Docker, Inc

Two updates to audit capabilities in Docker AI Governance. We've produced a structured event for every policy evaluation since AI Governance launched in May: the identity, the resource, the decision, and the rule that made it. Today, those events are now searchable across your whole organization in Docker Cloud, and they stream directly to your SIEM tools like Splunk, Datadog, Dynatrace, and Grafana Labs. Read more:

"Just update everything" isn't always an option. In this episode of Ship Happens, Per Ploug Krogslund and Colton Shaw from Spectro Cloud discuss what Log4Shell taught the industry, why understanding your dependencies has become essential, and what devs can learn from the way regulated industries approach software supply chain security. As AI agents take on more operational work, those lessons are becoming relevant far beyond defense and healthcare. Watch → https://lnkd.in/g2P2KVSS

Docker now supports OIDC connections with GitHub Actions for Docker Organizations. Instead of storing a personal access token as a GitHub secret, your workflow proves its identity (which repo, which branch, which environment) and gets back a short-lived token that expires in minutes. No stored secrets means nothing to rotate and nothing for an attacker to walk away with. Try it out today with your Docker Team and Business, DHI or DSOS organizations. Read more:

Docker Captain Nick Janetakis just published a deep-dive on backing up PostgreSQL in Docker, covering everything from a simple cron + pg_dumpall setup to using the open-source tool Plakar with S3. The post includes ready-to-use shell scripts for both backup and restore, a concrete cost comparison showing how deduplication can reduce S3 storage costs significantly over time, and coverage of pruning policies, snapshot diffs, and safe atomic writes. Whether you're self-hosting a small app or managing databases with millions of rows, this is a solid foundation to build on. https://bit.ly/4pLGZ4Q

Trust and security are the foundation on which success in the agentic era is built. But no one company can build that foundation alone. That’s why Docker is joining NVIDIA's Open Secure AI Alliance. We’re excited to do our part to create a world where developers can move freely between open-weight and frontier models without compromising on safety, security, and governance. Read more about why we're joining and what it means for the future of agentic AI. https://bit.ly/4pOnXL3

Introducing Agent Baseline: a vendor-neutral reference architecture that enables organizations to safely build, deploy, and operate AI agents in enterprise environments. This open-source framework was created by the collaboration between Snyk, Docker, and Keycard, and establishes the minimum standard for agent safety. Read more:

Whenever a new agent "auto mode" update drops, Mark Cavage tries to make it do something it shouldn't. It usually takes him four minutes or less. Docker's President and COO joined Software Engineering Daily for a deep dive on agent security: why agents fundamentally break the immutability assumptions containers were built on, and what it actually takes to contain them safely. They also get into how microVMs create a stronger boundary than containers alone, and the still-unsolved challenge of giving agents scoped, trustworthy access to sensitive services and data. Listen to the full episode →

Everyone is debating how much freedom to give agents. What that conversation often skips is where humans need to stay in the loop. As part of our CISO panel on securing AI, Zach Lloyd (Warp) makes the case that dependency selection is one aspect you don't want to hand over entirely. His take: give agents choice, but make it a choice that's been defined by human policy. Watch the full panel episode for takes from all the CISO panelists → https://lnkd.in/gjydtD8Y

When AI agents start pulling dependencies, building environments, and invoking tools on their own, your security model has to evolve. That's why we're excited to share another workshop announced for WeAreDevelopers North America: “Securing the Agentic Stack: Docker Hardened Images and Supply Chain Security”, led by Ajeet Singh Raina. You'll get hands-on with SBOMs, VEX, Docker Hardened Images, image signing, and build policies, learning how to create a secure foundation for both developers and AI agents. The goal isn't just to find vulnerabilities. It's to build secure defaults into your development workflow from the start. 📍 San Jose, Sept. 23–25 Get your ticket → https://bit.ly/4e7b7nD

The malware didn't bring its own credential scanner. It borrowed yours. In Part 4 of the AI Coding Agent Horror Stories series, Ajeet Singh Raina breaks down the s1ngularity attack: a poisoned npm post-install hook that invoked Claude Code, Gemini CLI, or Amazon Q with permission prompts disabled. The campaign leaked 2,349 secrets across 1,079 repositories.. He also walks through how to prevent it, including how you can run agents with a workspace-only filesystem view, so there's nothing to harvest even if a dependency goes rogue. Read: