influencer, these tools are essential for creating clean, prof

Introduction In today’s fast-paced digital world, effective communication is key to success, especially when presenting ideas, projects, and pitches. Whether for business meetings, educational purposes, or personal projects, the right presentation software can make all the difference in delivering impactful and visually engaging presentations. In 2026, the market for presentation software tools is more diverse than ever, offering a wide range of features to cater to various professional need

Introduction In today’s digital age, the power of a well-designed presentation cannot be overstated. As businesses, educators, and creators rely on visuals to communicate their ideas, AI-driven presentation design tools have emerged as a game-changer. These tools leverage artificial intelligence to help users craft compelling, visually appealing presentations in minutes, saving time and boosting creativity. AI Presentation Design Tools in 2026 are essential for professionals who want to

Introduction In 2026, AI-driven design tools are revolutionizing the way posters and flyers are created, making the design process faster, easier, and more accessible to everyone from small businesses to large corporations. AI Poster & Flyer Designers tools leverage the power of artificial intelligence to automate and enhance design tasks, making it possible for anyone—whether they have a background in graphic design or not—to create visually stunning and professional designs in just a f

Introduction In the ever-evolving digital world of 2026, graphic design is increasingly powered by artificial intelligence (AI), revolutionizing the creative industry. AI graphic design tools are designed to automate and enhance the design process, making it accessible, faster, and more efficient. These tools can generate stunning designs, suggest layouts, and optimize images based on the user’s input. AI’s ability to assist with tasks such as resizing, color adjustments, or generating creat

Introduction In 2026, web design continues to be a cornerstone of digital presence, playing a crucial role in how brands, businesses, and creators engage with audiences. Web Design Software tools are essential platforms that help users build, edit, and publish visually appealing, responsive, and interactive websites without the need for extensive coding knowledge. Whether you’re a freelance designer, a startup founder, or a large-scale enterprise, the right web design tool can make the d

Introduction In 2026, the demand for high-performance, visually appealing, and responsive websites continues to rise as more businesses, creators, and freelancers seek a strong online presence. Website builders have become essential tools, allowing users of all skill levels to create professional websites without needing advanced coding knowledge. Whether you’re launching a personal portfolio, an eCommerce store, or a company site, a reliable website builder can drastically reduce time-to-ma

Introduction In today’s digital landscape, establishing a recognizable brand identity is paramount, and a logo plays a crucial role in this process. For entrepreneurs, small businesses, and even established companies, having a professional and eye-catching logo is essential to create a lasting impression. However, hiring a designer or agency can be costly, leading many to explore logo generator tools. Logo generators are online tools that allow users to create logos quickly and efficient

Introduction Mastering DevOps is an ongoing journey that requires far more than passive course completion; it demands a structured approach centered on hands-on application, troubleshooting, and architectural understanding. To navigate this complex landscape without losing momentum, you must move beyond collecting certifications and start measuring tangible progress through project outputs, skill matrices, and consistent self-assessment. By focusing on building real-world solutions rather th

Introduction Modern IT environments have moved far beyond the monolithic architectures of the past. Today, we operate in complex, hybrid-cloud ecosystems driven by microservices, containerization, and ephemeral workloads. For an average SRE or DevOps team, the sheer volume of data generated is overwhelming. You are likely familiar with the “alert storm”—the scenario where your monitoring system fires thousands of notifications during a minor incident, burying the actual root cause under a mo

AI coding agents are quickly becoming part of everyday development workflows. Today, AI tools can write and execute code, install dependencies, debug repositories, interact with APIs, automate terminal tasks, and modify project files. What once required constant developer involvement can increasingly be delegated to AI-assisted workflows.  This shift is exciting, but it also changes an important assumption in software development: Should AI-generated code run directly on your machine? As AI

The technology landscape is shifting rapidly toward automation, cloud-native architectures, and platform-driven delivery models, making the role of the DevOps engineer more critical than ever. In this evolving environment, true career stability is not built on memorizing the latest software release, but on mastering the fundamental principles of system architecture, infrastructure automation, and continuous delivery. Employers today increasingly prioritize candidates who demonstrate practical, h

