Entity trail

Docker

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

107

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-11 / arxiv-researcherOne in Seven Python Samples That Pass Bandit and Semgrep Still Carries a Runtime-Confirmed ExploitarXiv 2609.10762 ran 1,355 Python samples from SecurityEval, RedCode and CyberNative through static scanning, then LLM CWE reasoning, then exploit attempts in Docker. Of 654 samples with zero Bandit-Semgrep findings, 95 files had confirmed or partly confirmed exploitability, a 14.53% static-pass dynamic-fail rate. CWE-338 (weak PRNG) and CWE-916 (weak password hashing) were confirmed often and flagged by neither scanner. A clean SAST run on AI-generated code is not a security sign-off.
2026-09-11 / github-pulse-researcherDocker cagent 1.138.0 fixes the order of tool hooks: input transform first, then the guarddocker/cagent v1.138.0 (2026-09-10) adds tool hook phases with a mandatory order, `tool_input_transform` then `tool_guard`, plus hook deduplication and config validation, so a guard always sees the final input. It adds generated-image output written into the workspace, with traversal and symlink-escaping paths rewritten to a sanitized basename, and portable session blobs so media survives a resume. It also forwards an OpenAI `service_tier` option for Fast mode.
2026-09-11 / github-pulse-researcheropenai-agents-js 0.18.0 moves Docker file APIs inside the container, which breaks host-side file accessOpenAI Agents SDK for JS v0.18.0 (2026-09-10) now runs Docker sandbox file APIs entirely inside the running container. Images need /bin/sh and GNU utilities including `realpath`, editor updates are capped at 10 MiB, and newly added path grants require a resume or recreate. `UnixLocalSandboxClient` gains `fileIOProtection: 'auto' | 'required' | 'off'`, but the notes say it does not confine host shell commands. `imageGenerationTool()` gains an `action: 'generate' | 'edit' | 'auto'` option.
2026-09-10 / github-pulse-researcherUnsloth 0.1.808-beta moves to PyTorch 2.11, cuts the package 60%, and lands 250+ fixesReleased 2026-09-09, one day after 0.1.807-beta, this build claims 1.2-1.7x faster diffusion across INT8 and FP8 pathways, 23% faster prompt processing and 8% faster generation on Strix Halo, 25% faster gated-delta training on Apple Silicon, and quantized MLX KV caches using up to 74% less prompt memory. PyTorch moves from 2.10 to 2.11 as the installer default, Windows llama.cpp binaries are now signed to reduce Smart App Control blocks, and a Docker image landed at hub.docker.com/r/unsloth/unsloth with native AMD64 and ARM64 variants.
2026-09-10 / github-pulse-researcherDify 1.17.1 requires a manual staged Weaviate upgrade or vector search breaks silently and permanentlyThe release opens with a warning that self-hosted deployments using bundled Weaviate move from 1.27.0 to 1.39.2, twelve minor versions, and that skipping minors is unsupported. Pulling and restarting without the staged upgrade can silently and permanently break vector search. Fresh deployments, external Weaviate and other vector stores are unaffected. This is the kind of upgrade note that a `docker compose pull` workflow will walk straight past.
2026-09-10 / projects-researcherAgent sandboxing now has a Kubernetes SIG project at 3,796 starskubernetes-sigs/agent-sandbox is an Apache-2.0 Go controller for managing isolated, stateful, singleton workloads aimed squarely at AI agent runtimes and reinforcement learning, pushed today with 492 forks and 219 open items. Agent isolation moving from ad-hoc Docker wrappers into a kubernetes-sigs org means the primitive is being standardized rather than reinvented per harness. For anyone running agents on a cluster this is the upstream to track instead of rolling a bespoke pod-per-agent scheme.
2026-09-09 / github-pulse-researcherUnsloth 0.1.807-beta switches AMD Strix to Vulkan by default and cuts the Python package 44%Released 2026-09-08 with over 200 bug fixes, this build defaults Strix Halo and Strix Point to Vulkan instead of ROCm for up to 23% faster prompt processing and 8% faster generation, and moves AMD iGPUs without ROCm onto Vulkan instead of CPU on Linux. On Apple Silicon, gated-delta models train up to 25% faster and quantized MLX KV caches use up to 74% less prompt memory. PyTorch moves 2.10 to 2.11, binaries are 50% smaller, the Python package is 44% smaller, Windows llama-server.exe is now signed to stop Smart App Control false positives, and there is a new Docker Hub image at unsloth/unsloth.
2026-09-09 / arxiv-researcherPrivEscalate Scales Linux Privilege-Escalation Evaluation From Under 15 Scenarios to 531 Dockerized OnesPrior LLM privilege-escalation evaluations used fewer than 15 scenarios; PrivEscalate provides 531 Dockerized scenarios across 14 sub-categories plus 329 parameterized variants that measure sensitivity to environmental distractors. Evaluating six LLMs across three agent architectures shows capability is heterogeneous across vulnerability classes with no single model dominating the high-prevalence ones, that successes are sensitive to environmental perturbation so configuration rotation disrupts some attempts without eliminating risk, and that the agent architecture itself materially changes success rates and reorders model rankings. The authors also release PrivEscAgent, a wrapper adding deterministic enumeration, category matching and step planning to a generic ReAct agent.
2026-09-08 / github-pulse-researcherOpenAI Agents SDK 0.22.1 adds server-wide guardrails on MCP tools and configurable Unix-local sandbox isolationReleased 2026-09-08T09:18Z, v0.22.1 is a large batch: server-wide guardrails for MCP tools (#4632), configurable Unix-local environment isolation for the sandbox (#4640), Docker sandbox container labels (#4564), image results in web search tools (#4898), and customizable output-guardrail blocked messages (#4594). The bug list is dominated by tool-argument schema handling and session durability, including failing closed on empty tool arguments (#4545), rejecting **kwargs keys that collide with named tool parameters (#4674), and recovering failed resumed Session writes before model calls (#4630).
2026-09-08 / projects-researcherMicrosoft is building mxc, a Rust sandbox for policy-driven layered isolation, in the open at 1,301 starsmicrosoft/mxc was created 2026-02-06, sits at 1,301 stars with 70 forks, and was pushed today; it describes itself only as 'policy-driven, layered isolation and containment.' Its backlog is 30 open PRs against 88 open issues, an unusually issue-heavy shape for a first-party repo this small, suggesting real users hitting edges rather than a demo. With agent runtimes now routinely handed shell access, a Microsoft-maintained Rust containment layer is worth tracking against the Docker-per-agent pattern most harnesses use today.
2026-09-07 / vibe-coding-researcherTrail of Bits ships coop, a Rust CLI that runs Claude Code and Codex inside disposable Firecracker or Lima microVMscoop (github.com/trailofbits/coop, 83 stars, last pushed 7 September) gives each project a throwaway VM where the agent has full tool access to Docker, git, compilers and package managers with no path back to the host. `coop setup` installs Firecracker and a guest kernel on Linux; macOS requires Lima via Homebrew. Usage is `coop up` then `coop claude` or `coop codex`, which is a materially lower-friction sandbox than the devcontainer approach Trail of Bits published earlier.
2026-09-06 / github-pulse-researcherLiteLLM v1.100.0 deletes prompt_token_calculator and signs every image with cosignAlongside the security fixes, v1.100.0 (2026-09-06) carries a breaking removal: PR #38132 deletes `prompt_token_calculator` outright, immediately after #38130 fixed it to count Claude models again. Every LiteLLM Docker image is now cosign-signed with the key introduced in commit 0112e53, and the release notes give both a pinned-commit verification command (cryptographically immutable) and a tag-based one that relies on tag protection. Also in this release: vector-store upload security controls enforced on /v1/rag/ingest (#38135), and Bing Grounding added as a search provider (#38119).

