All news with #container security tag

🔬 AWS HealthOmics now supports container images from third‑party registries such as Seqera (Wave), NVIDIA NGC, and Google Artifact Registry, allowing customers to use existing containerized tools without manually migrating images into Amazon ECR. The service can copy images into Amazon ECR on behalf of users when running private workflows, and private workflows can access both Amazon ECR pull‑through cache registries and the newly supported registries. HealthOmics is HIPAA‑eligible and the expanded support is available in all Regions where the service is offered, including US, Europe, Israel, and Asia Pacific.

⚠️ Docker disclosed CVE-2026-105445, a critical Docker Hub vulnerability where personal access tokens (PATs) could be reassigned during account-to-organization conversion, letting attackers impersonate owners. An attacker-created account and PAT could be converted and named the target owner without changing the secret or obtaining consent, enabling pull, push, or delete actions depending on token scope. Docker patched the issue within hours of report, deactivated transferred PATs, and now requires consent and no longer transfers tokens during conversion.

🔒 AWS Network Firewall now supports wildcard matching in container attribute-based inspection filters for Amazon EKS and Amazon ECS, allowing administrators to define patterns that match multiple container workloads in a single rule. This eliminates the need to create individual container associations for each variant and simplifies management in dynamic container environments. Wildcard patterns such as app=payments-* automatically cover variants like payments-api, payments-worker, and payments-cron. The feature is available in all Regions where container attribute-based inspection is supported.

🛠️ Amazon GameLift Servers now supports CPU burstability for container fleets, allowing developers to pack containers based on typical CPU needs while permitting short runtime CPU bursts during peak demand. This opt-in feature is configured per container group, supports high-density deployments without sacrificing peak performance, and is included at no additional cost. It is available in all AWS Regions that support container fleets, excluding China Regions.

🔧 Amazon Elastic Container Service (Amazon ECS) now provides built-in blue/green, linear, and canary deployment strategies for services using Amazon VPC Lattice. Applications using VPC Lattice for cross-VPC and cross-account communication can leverage managed traffic shifting directly from ECS when rolling out updates. Teams can validate new versions with test traffic, use lifecycle hooks for custom validations or manual approvals, and rely on CloudWatch alarms and the ECS deployment circuit breaker to trigger automatic rollbacks.

🔔 AWS has integrated Amazon GuardDuty Runtime Monitoring into the AWS Security Hub Threat Analytics plan. This runtime capability inspects OS, network, and file activity to detect threats like container escapes, privilege escalation, and cryptomining across Amazon EC2, Amazon EKS, and Amazon ECS on AWS Fargate. Billing for Runtime Monitoring is now consolidated under Security Hub as a single usage type, eliminating separate GuardDuty Runtime Monitoring charges for accounts and regions with Security Hub enabled. Detection behavior, finding types, and GuardDuty agents remain unchanged, and no reconfiguration is required; free-trial terms for Threat Analytics and Security Hub Essentials remain separate.

🛠️ Cloudflare rearchitected Containers to better serve on-demand agent sandboxes by allowing code to choose sandbox images and instance types at runtime. The new durable_object scheduling policy and redesigned runtime yield a 6x faster median startup and improved burst performance, while filesystem snapshots enter public beta. Durable Objects now control containers more directly via the native ctx.container API, simplifying rollout and enabling richer, per-task environment decisions.

🐧 Microsoft has made WSL Containers generally available, enabling direct build, run, and deployment of Linux containers on Windows via a new wslc.exe (alias container.exe). The release adds missing preview features like restart, file copy, health checks, networking commands, mounts, and configurable storage. A WSL Containers API lets Windows apps programmatically launch containers, and integrations include Defender for Endpoint, Intune policy controls, and VS Code tooling support.

🛠️ AWS Deadline Cloud now supports running jobs using Docker containers from Amazon Elastic Container Service (ECS) on Linux-based service-managed fleets. Deadline Cloud is a fully managed service for compute-intensive workloads like visual effects, simulation, and gaming. Customers can bring their own container images and have Deadline Cloud automatically deploy them at scale. Container support is available in all Regions where Deadline Cloud is offered.

🚀 GKE Pod snapshots let you capture and restore a running Pod’s full state, including CPU and GPU memory, to dramatically reduce cold-start times for AI inference and sandboxed agent workloads. By persisting snapshots to high-throughput Cloud Storage, new replicas restore directly from a warmed state, cutting startup latency by up to 89% in benchmarks. This enables aggressive autoscaling, lowers idle GPU costs, and replaces complex custom caching solutions with a simple declarative CRD-driven workflow.