Introduction In the rapidly evolving landscape of modern software development, DevOps has firmly established itself as one of the most in-demand career paths in the IT industry. Organizations across the globe are moving toward agile, automated, and cloud-native environments, creating a massive need for professionals who can bridge the gap between development and operations. However, many beginners fall into the trap of chasing the latest flashy tools without first understanding the underlyin

The journey toward financial independence often begins with a single step: understanding how money works. In an era where financial markets are more accessible than ever, the interest in equity participation has reached new heights. However, for many, the stock market remains a complex puzzle characterized by volatility and technical jargon. This is where the importance of financial literacy becomes paramount. Navigating these markets without a map is akin to sailing in a storm without a compass

Modern enterprises operate in an environment where the speed of delivery is as critical as the quality and security of the product. Achieving this balance requires more than just adopting new tools; it necessitates a fundamental shift in how teams build, deploy, and manage software. Partnering with a specialized DevOps consulting company allows organizations to navigate this complex transition effectively. At cotocus, we support firms in refining these operational workflows to ensure sustained c

For teams building AI-governed systems, the EU AI Act adds compliance obligations to every stage of the development lifecycle, from documenting training data to reporting incidents in production. With phased enforcement already underway, now is the time to assess where your workflows stand. The EU AI Act (Regulation (EU) 2024/1689) is the world’s first comprehensive AI regulation. It entered into force in August 2024 with requirements rolling out in phases through 2027. The Act applies, amon

According to Omdia’s 2026 software supply chain security report, 86% of organizations find SBOM generation challenging. A major driver is tool sprawl: teams cobbling together different scanners for different artifact types, getting inconsistent output across pipelines, and spending engineering time reconciling the results rather than acting on them. SBOMs have become important to how security teams respond to vulnerability disclosures, how compliance teams satisfy auditors, and how procureme

The EU Cyber Resilience Act (CRA) was officially introduced on December 10th 2024, to protect foundational EU values in the face of rising cyberattack threats. As cyberattacks targeting products with digital elements have grown more frequent and costly, the regulation establishes the first horizontal cybersecurity baseline for all hardware and software products sold in Europe. The urgency is real given that in Omdia’s 2026 software supply chain security report, 77% of organizations reported expe

In Omdia’s 2026 software supply chain security report, 73% of organizations that generate SBOMs say they enable more efficient vulnerability mitigation, yet 86% still find the generation process challenging. That gap between recognized value and operational difficulty is where most teams are stuck. For teams building and securing containerized applications, understanding what an SBOM is, and how to make it useful, is no longer optional. This guide covers what SBOMs contain, why they matter f

Introduction If you find yourself stuck in a cycle of endless tutorials without feeling confident enough to handle real-world infrastructure, you are likely missing the most critical component of DevOps mastery: hands-on experience. Theory alone can only take you so far; the true transition from a learner to an engineer happens when you stop watching and start building in a safe environment. A DevOps home lab serves as your personal proving ground, allowing you to bridge the gap between “kno

Introduction In the modern business landscape, digital transformation has evolved from a strategic advantage into an existential necessity, forcing enterprises to abandon siloed, legacy IT models in favor of agile, cloud-native frameworks. As organizations strive to balance increasing market demands with the need for operational resilience, DevOps has emerged as the critical bridge between business strategy and technical execution, effectively transforming IT departments from mere cost cente

By Ram Venkataraman, CEO, KIBO Commerce Technical debt is quietly eroding the value of B2B Commerce platforms — and most organizations don’t see it until it shows up on the balance sheet. Commerce leaders in manufacturing, distribution, and wholesale are all facing the same conundrum. The ERP team committed to an established back-office platform. The storefront team championed a leading eCommerce solution. Operations inherited a standalone OMS that’s too embedded to replace. Each decisio

Modern enterprise infrastructure has outgrown human capacity. Cloud-native ecosystems generate an overwhelming amount of telemetry data—millions of logs, metrics, and traces pass through your monitoring pipelines every single second. When an outage occurs, it rarely triggers a single, clear alert. Instead, it sparks a catastrophic alert storm, drowning your on-call engineers in noise while systems crumble. Traditional monitoring frameworks operate on static, hard-coded thresholds. They tell