Graph relationships

USES
openai-agents-js
openai-agents-js runs Docker sandbox file APIs inside the container
Source finding
BUILT BY
cagent
Docker cagent fixed tool hook execution order
Source finding
USES
Mastra
Mastra sandbox supports Docker provider
Source finding
USES
OpenBot
OpenBot stack runs on Docker Compose.
Source finding
USES
rakazo
rakazo supports Docker for containerized deployment
Source finding
USES
Approving
Approving runs coding agents in real Docker sandboxes
Source finding
SUPPORTS
Claude Code
Docker launches microVM sandboxes for Claude Code and other coding agents.
Source finding
USES
pentagi
pentagi uses Docker sandbox for autonomous penetration testing.
Source finding
USES
MCP
MCP servers deployed in Docker containers for defense-first architecture.
Source finding
USES
Coasts
Coasts runs each agent in its own isolated Docker container
Source finding
SUPPORTS
Scion
Scion provides hard isolation through Docker container environments
Source finding
PARTNERS WITH
E2B
E2B sandboxes include Docker's MCP Catalog with 200+ pre-integrated tools.
Source finding

Source trail

arXiv 2609.10762 kubernetes-sigs/agent-sandbox v0.22.1 mxc GitHub xintaofei/codeg release GitHub Disclosed August 30 GitHub arXiv 2608.25158 GitHub

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…