All news with #container security tag

🧰 Google and Anyscale introduce an experimental Ray library that integrates gVisor sandboxes into distributed Ray clusters to provide secure, high-performance isolation for agentic and reinforcement learning workloads. The design maps sandboxes to Ray Actors so schedulers can place, resource, and manage them like other Ray-managed resources. The sandbox API supports OCI images, resource limits, file operations, command execution, and lifecycle controls, while SandboxRuntime offers lower-level access and OCI spec modification.

🔧 Amazon Elastic Container Service now automatically detects and repairs container instances with impaired agent connectivity across all compute options. It surfaces a new AGENT_CONNECTIVITY health change event for AWS Fargate, Amazon ECS Managed Instances, and Amazon ECS on EC2. For ECS Managed Instances and Fargate, ECS will automatically drain tasks and launch replacement capacity while deregistering impaired instances; ECS on EC2 users can use the event to trigger replacements. This capability is available at no additional cost in all AWS Commercial and GovCloud (US) Regions.

🚀 Amazon Elastic Container Registry (Amazon ECR) has increased the maximum number of replication rules per registry from 10 to 25. This change addresses limitations for complex multi-region and multi-account architectures, allowing more granular replication strategies for scenarios such as distributing images for low-latency pulls and separating production and staging targets. The increase is available in all AWS Regions where Amazon ECR is supported.

🆕 Amazon Elastic Container Registry (Amazon ECR) now supports image layers up to 200 GB for images pushed via Docker push. This removes the need to split large assets across multiple layers or rely on external storage for many workloads, simplifying packaging for use cases such as embedding large language models, genomics datasets, or bulky binary dependencies. Note that uploads via the AWS SDK or CLI (UploadLayerPartAPI) remain capped at 50 GB, and the feature is available in most AWS Regions except Bahrain and UAE.

🔒 Amazon SageMaker HyperPod now supports custom AMIs for Slurm-orchestrated clusters, enabling deployment of pre-configured, security-hardened environments tailored to organizational needs. This reduces reliance on complex lifecycle scripts and improves startup times and consistency across nodes. Custom AMIs must be built from HyperPod's public base AMIs for compatibility and can be specified via the CreateCluster, UpdateCluster, or UpdateClusterSoftware APIs. The feature is available in all Regions where HyperPod is supported.

🛡️ AWS Network Firewall now supports container attribute-based rules for Amazon EKS and Amazon ECS, enabling firewall policies based on native container attributes (namespaces, pod names, labels, cluster names) instead of ephemeral IPs. This feature automatically discovers and tracks matching pods, dynamically updates IP-to-attribute mappings, and enriches alert logs with container context for easier troubleshooting and auditing. It integrates with Suricata-compatible rules, exports logs to CloudWatch Logs and S3, and can be configured via the AWS Console, CLI, or SDK with no additional feature charge.

🔧 Amazon Elastic Container Service (Amazon ECS) now lets you customize when a service deployment is considered failed and automatically rolled back. You can set the circuit breaker threshold using a fixed task failure count or a percentage of desired tasks, and choose between consecutive or cumulative failure counting models. This allows different rollback behavior across environments and is available in all AWS Regions where ECS is offered.

🔒 Today AWS announced container attribute-based rules for AWS Network Firewall, allowing firewall policies to reference native container constructs like Namespace, Cluster Name, Labels for Amazon EKS, and Cluster Name and Container Instance Attributes for Amazon ECS. This removes the need for fragile IP-based rules that break when pods scale or restart and supports generative AI and other dynamic workloads. The feature supports TLS decryption, FQDN and URL category filtering, and GeoIP controls, and is available at no extra cost in supported regions.

🛡️ The AWS CIRT updated the Threat Technique Catalog for June 2026, adding five new entries focused on container security, organization-level trust, and compute hijacking. The update documents EKS workload modification, exploitation of public-facing Kubernetes services, sts:AssumeRoot abuse across AWS Organizations, compute hijacking in clusters, and account invitations into attacker-controlled organizations. It also refreshes three existing entries with expanded detection and mitigation guidance.

🛠️ Amazon GameLift Servers introduces two container fleet improvements to improve flexibility and inter-container communication for game server deployments. You can now customize Linux capabilities in container group definitions to grant specific permissions such as NET_RAW or SYS_PTRACE, and call the new ListContainersNetworkInfo() server SDK action to discover co-located containers' names, IDs, local IPs, and group types. These features are exposed via the console, AWS CLI, SDK, and CloudFormation and supported in server SDK 5.x for Go, C++, and C#, plus Unreal and Unity plugins, available in all GameLift regions except China.