In Part 1, we walked through six categories of AI coding agent failures and why they keep happening. The agent runs as you, with your filesystem permissions and your credentials, and nothing sits between the model’s decision and the shell’s execution. In Part 2, we looked at one specific version of that failure in detail, the rm -rf ~/ incident that wiped a developer’s entire Mac in a single command. Part 3 moves the same problem up the stack, into a production AWS environment where the blast ra

Introduction When you first step into the world of DevOps, it can feel like you have arrived in a foreign country where everyone speaks a different language. You hear terms like pipelines, containers, and orchestration thrown around in meetings, and it is easy to feel overwhelmed. DevOps is not just a collection of tools; it is a philosophy that bridges the gap between software development and IT operations. Because of this, it has developed a specialized vocabulary that defines how we build

TLDR: Docker Content Trust (DCT) and the Notary v1 service at notary.docker.io are being fully retired (first announced in July of 2025). This blog explains what is changing, who is affected, and how to move to modern alternatives.  Ten years ago, Docker Content Trust (DCT) gave the container ecosystem one of its first ways to verify the integrity and publisher of an image, built on The Update Framework and the Notary v1 project. The upstream Notary v1 codebase is no longer maintained, more

The obvious takeaway from 2026’s biggest incidents is that attackers are increasingly using AI to move fast. Docker’s CISO, Mark Lechner, wrote about this shift and what every engineering team should do now. What worries us is that the bar is about to drop further. For most of the last decade, finding a serious vulnerability in widely used open source took time and specialized skill. Frontier models now read code, reason across dependencies, and surface novel, chained vulnerabilities at mach

Introduction If you are just starting your journey in the world of technology, you have likely heard the term DevOps tossed around in almost every job description. It is a common point of confusion for beginners, students, and even experienced professionals. Many people search for “what is a DevOps engineer,” thinking it is a single job title that requires knowing everything under the sun. The truth is that DevOps is not one single role. Instead, it is a cultural and professional approac

Aikido now scans Docker Hardened Images (DHI) with built-in VEX support. Vulnerabilities that Docker has verified as non-exploitable drop out of the queue automatically, so developers spend their time on findings that actually matter. This post walks through what changed, why it matters, and how users can benefit from the new integration. Why teams are drowning in CVEs Modern application teams drown in CVEs. And the volume is climbing fast. AI coding agents now generate and assemble

Introduction In the world of software engineering, we often talk about speed. We talk about CI/CD pipelines, containerization, and the race to production. However, speed without direction is dangerous. If you are shipping code quickly but failing to understand the impact of that code, you are not doing DevOps; you are simply creating problems faster. This is where feedback loops become the most important component of your engineering culture. Software teams cannot improve without knowing

Introduction Entering the world of software development and IT infrastructure can feel overwhelming. Many new students face an avalanche of technical terms like containers, orchestrators, and automated workflows right at the start of their learning journey. It is entirely common to feel confused about how all these pieces fit together. The primary reason for this struggle is that traditional computer science education often focuses heavily on writing code, while ignoring how that code ac

Understanding software supply chain security is one thing. Putting it into practice across a real pipeline, with real deadlines and real constraints, is another. Most organizations recognize that their software supply chain is a growing attack surface, but translating that awareness into concrete, repeatable practices is where the work gets difficult. But why should your team tackle this now? According to Sonatype, over 99% of open source malware identified in 2025 occurred on npm. And the f

Introduction Software development has changed drastically over the last decade. In the past, companies released software once or twice a year. Today, users expect new features, security updates, and bug fixes on a weekly or even daily basis. This pressure to release code faster has forced development teams to rethink how they build, test, and deliver applications. Teams that rely on manual processes often struggle with integration errors. When developers work in isolation and merge their

Introduction In 2026, no-code platforms have revolutionized the way businesses and individuals build applications. These platforms enable users with little to no coding experience to create functional, custom solutions. Whether it’s designing websites, automating processes, or building complex enterprise-level applications, no-code tools have democratized software development, making it accessible to everyone from small businesses to large enterprises. The importance of no-code platforms