🐧 Amazon Elastic Container Service Express Mode now supports specifying ARM64 as the CPU architecture for services, enabling deployment of ARM-based container images on AWS Graviton-powered compute with up to 40% better price-performance versus x86. ECS Express Mode orchestrates networking, load balancing, autoscaling and deployments, providing an auto-generated URL while simplifying launches of web apps and APIs. Users can set the CPU architecture for new and existing services via the AWS Console, CLI, SDKs, or IaC tools, and the feature is available in all AWS commercial Regions and AWS GovCloud (US).

🟦 Amazon Elastic Container Service (Amazon ECS) introduces a console-only consolidated deployment view for Managed Daemons that centralizes rollout progress, failures, and potential blockers. The view provides a lifecycle timeline with timestamps and duration, per-capacity-provider progress bars, and a monitoring panel showing circuit breaker, alarms, and health checks with live CloudWatch details. Failed daemon tasks show stop reasons with links to task logs and troubleshooting guidance, and the console displays target/source revisions, instance counts, drain percentages, and bake time. This enhancement is available at no additional cost in all AWS Commercial Regions.

📁 Amazon Elastic Container Service (Amazon ECS) now supports Amazon S3 Files for tasks using the Amazon EC2 launch type, allowing containerized applications to access S3 data as a shared file system. This extension enables file-based applications, AI agents, and data processing workloads to use standard file system semantics without code changes or data duplication. S3 Files was already available for ECS on AWS Fargate and ECS Managed Instances and now provides consistent access across all three ECS launch types.

🎮 SeaVerse, a SeaArt gaming startup, built a platform for playable AI experiences and needed infrastructure that could run dynamic, multi-tenant sandboxes with low latency, strong isolation, and better observability. By adopting Google Kubernetes Engine (GKE) and GKE Agent Sandbox, SeaVerse achieved kernel-level isolation with microVMs and gVisor options, improved runtime visibility, and scaled sandbox allocations rapidly. The change reduced infrastructure costs by up to 60% while preserving a fast creator experience.

🚀 Microsoft reports being named a Leader in the 2026 Gartner® Magic Quadrant™ for Container Management, positioned furthest on Completeness of Vision. The post outlines how Azure's container portfolio—including AKS, Azure Container Apps, Azure Arc, and Azure Kubernetes Fleet Manager—supports diverse AI and application workloads across cloud, edge, and hybrid environments. It emphasizes open-source alignment with upstream Kubernetes and investments in operational automation and agentic operations to address cluster sprawl and governance challenges.

🔧 Over six months Chainguard doubled its output from 500 million to over 1 billion container build manifests, surpassing 3,000 images and 675,000 versions. The article explains what a build manifest represents and how Chainguard OS and Chainguard Factory produce continuous, reproducible artifacts with SLSA Level 3 provenance, Sigstore signatures, and SBOMs. It describes the transition from an event-driven Factory to Factory 2.0 (DriftlessAF), which uses continuous reconciliation, redundant work queues, and targeted AI to remove toil and accelerate rebuild velocity. The piece argues that faster rebuilds are essential to staying ahead of AI-enabled attackers and outlines future expansion and open sourcing of DriftlessAF.

🧰 Google and Anyscale introduce an experimental Ray library that integrates gVisor sandboxes into distributed Ray clusters to provide secure, high-performance isolation for agentic and reinforcement learning workloads. The design maps sandboxes to Ray Actors so schedulers can place, resource, and manage them like other Ray-managed resources. The sandbox API supports OCI images, resource limits, file operations, command execution, and lifecycle controls, while SandboxRuntime offers lower-level access and OCI spec modification.

🔧 Amazon Elastic Container Service now automatically detects and repairs container instances with impaired agent connectivity across all compute options. It surfaces a new AGENT_CONNECTIVITY health change event for AWS Fargate, Amazon ECS Managed Instances, and Amazon ECS on EC2. For ECS Managed Instances and Fargate, ECS will automatically drain tasks and launch replacement capacity while deregistering impaired instances; ECS on EC2 users can use the event to trigger replacements. This capability is available at no additional cost in all AWS Commercial and GovCloud (US) Regions.

🚀 Amazon Elastic Container Registry (Amazon ECR) has increased the maximum number of replication rules per registry from 10 to 25. This change addresses limitations for complex multi-region and multi-account architectures, allowing more granular replication strategies for scenarios such as distributing images for low-latency pulls and separating production and staging targets. The increase is available in all AWS Regions where Amazon ECR is supported.

🆕 Amazon Elastic Container Registry (Amazon ECR) now supports image layers up to 200 GB for images pushed via Docker push. This removes the need to split large assets across multiple layers or rely on external storage for many workloads, simplifying packaging for use cases such as embedding large language models, genomics datasets, or bulky binary dependencies. Note that uploads via the AWS SDK or CLI (UploadLayerPartAPI) remain capped at 50 GB, and the feature is available in most AWS Regions except Bahrain and UAE.