Docker vs HashiCorp

Trust Docker for the agents you don’t

At WeAreDevelopers, Docker introduced Cloud Sandboxes, the open Sandbox Kit specification, and a commitment to bring Kits to the CNCF for neutral governance.

Manufacturing Trust for AI Agents | Docker’s WeAreDevelopers Keynote

Docker’s WeAreDevelopers keynote shows how Sandboxes, Kits, and Cloud Sandboxes give AI agents strong isolation and reproducible authority. Also announced: Docker and CNCF partner on an open spec for agent permissions, and Introducing Cloud Sandboxes: Start on Your Laptop, Finish in the Cloud.

Docker Launches Cloud Sandboxes, Extending Secure AI Agent Isolation Beyond the Laptop

Docker, Inc.®, the trusted platform for building software in the agentic era, today announced Docker Cloud Sandboxes, a new solution for secure, isolated AI agent execution that enables complex agentic workflows to continue running in the cloud long after a developer's laptop shuts down.

AI/Infra/VC News Roundup: AI Investments, Funding, Security

This newsletter from 'What's Hot in Enterprise IT/VC' compiles recent AI, infrastructure, and venture capital news. It highlights trends in AI funding, including Gimlet Labs' $300M Series B at a $3B valuation with multiple tranches, and Clay's $115M Series D at $7.1B. It also covers the decline in AI spending among top enterprises, the increasing demand for AI compute, and the emergence of cybersecurity threats using AI, such as Anthropic's report on Iran's misuse of Claude. The roundup includes commentary on the AI infrastructure buildout, the acquisition of Miro for $1.355B, and the rise of physical AI deployments like Skild AI's $100M ARR. Overall, it reflects the dynamic and rapidly evolving landscape of AI technology, infrastructure, and investment.

• Gimlet Labs raised $300M Series B at $3B valuation, led by a16z, with money in at $2.5B, $3B and higher tranches.
• Clay raised $115M Series D at $7.1B valuation, with clients including Anthropic, Google, OpenAI, Stripe, Visa, and UPS.
• AI spend among top 1% of businesses declined 10% in August to $7.2K per employee per month.

AI Projects Close PRs, Deploy Agent 'Software Factories'

AI-native open source projects are increasingly shutting down external pull requests and using agent-based 'software factories' to manage contributions. Vercel deployed such a system for its AI SDK project, which now authors 25–35% of merged PRs and closes 70–80% of issues. The Astro web framework adopted agent-driven triage and regained control of its backlog. Flue and tldraw now automatically close external PRs, converting them into issues or discussions, partly to prevent 'drive-by AI slop PRs.' Maintainers say they trust internally optimized agents more than community-generated code, though they acknowledge risks for community onboarding. Mitchell Hashimoto predicts large open source projects will eventually close contributions completely, while projects still invite reporting, discussion, and perspective from outside contributors.

• Vercel's agent-based 'software factory' for AI SDK authors 25–35% of merged PRs and closes 70–80% of issues within four weeks.
• Flue and tldraw automatically close external pull requests and convert them into issues or discussions.
• The Astro web framework adopted agent-based triage to reestablish control over its GitHub issue backlog.

Container Security Checklist for SREs

A technical how-to and checklist for site reliability engineers (SREs) covering container security best practices. The article recommends using minimal multi-stage base images to reduce attack surface, scanning container images (example with Trivy in a GitHub Actions workflow), running containers as non-root with Kubernetes securityContext settings, applying network policies and pod security standards, managing secrets via external vaults (e.g., HashiCorp Vault), enforcing resource limits, and automating weekly audits (using kubectl, skopeo, jq). The author is Dr. Samson Tanimawo, Founder & CEO of Nova AI Ops.

• Article provides a container security checklist aimed at SREs including image scanning, non-root containers, network policies, secrets management, resource limits, and pod security standards.
• Recommends image scanning in CI (example uses aquasecurity/trivy-action in a GitHub Actions workflow) and failing builds on HIGH/CRITICAL vulnerabilities.
• Advises using multi-stage builds and slim base images to minimize image size and attack surface, and running processes as non-root (Kubernetes securityContext examples provided).