AI agents are moving fast. According to our State of Agentic AI report, 60% of organizations already have AI agents in production, yet 40% cite security and compliance as the number-one barrier to scaling them further. And that gap between adoption and oversight is exactly where AI governance lives. As AI takes on higher-stakes decisions and agents begin operating with greater autonomy, the organizations that lack clear guardrails face mounting exposure to regulatory penalties, security vuln

Planning a trip often feels like balancing a complex puzzle. Between hunting for reliable accommodation, decoding confusing transportation schedules, and trying to find authentic local experiences, the excitement of travel can quickly be overshadowed by the stress of logistics. While search engines provide a flood of generic information, they often lack the personal touch and real-world nuance required to make a trip truly memorable. This is where community-driven knowledge transforms the planni

Modern travel is undergoing a significant transformation. Today, discerning travelers are moving beyond conventional tourist traps and pre-packaged corporate itineraries. There is a growing demand for authentic travel experiences that offer genuine cultural immersion, personal connection, and a deeper understanding of a destination. This shift represents a move toward community-driven tourism, where the focus is not just on the place, but on the people who call it home. Finding these authent

When security teams scan their container environments for the first time, they often discover hundreds of known vulnerabilities, and almost none of them trace back to application code. The overwhelming majority come from packages that shipped with the base image: shells, compilers, debug utilities, and libraries the application never calls. In a software supply chain built on containers, the base image is the foundation. If that foundation ships with unnecessary components, every workload bu

Introduction DevOps is no longer just a trend or a buzzword; it is the backbone of modern software delivery. Whether you are a developer looking to bridge the gap between code and operations, or a system administrator wanting to modernize your skillset, the demand for competent DevOps engineers remains at an all-time high. Yet, the path to becoming one is often obscured by an overwhelming array of tools, cloud platforms, and methodologies. If you have tried searching for a learning path,

Software supply chain attacks have accelerated faster than most security teams anticipated. Sonatype’s 2026 State of the Software Supply Chain report identified more than 454,000 new malicious packages published to open source repositories in 2025, bringing the cumulative total to over 1.2 million since 2019. The blast radius keeps expanding as organizations consume more open source software, ship more container-based workloads, and distribute software through increasingly complex pipelines.

Introduction Entering the world of DevOps can feel like walking directly into a massive storm of technologies, terminology, and confusing industry jargon. New learners are often told they must master automation, cloud computing, continuous integration, containerization, and monitoring all at the same time. This overwhelming amount of information creates immediate confusion, leaving many capable individuals feeling entirely lost before they even write their first configuration script. The

In our State of Agentic AI report, 45% of organizations said they struggle to ensure the tools their agents use are secure and enterprise-ready. That number reflects a broader reality: AI agents are moving into production faster than the security practices around them are maturing. The challenge is not that organizations lack security awareness. It’s that agents behave fundamentally differently from the applications security teams are used to protecting. An agent decides on its own which too

Introduction In the current landscape of information technology, there is perhaps no career path as dynamic, rewarding, and challenging as DevOps. You see the job postings everywhere, with high salaries and the promise of working with cutting-edge technology. However, for many students and professionals looking to transition, the path is clouded by confusing jargon, an endless list of tools, and a feeling that they are already behind before they even begin. When you decide you want to st

If you’re already familiar with sandboxing as an isolation technique, sandbox security is the next layer: the policies, controls, and enforcement mechanisms that make sure those isolation boundaries actually hold under real-world pressure. According to our State of Agentic AI report, 40% of respondents cite security as the top challenge in scaling agentic AI, and 43% point to increased security exposure from orchestration sprawl. As agents execute code, call APIs, and interact with live infr

This is Part 2 of our AI Coding Agent Horror Stories series, an in-depth look at real-world security incidents exposing the vulnerabilities in AI coding agents, and how Docker Sandboxes deliver workspace-scoped isolation that contains the worst failures at the execution layer. In part 1 of this series, we mapped six categories of AI coding agent failures and the architectural reason they keep happening: the agent runs as you, on your filesystem, with your credentials, and nothing sits betwee

