Find published research by company, product, platform or technology.
Showing 1–4 of 4 dossiers
Docker’s new agent stack combines pay-as-you-go microVM sandboxes with an OCI-based Kit format for declaring what an agent can use. Cloud sessions cost from $0.07 to $1.12 an hour, and Docker says it plans to take the Kit specification toward CNCF neutral governance.
The security shift is deeper than running application containers as non-root: the node stack itself can now live inside a user namespace. The feature is enabled by default in 1.37, but clusters do not become rootless automatically and CNI/CSI compatibility still needs testing.
The new AWS–Azure pairing is less about raw bandwidth than an operational boundary shift: each cloud provider now manages its side of the private cross-cloud connection, with prebuilt capacity and native provisioning instead of a bespoke interconnect stack.
This was not a Firecracker escape or access to a live victim disk. It was a storage-isolation failure underneath the sandbox: researchers recovered foreign directory structures, database pages and complete SQLite databases from reused blocks, and Cloudflare had to fix allocation plus retire existing disks and cached snapshots.