# Containers Published articles for Containers. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Kubernetes Architecture: Control Plane, Scheduler, and Kubelet DevFeed: [Kubernetes Architecture: Control Plane, Scheduler, and Kubelet]() Original publisher: [Read original article]() Author: Nimesha Jinarajadasa Published: 2026-09-17T06:25:02Z Content type: tutorial Language: en Sources: [Kubernetes - KodeKloud Blog | DevOps, Cloud, Kubernetes, AI Tutorials & More]() Topics: [Kubernetes](), [control-plane](), [api server](), [Containers](), [etcd](), [kubectl]() Tags: [api](), [api-server](), [containers](), [control-plane](), [controllers](), [etcd](), [kubectl](), [kubernetes](), [kubernetes-architecture](), [kubernetes-networking](), [node](), [scheduler]() ### AI overview A beginner-friendly tutorial explaining how Kubernetes maintains the desired state of containerized applications. It covers the control plane, API server, etcd, controllers, scheduler, and kubelet. ### Source excerpt Learn how Kubernetes works, from the control plane and scheduler to kubelet, pods, and Services, with simple answers to interview questions. ## Sunsetting netlab Vagrant/libvirt provider DevFeed: [Sunsetting netlab Vagrant/libvirt provider]() Original publisher: [Read original article]() Published: 2026-09-17T05:51:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [Vagrant](), [Infrastructure as code](), [Orchestration](), [Containerlab topology](), [Oracle-VM-VirtualBox]() Tags: [change](), [containers](), [infrastructure](), [infrastructure-as-code](), [netlab](), [orchestration](), [vagrant](), [virtualbox]() ### AI overview The netlab project is sunsetting its Vagrant/libvirt provider after the vagrant-libvirt plugin became effectively unmaintained and HashiCorp announced the closure of Vagrant Cloud by the end of 2026. Existing support and tests will remain for now, but no new libvirt features or device integration tests are planned; containerlab will become the primary orchestration path. ### Source excerpt When I started the netlab project, Vagrant was the go-to tool if you wanted to build a virtual environment described in a text configuration file (an idea popularized as infrastructure-as-code). It wasn't ideal for what we were doing, but a tool rarely does a great job when used far away from its intended use case. netlab initially supported Vagrant with VirtualBox, quickly adding support for KVM/libvirt through the vagrant-libvirt plugin. Life was good... until it wasn't. Read more ... ## Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions DevFeed: [Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions]() Original publisher: [Read original article]() Author: Nispriha Jagan; Neeraj Krishna Gopalakrishna Published: 2026-09-16T18:30:00Z Content type: article Language: en Sources: [Kubernetes Blog]() Topics: [Kubernetes](), [Security](), [mount](), [Filesystems](), [chmod](), [Unix]() Tags: [chmod](), [container](), [containers](), [filesystem](), [hardening](), [kubernetes](), [linux](), [mount](), [permissions](), [storage](), [volume](), [volumes]() ### AI overview Kubernetes v1.37 adds bind mount options and emptyDir permission modes to strengthen storage security. The article explains how noexec, nosuid, nodev, Unix permissions, and the sticky bit can help enforce security policies on writable volumes. ### Source excerpt Kubernetes v1.37 brings important storage security features: emptyDir permission modes and bind mount options. They help application programmers and security professionals implement rigorous security policies, for example, prohibiting deletion of files across containers or execution of arbitrary binaries from writable volumes, directly in Kubernetes without any complicated circumvention. Linux storage and permission fundamentals Before diving into the new Kubernetes features, let us briefly review the low-level Linux security mechanisms that make them possible. Bind mount flags When Linux mounts or remounts a directory, Virtual File System (VFS) flags control what actions are permitted on that filesystem: noexec: Do not permit direct execution of any binaries on the mounted filesystem. nosuid: Do not allow set-user-identifier or set-group-identifier bits to take effect. nodev: Do not interpret character or block special devices on the file system. Directory permissions and the sticky bit Standard Unix permissions