If you are starting your career in DevOps, SRE, cloud engineering, platform engineering, or application support, one skill will keep showing up again and again: observability. Not just monitoring. Not just dashboards. Not just logs. Real observability. Modern systems are no longer simple. Applications run across Kubernetes clusters, cloud platforms, microservices, APIs, databases, message queues, containers, serverless components, and third-party services. A single user reque

Introduction In the current landscape of software engineering, technical proficiency is the baseline expectation. If you know how to write code, configure servers, or manage cloud infrastructure, you have entered the game. However, many engineers find that their career trajectory plateaus despite having advanced technical knowledge. They master the tools but struggle to lead, innovate, or advance into senior roles. This is where the missing piece—DevOps culture—becomes critical. Many pro

CVE-2026-31431 is a Linux kernel vulnerability that was recently disclosed. This CVE does not compromise Docker infrastructure. That said, Docker Engine’s default profiles prior to v29.4.3 allowed containers to create AF_ALG sockets, which is the syscall surface the exploit uses. You are not exposed if you are running Docker Engine v29.4.3 or later, OR a patched host kernel. If either of those is missing, you have exposure on that host, and you should read the rest of this post. As of wr

Earlier this year I mass-migrated my blog to Astro using Claude Code. 146 posts. 6,024 images. Canonical URLs, JSON-LD markup, sitemap generation, the whole stack. I’d spent hours writing a skills file to teach the agent about my blog’s architecture, how deployment worked, what not to touch. And it worked. Claude Code rewrote components, fixed trailing-slash mismatches across hundreds of pages, added BreadcrumbList structured data to hundreds of routes. Lighthouse scores hit 97 on performance. T

Introduction In my two decades of working with engineering teams, I have seen brilliant engineers struggle not because they lacked technical skill, but because they lacked a cohesive framework. We often talk about tools—Kubernetes, Jenkins, Terraform—as if they are the silver bullet for DevOps success. However, installing a tool is simple. Changing how an organization thinks, communicates, and delivers value is the real challenge. Many organizations fail at DevOps because they view it as

Introduction In the current landscape of software engineering, the pressure to deliver high-quality code at an unprecedented speed is constant. As systems grow more complex, the distance between writing code and running it in production has created significant friction. Traditionally, development teams focused on feature velocity while operations teams prioritized stability, creating isolated silos that often led to bottlenecks, finger-pointing, and delayed releases. To bridge this gap,

Gordon understands your environment, proposed fixes, and takes action across your entire Docker workflow. Now generally available. Image 1: Gordon in Docker Desktop Why Gordon Exists  Developers are more productive than ever. AI coding assistants are writing code, merging PRs and cutting review cycles. But the moment something breaks in a container, or a teammate hands you a service and says “ship it,” you’re on your own.  Containers don’t break th

AI agents are already running inside production environments. They call APIs, interact with internal systems, retrieve sensitive data, and make decisions with limited human oversight. For DevOps teams, this creates a problem, as traditional application security tooling was never really designed to handle it. Most DevSecOps pipelines are built around deterministic software. You scan code before deployment, validate dependencies, harden containers, and block known vulnerabilities before wo

This is issue 1 of a new series called Coding Agent Horror Stories where we examine critical security failures in the AI coding agent ecosystem and how Docker Sandboxes provide enterprise-grade protection against these threats. AI coding agents are everywhere. According to Anthropic’s 2026 Agentic Coding Trends Report, developers are now using AI in roughly 60% of their work. The report describes a shift from single agents to coordinated teams of agents, with tasks that took hours or days ge

Introduction Modern software development moves at lightning speed. Organizations can no longer afford to wait months for software updates, bug fixes, or new features. In the early days of information technology, software creation followed a rigid sequence where development teams and operations teams worked in silos. Developers wrote the code, and operations teams deployed it. This separation created friction, delayed deployments, and caused frequent system downtime. DevOps emerged as the

