Docker

🐳 🐙 Docker Compose Tip #63: Tuning containers with ulimits and shm_size Two settings that solve specific runtime problems! ```yaml services: scraper: image: chrome-headless ulimits: nofile: soft: 65536 hard: 65536 shm_size: 2gb ``` When you need them: • ulimits/nofile: high-concurrency servers (nginx, Node.js ) hitting "Too many open files" • shm_size: Chrome/Puppeteer (defaults to 64MB and crashes), PyTorch DataLoaders, busy PostgreSQL • ulimits/nproc: apps that fork heavily These complement CPU/memory limits (Tip #16): one caps the resources Docker hands out, the other configures how the container uses them. Full guide: https://lnkd.in/euXJpSkg #Docker #DockerCompose #Performance #Runtime #DevOps

A dozen CISO conversations this week since we launched Docker AI Governance. They all keep coming back to the same question.... Janakiram MSV captured it in Forbes today: "Is AI agent adoption in your organization currently governed, or merely tolerated?" That is the bind every security leader is in right now: • Agents do not look like pipelines, do not live in the VPC, and do not follow your IAM model. They run on the developer's laptop, acting as the developer, reaching production systems. • The security stack enterprises spent two decades building was designed for humans at defined interfaces. It does not see what an agent is doing. • Enforcement has to live at the runtime layer, not as advisory rules a clever prompt can route around. • The same policy has to follow the agent from laptop to CI to production, or the gap becomes the breach. If you are an IT or security leader trying to enable your entire organization to use agents safely, whether that is coding agents in engineering or Claws running in sales, finance, marketing, and support, let's connect. Happy to share what is working across the Fortune 500 rollouts we are standing up right now. Read Janakiram's full analysis: https://lnkd.in/gqYCCGZk #AIGovernance #AgenticAI #CISO #MCP #EnterpriseAI #AISecurity #Docker #SBX #Sandboxes

Docker AI Governance is available now. If you’re a security leader trying to close the AI governance gap, or a platform team ready to roll out agents without compromising control, it was built for you.

Today we launched Docker AI Governance: centralized control over how agents execute, what they can reach on the network, which credentials they can use, and which MCP tools they can call, so every employee in your company can run AI agents safely, wherever they work.

The Docker Agent 1-Click Droplet on DigitalOcean reduces deployment to under five minutes with Docker Agent v1.9.10 pre-installed on Ubuntu 24.04. Multi-agent architectures split complex tasks across focused specialists. In this tutorial, the Tester agent automatically generated unit tests without any explicit prompting. Docker Agent supports cloud APIs (OpenAI, Anthropic) and local models through Docker Model Runner for air-gapped or privacy-sensitive environments. Local inference with Qwen3 8B correctly diagnosed bugs but took roughly three minutes on CPU, compared to about five seconds with cloud APIs. For faster local inference, consider DigitalOcean GPU Droplets. Agents are distributable as OCI artifacts through Docker Hub, enabling instant sharing and deployment across teams.

🇦🇺 Docker APAC is expanding 🚀 We’re hiring a Senior Marketing Manager (APAC) to support our growing team. Massive opportunity to join a high-growth region, work with an incredible team, and make real impact. If you’re hungry, driven, and ready to build come join us! https://lnkd.in/gbW7YNqz

The standard response to agent security concerns is policy. Add guardrails. Improve the system prompt. Monitor the output. Red-team the agent. These things have value, but they share a common weakness: they rely on the agent choosing to stay within bounds. A well-crafted prompt injection can bypass any instruction. An edge case in the agent's reasoning can send it somewhere unexpected. Policy is better than nothing, but it's operating at the wrong layer. Docker Sandboxes takes a different approach entirely. Instead of asking the agent to behave, it structurally removes the things the agent shouldn't be able to reach. sbx run claude . That one change puts the agent inside a microVM, a lightweight virtual machine with its own Linux kernel, its own Docker Engine, and its own network namespace. The only filesystem path shared between the VM and your host is your project directory. Nothing else exists inside the sandbox. https://lnkd.in/gXtGEfqc

DOCKER WILL BE AT DEVOXX PARIS ! Will you be joining ?

When your swag ships with a thesis. 🧦 “Run Agents Freely. Safely.” That tagline on a pair of Docker socks isn’t marketing fluff ~ it’s the entire product direction. Freedom without safety is a liability. Safety without freedom kills velocity. MicroVM sandboxing is how you get both. The future of agents isn’t faster prompts. It’s stateful, governed, self-contained runtimes and the infrastructure to run them without breaking your system. Also: the socks are genuinely comfortable. 😄 #Docker #AgenticAI #Sandboxing