🔧 Amazon ECS Managed Daemons now support inter-task visibility and communication by adding pidMode and ipcMode settings. These allow daemons to share process and IPC namespaces with application containers when set to "shared", while the default "none" keeps them isolated. Daemons run once per instance and start before applications, enabling independent deployment of agents like tracing, profiling, and security tools. The feature is available in all AWS Regions at no extra cost.

🛡️ We’re adding Knostic’s AgentMesh to VirusTotal’s Crowdsourced AI lineup to analyze Visual Studio Code extension (.VSIX) files. This integration complements Code Insight and other AI contributors to help developers, platform engineers, and security teams assess extension security and detect supply-chain threats prior to installation. The collaboration highlights the growing importance of securing IDE extensions.

🔒 Researchers disclosed a vulnerability in Gitea that allowed unauthenticated remote attackers to pull private container images from affected deployments without credentials. Tracked as CVE-2026-27771, the issue affects all Gitea versions prior to 1.26.2, which contains the fix. Noscope estimates more than 30,000 deployments globally may be impacted, spanning healthcare, aerospace, retail, and ISPs. Users are advised to update to 1.26.2 or enable REQUIRE_SIGNIN_VIEW as a temporary mitigation.

🔒 Kaspersky Container Security (KCS) is presented as a comprehensive platform that reaches beyond registry image scanning to secure container workflows across development and production. The Product Security Team uses KCS in CI/CD pipelines, registry correlation, and cluster runtime monitoring to tie findings to specific artifacts, pipelines, and scan times. KCS computes risk ratings, supports SBOM processing, and produces reports in SARIF, CycloneDX, SPDX and standard formats to integrate with AppSec and internal tooling.

📦 AWS Transform now automates replatforming to containers during migrations, extending its agentic AI to generate Dockerfiles, build images, and publish to Amazon ECR. It supports repositories from GitHub, Bitbucket, GitLab, or .zip sources and builds deployment artifacts for Amazon ECS and Amazon EKS. Integrated security scanning and Terraform and Helm outputs simplify operations. Available in all Regions where AWS Transform is offered.

🛡️ Microsoft Defender Security Research warns of CVE-2026-31431, known as 'Copy Fail', a high-severity local privilege escalation in the Linux kernel crypto subsystem that impacts many major distributions and cloud workloads. An unprivileged user can abuse AF_ALG and splice() to corrupt the page cache and deterministically escalate to root, enabling container escape and multi-tenant compromise. Apply vendor patches or block AF_ALG socket creation immediately and hunt for indicators of compromise.

⚙️ At Google Cloud Next '26, Google announced Fluid Compute and a broad set of compute, networking, and storage updates to support both traditional and agentic AI workloads with better performance and lower cost. Key moves include GA of the Arm-based Axion N4A, a GKE Agent Sandbox running on Axion, previews of bare-metal Axion C4A.metal and network-optimized C4N, and expanded Flexible Committed Use Discounts. The changes emphasize elastic scaling for spiky agent workloads, isolated runtime sandboxes, and higher I/O and VM-to-VM bandwidth to reduce contention and TCO.

🔧 Amazon Elastic Container Service now includes NVIDIA GPU health monitoring and auto repair for ECS Managed Instances. The capability leverages NVIDIA Data Center GPU Manager (DCGM) to detect critical GPU hardware failures and proactively replace impaired instances to maintain availability for GPU-accelerated container workloads. You can view GPU health via the DescribeContainerInstances API and receive notifications through Amazon EventBridge. Auto repair is enabled by default on supported instances at no additional cost and is available in all AWS Commercial Regions.

🔁 Amazon Elastic Container Registry (Amazon ECR) now automatically discovers and caches OCI referrers — including image signatures, SBOMs, and attestations — from upstream registries for repositories configured with pull through cache. Previously, referrers had to be listed and fetched manually because ECR would not return or sync them for cached repositories. With this change, referrers API requests reach upstream and automatically cache related artifacts, enabling end-to-end signature verification, SBOM discovery, and attestation retrieval without client-side workarounds. The feature is available today in all Regions where Amazon ECR pull through cache is supported.

🧰 Cloudflare has declared Sandboxes and Cloudflare Containers generally available, delivering persistent, isolated development environments tailored for AI agents and human developers. Key additions include secure credential injection via an egress proxy, PTY-backed WebSocket terminals, persistent Python/JavaScript/TypeScript interpreters, filesystem event streams, background dev servers with public preview URLs, and fast disk-state snapshots. Higher instance limits and Active CPU Pricing reduce cost and improve scalability; the SDK is at version 0.8.9.