We’re excited to announce the general availability of Custom Catalogs and Profiles for managing Model Context Protocol (MCP) servers. These two complementary capabilities fundamentally change how teams package, distribute, and manage AI tooling.  Custom MCP Catalogs let organizations curate and distribute approved collections of MCP servers. MCP Profiles enable individual developers to easily build, run, and share their MCP tools and configurations across projects and teams. In this post

On April 15, NIST announced a prioritized enrichment model for the National Vulnerability Database. Most CVEs will still be published, but fewer will receive the CVSS scores, CPE mappings, and CWE classifications that container scanners and compliance programs have historically relied on. The change formalizes a drift that has been visible to anyone pulling NVD feeds for the past two years. What shifted on April 15 is the expectation: NIST has now said plainly that it does not intend to retu

Introducing Docker AI Governance: centralized control over how agents execute, what they can reach on the network, which credentials they can use, and which MCP tools they can call, so every developer in your company can run AI agents safely, wherever they work. Your laptop is the new prod Agents are the biggest productivity unlock the modern workplace has seen in a generation, and engineering is where the shift is most obvious. Developers aren’t using agents to autocomplete a function a

I just got back from DevOpsDays Austin, and it’s always great to go out and talk with a wide array of folks from the tech community to see what’s up. The takeaways were interesting. Austin is an advanced tech hub, but hasn’t been bitten by the AI bug as hard as SFO. On the one hand that worries me that our community might be getting behind, but there’s some justified bubble avoidance too. Takeaway One: AI adoption is on a curve like everything else. It is a sharp curve, but out in r

“AI agents will become the primary way we interact with computers in the future. They will be able to understand our needs and preferences, and proactively help us with tasks and decision making.“ Satya Nadella CEO of Microsoft Whether you are a software engineer, a product manager, or a designer, this quote should fundamentally change how we approach our daily routine. We are no longer just building interfaces; we a

As cloud infrastructure scales across global enterprises, the gap between engineering decisions and financial accountability has become a critical bottleneck. The Certified FinOps Manager framework addresses this by building leaders who can optimize cloud spend without slowing down deployment velocity. This guide is designed for engineers, platform architects, and managers who want to master the financial operations of modern technical environments. By aligning cloud investment with business val

How I use AI as a sounding board for home organization, while keeping every decision mine. I work in internal developer relations at Google, which means I spend most of my time thinking about how engineers adopt AI tools. Prompting, delegation, workflow integration. It’s the job. So it was probably inevitable that I’d eventually turn that lens on my own garage. My tool shed had gotten out of hand. Rakes leaning in a pile, a Greenworks mower blocking everything, an orange leaf blower

We’ve all been there: you need to generate a few images for a project, you fire up an AI image service, and suddenly you’re wondering what happens to your prompts, how many credits you have left, or why that “safe content” filter rejected your perfectly reasonable request for a dragon wearing a business suit. What if you could skip all of that and run the whole thing on your own machine, with a slick chat UI on top? That’s exactly what Docker Model Runner now makes possible. With a couple of

The complexity of modern containerized applications often leaves developers drowning in a sea of “noise”—vulnerabilities that exist in the file system but pose zero actual risk to the application. The integration between Black Duck and Docker Hardened Images (DHI) provides a definitive answer to this challenge. By combining Docker’s secure-by-default foundations, using VEX (Vulnerability Exploitability eXchange) statements, and Black Duck’s industry-leading analysis engines, teams can now automa

Introduction The transition from traditional IT spending to cloud consumption has fundamentally changed how organizations manage their finances. The Certified FinOps Architect is a senior-level credential designed for those who bridge the gap between engineering, finance, and business leadership. This guide is curated for professionals navigating the complexities of cloud-native environments where cost efficiency is as critical as system performance. By focusing on the intersection of DevOps

I work on Coding Agent Sandboxes, aka “sbx” at Docker. The project provides secure, microVM-based isolation for running AI coding agents like Claude Code, Gemini, Codex, Docker Agent and Kiro. Agents get full autonomy inside a sandbox (their own Docker daemon, network, filesystem) without touching your host system. Over the past couple of weeks, we built something on top of it: a virtual team of seven AI agent roles that test the product, triage issues, post release notes, and even fix bugs, all