regulate access across three scopes: Owner, Group, and Others (e.g., 0755 or 0777). Beyond standard read, write, and execute bits, Linux supports the sticky bit (as in mode 01777). When applied to a directory, the sticky bit ensures that a file inside that directory can only be deleted or renamed by the file's owner or root. This is essential for shared writable directories like /tmp. Motivation for the improvements Why does Kubernetes need bind mount options and emptyDir permissions? The primary goal of these features is to increase the security of Kubernetes workloads by allowing security-related bind mount options on volume mounts. By default, volumes are bind-mounted into containers by the container runtime and kubelet without noexec, nosuid, or nodev flags. This default can undermine security. For example, with noexec missing, a compromised process can use any writable volume (emptyDir, PersistentVolume, etc.) to download, chmod +x, and execute arbitra ## Secure Compute and Static IP builds start 64% faster DevFeed: [Secure Compute and Static IP builds start 64% faster]() Original publisher: [Read original article]() Author: Karim Hasebou Published: 2026-09-16T17:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Deployment](), [Containers](), [Network Configuration]() Tags: [automatically](), [build](), [compute](), [containers](), [faster](), [ip](), [network-configuration](), [static]() ### AI overview Vercel reports that builds using Secure Compute or Static IPs now start 64% faster on average, improving from 6.7 seconds to 2.4 seconds. The change uses prewarmed build containers with network configuration attached at build start and requires no configuration changes. ### Source excerpt Builds using Secure Compute or Static IPs now start 64% faster, with the average time from deployment creation to build start dropping from 6.7 seconds to 2.4 seconds. Previously, each build waited for a new build container to boot with its network configuration. These builds now use prewarmed build containers, with your network configuration attached when the build starts. The improvement is applied automatically to builds using Secure Compute or Static IPs, with no configuration changes required. Learn more about Secure Compute and Static IPs. Read more ## Constraining AI agents with Red Hat AI: Containment, identity, and governance DevFeed: [Constraining AI agents with Red Hat AI: Containment, identity, and governance]() Original publisher: [Read original article]() Author: Grace Ableidinger Published: 2026-09-16T13:01:59Z Content type: tutorial Language: en Sources: [Red Hat](), [Red Hat Developer]() Topics: [Artificial Intelligence](), [Security](), [Zero Trust](), [Containers](), [Kubernetes](), [Architecture & Design]() Tags: [ai](), [ai-agents](), [containers](), [deployment](), [kubernetes](), [prompt-injection](), [security](), [trust]() ### AI overview This tutorial explains how to secure AI agents running on Red Hat OpenShift using containment, verifiable identity, and governance. It covers namespace isolation, quotas, sandboxing, workload identity, and admission control, with OpenClaw used in the demo. ### Source excerpt When an agent process runs on your laptop, it typically inherits anything your user has access to. Often this includes the full network stack, the file system, and the credentials sitting in memory. When integrating with GitHub, Slack, or a cloud provider, you could be one faulty permission or well-crafted prompt injection away from a security incident. The post Constraining AI agents with Red Hat AI: Containment, identity, and governance appeared first on Red Hat Developer. ## The Original Serverless Architecture is Still Here DevFeed: [The Original Serverless Architecture is Still Here]() Original publisher: [Read original article]() Author: Khan Academy Published: 2018-05-31T22:00:00Z Content type: opinion Language: en Sources: [Khan Academy]() Topics: [serverless architecture](), [Kubernetes](), [Orchestration](), [Docker](), [Cloud](), [Firebase](), [DynamoDB]() Tags: [amazon](), [cloud](), [containers](), [docker](), [dynamodb](), [engineering](), [firebase](), [infrastructure](), [kubernetes](), [news](), [orchestration](), [serverless](), [serverless-architecture]() ### AI overview This commentary compares Kubernetes-based architectures with serverless approaches. It explains that Kubernetes offers flexibility through containers, Helm, ingress controllers, monitoring tools, and service meshes, but requires substantial configuration and maintenance. Serverless platforms such as Firebase and Amazon Lambda abstract away server infrastructure so developers can focus on applications and stateless functions. ### Source excerpt By Kevin Dangoor This month, my colleague Dave Rosile and I went to GlueCon 2018 in sunny Denver, ... Read more ## Safeguarding LLM-Assisted Dev at Guardsquare | Guardsquare DevFeed: [Safeguarding LLM-Assisted Dev at Guardsquare | Guardsquare]() Original publisher: [Read original article]() Author: Noah Fraiture - Backend Engineer Published: 2026-09-15T13:03:38Z Content type: article Language: en Sources: [Guardsquare Blog]() Topics: [Development](), [Large Language Model](), [Cybersecurity](), [Security & Privacy](), [agent observability]() Tags: [ai-agents](), [android](), [containers](), [cybersecurity](), [data](), [dev](), [developer](), [development](), [ios](), [llm](), [llm-gateway](), [thought-leadership]() ### AI overview Guardsquare explains why it adopted LLM-assisted software development despite risks involving sensitive intellectual property, personally identifiable information, and agent access to developer infrastructure. The post describes safeguards including separating sensitive code, isolating agent execution, and controlling model access and outbound data through an LLM gateway and guardrail service. ### Source excerpt This post is not meant to tell you how to use large language models (LLMs) or to claim we've found the right approach. As a cybersecurity company working with particularly sensitive IP, our decision to use LLMs for development was never just about productivity. The broader enthusiasm around LLMs was not itself a reason for us to adopt them quickly. For some time, our position was that the risks outweighed the productivity gains, and incidents involving AI agents elsewhere in the industry reinforced that assessment. ## Using the Komodo MCP Server to Manage Docker Infrastructure with AI Assistants DevFeed: [Using the Komodo MCP Server to Manage Docker Infrastructure with AI Assistants]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-15T12:38:26Z Content type: tutorial Language: en Sources: [Virtualization Howto]() Topics: [Homelab](), [Model Context Protocol (MCP)](), [Docker](), [Docker Compose](), [GitOps](), [Artificial Intelligence]() Tags: [ai](), [automation](), [containers](), [docker](), [gitops](), [home-lab](), [home-server](), [infrastructure](), [mcp]() ### AI overview This tutorial introduces the Komodo MCP Server, which connects AI assistants such as Claude and GitHub Copilot to Komodo for managing Docker environments. It describes natural-language control of containers, stacks, deployments, servers, builds, repositories, and related infrastructure through the Model Context Protocol. ### Source excerpt There are so many cool projects now that we have access to in the the realm of home lab, especially when it comes to automation and AI Ops for our... The post I Gave AI Control of My Docker Home Lab With Komodo MCP appeared first on Virtualization Howto. ## Monitor TAS and gang scheduling for AI training in Kubernetes DevFeed: [Monitor TAS and gang scheduling for AI training in Kubernetes]() Original publisher: [Read original article]() Author: David Lentz; Kathy Lin Published: 2026-09-15T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [Kubernetes](), [kueue](), [distributed-training](), [GPU](), [Monitoring](), [datadog]() Tags: [ai](), [batch](), [containers](), [datadog](), [distributed-training](), [gpu](), [gpu-monitoring](), [kubernetes](), [kueue](), [monitoring](), [scheduler]() ### AI overview This article explains why Kubernetes scheduling is insufficient for distributed AI training workloads and how topology-aware scheduling and gang scheduling address hardware placement and simultaneous startup requirements. It discusses implementing these capabilities with Kueue and the Coscheduling plugin, and monitoring and troubleshooting them with Datadog GPU Monitoring. ### Source excerpt Learn how Datadog helps you correlate Kueue, Coscheduling, GPU, and training framework signals to validate gang scheduling and topology-aware scheduling. ## EROFS Disables LZ4 Rolling Decompression Due To Data Corruption Possibility DevFeed: [EROFS Disables LZ4 Rolling