In November 2025, a team self-hosting Langfuse, an open-source LLM observability platform, on Kubernetes uploaded their ClickHouse image to AWS ECR as part of their production preparation. They found that the pipeline scanner had returned three critical vulnerabilities – not in ClickHouse, but in the base image. Their security team saw the findings and blocked the deployment before it ever reached production. “Our security team is not allowi

Introduction In the fast-paced and ever-evolving construction industry, the need for efficient project management tools is more pressing than ever. Construction management software tools have become essential for overseeing the various aspects of construction projects, from scheduling and budgeting to resource allocation and risk management. As the industry faces rising demand for quicker project timelines and higher accountability, these software tools offer much-needed solutions for managi

Introduction The transition from experimental machine learning to production-grade AI systems has created a significant gap in technical leadership. The Certified MLOps Manager designation is designed to bridge this gap by combining the principles of DevOps with the unique challenges of machine learning lifecycles. This guide is crafted for professionals who want to move beyond building models and start managing the infrastructure, pipelines, and teams that keep those models running at scale

Catching the KICS push: what happened, and the case for open, fast collaboration In the past few weeks we’ve worked through two supply chain compromises on Docker Hub with a similar shape: first Trivy, now Checkmarx KICS. In both cases, stolen publisher credentials were used to push malicious images through legitimate publishing flows. In both cases, Docker’s infrastructure was not breached. And in both cases, the software supply chain of everyone who pulled the compromised tags was briefly

Introduction The transition from experimental machine learning to production-grade artificial intelligence is one of the most significant challenges facing modern enterprises. While data scientists excel at building models, the operationalization of those models requires a rigorous engineering approach known as MLOps. This guide explores the Certified MLOps Professional designation, a curriculum designed to bridge the gap between data science and IT operations. This roadmap is intended for e

Last week, we launched Docker Sandboxes with a bold goal: to deliver the strongest agent isolation in the market. This post unpacks that claim, how microVMs enable it, and some of the architectural choices we made in this approach. The Problem With Every Other Approach Every sandboxing model asks you to give something up. We looked at the top four approaches. Full VMs offer strong isolation, but general-purpose VMs weren’t designed for ephemeral, session-heavy agent workflows. So

Introduction Modern IT infrastructure has reached a level of complexity where manual intervention is no longer enough to maintain uptime. As environments scale, the volume of logs, metrics, and traces becomes overwhelming for human operators. This is where the Certified AIOps Professional program becomes essential for your career growth. This guide is designed for engineers and managers who want to move beyond traditional monitoring into the world of intelligent automation. By following the

We’re coming up on a year since launching Docker Hardened Images (DHI) this May, and crossing a milestone earlier this month made me stop and reflect on what we’ve actually been building. Earlier this month, we crossed over 500k daily pulls of DHIs, and over 25k continuously patched OS level artifacts in our SLSA Level 3 pipeline. From the time we launched the free DHI Community tier at the end of last year, the catalog has now grown to 2,000+ hardened images, MCP servers, Helm charts, and E

This post is a collaboration between Docker and Arm, demonstrating how Docker MCP Toolkit and the Arm MCP Server work together to scan Hugging Face Spaces for Arm64 Readiness. In our previous post, we walked through migrating a legacy C++ application with AVX2 intrinsics to Arm64 using Docker MCP Toolkit and the Arm MCP Server – code conversion, SIMD intrinsic rewrites, compiler flag changes, the full stack. This post is about a different and far more common failure mode. When we tried t

Q1 – What is Datadog? Q2 – What is the use of Datadog? Q3 – What is obserbability? Q4 – How to do obserbability? Q5 – What types of data is collected by Datadog Agent by default? View the full article

We recently announced the integration between Mend.io and Docker Hardened Images (DHI) provides a seamless framework for managing container security. By automatically distinguishing between base image vulnerabilities and application-layer risks, it uses VEX statements to differentiate between exploitable vulnerabilities and non-exploitable vulnerabilities, allowing your team to prioritize what really matters. TL;DR: The Developer Value Proposition The hallmark of this integration is its

Here’s a cleaned-up, beginner-friendly Kubernetes tutorial based on your session notes. Kubernetes Tutorial for Beginners 1. What is Kubernetes? Kubernetes, often called K8s, is an open-source platform used to deploy, manage, and scale containerized applications. It helps you run applications in containers across one or more machines in an automated and reliable way. In simple terms: Docker creates and runs containers Kubernetes manages those containers at scale

The software supply chain is under sustained attack. Not from a single threat actor or a single incident, but from an ecosystem-wide campaign that has been escalating for months and shows no signs of slowing down. This week, axios, the HTTP client library downloaded 83 million times per week and present in roughly 80% of cloud environments, was compromised via a hijacked maintainer account. Two backdoored versions deployed platform-specific RATs attributed with high confidence to North Korea

Docker Hub is quickly becoming the home for AI models, serving millions of developers and bringing together a curated lineup that spans lightweight edge models to high-performance LLMs, all packaged as OCI artifacts. Today, we’re excited to welcome Gemma 4, the latest generation of lightweight, state-of-the-art open models. Built on the same technology behind Gemini, Gemma 4 introduces three architectures that scale from low-power efficiency to high-end server performance. By packaging m

Docker Desktop is one of the most widely used developer tools in the world, yet for millions of enterprise developers, running it simply hasn’t been an option. The environments they rely on, such as virtual desktop infrastructure (VDI) platforms and managed desktops, often lack the resources or capabilities needed to run Docker Desktop. As enterprises scaled to support remote and contractor teams, these environments became the default, effectively blocking many developers from using Docker D

Introduction Cloud testing tools have become an essential part of the software development lifecycle, allowing teams to test their applications and services in cloud environments. These tools help organizations ensure that their applications are performing as expected, scalable, and ready to handle the complexities of modern cloud infrastructures. In 2026, as cloud adoption continues to rise and businesses rely on complex cloud-based environments, the need for efficient cloud testing tools h

Back in October, we showed how Docker Model Runner on the NVIDIA DGX Spark makes it remarkably easy to run large AI models locally with the same familiar Docker experience developers already trust. That post struck a chord: hundreds of developers discovered that a compact desktop system paired with Docker Model Runner could replace complex GPU setups and cloud API calls. Recently at NVIDIA GTC 2026, NVIDIA is raising the bar with NVIDIA DGX Station and we’re excited to add support for it in

Agents have crossed a threshold. Over a quarter of all production code is now AI-authored, and developers who use agents are merging roughly 60% more pull requests. But these gains only come when you let agents run autonomously. And to unlock that, you have to get out of the way.That means letting agents run without stopping to ask permission at every step, often called YOLO mode. Doing that on your own machine is risky. An autonomous agent can access files or directories you did not int

Hello, I’m Philippe, and I am a Principal Solutions Architect helping customers with their usage of Docker. I wanted a lightweight way to automate my IT news roundups without burning through AI credits. So I built a Docker Agent skill that uses the Brave Search API to fetch recent articles on a topic, then hands the results to a local model running with Docker Model Runner to analyze the stories and generate a Markdown report. In this setup, Qwen3.5-4B handles the reasoning and skill invocat

If you prepare and file taxes electronically, federal law has specific things to say about how your technology is set up. Not general cybersecurity advice. Specific, documented, enforceable requirements under IRS Publication 4557 and the Federal Trade Commission’s Safeguards Rule. And if your IT infrastructure does not meet them, the consequences go well beyond a cautionary letter. Tax and accounting firms are legally classified as financial institutions under the Gramm-Leach-Bliley Act.

We wanted to provide you information about a security incident that we became aware of that affects customers who use the Aqua Security Vulnerability scanner (Trivy) across multiple distribution channels including Docker Hub, GitHub, and npm. Between 18:24 UTC on March 19, 2026 and 01:36 UTC on March 23, 2026, Docker Hub customers who pulled the Trivy images with the 0.69.4, 0.69.5, 0.69.6, and latest tags may have had their CI/CD secrets, cloud credentials, SSH keys, and Docker configurations c