Decompression Due To Data Corruption Possibility]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-09-13T00:33:00Z Content type: news Language: en Sources: [Phoronix]() Topics: [Filesystems](), [systems](), [Optimization](), [Linux](), [data](), [Containers]() Tags: [containers](), [data](), [desktop-linux](), [embedded](), [embedded-systems](), [kernel](), [linux](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-performance](), [linux-server-benchmarks](), [memory](), [open-source-graphics](), [optimization](), [phoronix](), [phoronix-test-suite](), [reduce](), [systems](), [ubuntu-benchmarks](), [ubuntu-hardware](), [x86]() ### AI overview EROFS has temporarily disabled LZ4 rolling decompression because a rare interaction with the upstream LZ4 implementation could produce corrupted data. The change prioritizes data correctness in production but increases runtime memory usage. ### Source excerpt The EROFS read-only file-system popular for embedded systems, containers, and other use-cases has resorted to temporarily disabling its LZ4 rolling decompression support due to data corruption concerns... ## Using Komodo to Manage and Update Docker Compose Stacks Across Multiple Hosts DevFeed: [Using Komodo to Manage and Update Docker Compose Stacks Across Multiple Hosts]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-12T12:32:29Z Content type: tutorial Language: en Sources: [Virtualization Howto]() Topics: [Docker](), [Docker Compose](), [Homelab](), [Open Source](), [GitOps]() Tags: [containers](), [docker](), [docker-compose](), [gitops](), [home-lab](), [home-server](), [open-source]() ### AI overview The article explains how Komodo, an open source platform, can centrally manage Docker servers, containers, Compose stacks, and deployments across multiple hosts, reducing the need to update each stack manually. ### Source excerpt There are SO many tools out there that allow you to keep your containers updated and I have used just about all of them, including Watchtower, Dockcheck, and others. Running... The post I Stopped Manually Updating My Docker Container Stacks. I Use This Instead appeared first on Virtualization Howto. ## CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms DevFeed: [CrowdStrike Named Strongest Overall Leader in 2026 Frost Radar™: Cloud Workload Protection Platforms]() Original publisher: [Read original article]() Author: Brett Shaw Published: 2026-09-12T11:17:51.295154Z Content type: article Language: en Sources: [Blog]() Topics: [workload protection](), [Security & compliance, Cloud security](), [Security](), [telemetry](), [Containers](), [Kubernetes](), [SOC]() Tags: [2026](), [cloud](), [cloud-application-security](), [cloud-security](), [containers](), [growth](), [innovation](), [kubernetes](), [real-time](), [security](), [soc](), [telemetry](), [workload-protection]() ### AI overview CrowdStrike says Frost & Sullivan named it the strongest overall leader in the 2026 Frost Radar for Cloud Workload Protection Platforms. The article highlights Falcon Cloud Security's focus on connecting risk, adversary intelligence, and real-time protection across containers, Kubernetes, identities, cloud control planes, endpoints, and SOC operations. ### Source excerpt Falcon Cloud Security earned the highest scores in both Innovation and Growth by connecting risk, adversary intelligence, and real-time protection to stop attacks. ## Lambda SnapStart Comes to Container Images, Ending a Packaging Tradeoff DevFeed: [Lambda SnapStart Comes to Container Images, Ending a Packaging Tradeoff]() Original publisher: [Read original article]() Author: Steef-Jan Wiggers Published: 2026-09-12T10:09:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [Deployment](), [NumPy]() Tags: [announcement](), [architecture](), [architecture-design](), [aws](), [aws-lambda](), [cloud](), [containers](), [development](), [devops](), [lambda-snapstart-container-image](), [news](), [performance](), [python](), [serverless](), [startup]() ### AI overview AWS has extended Lambda SnapStart to container-image functions, allowing teams to combine larger dependency packages with sub-second startup times. The change removes a packaging tradeoff previously faced by workloads such as pandas- and NumPy-based Lambda functions. ### Source excerpt AWS has extended Lambda SnapStart to container image functions, which hold up to 10 GB against 250 MB for zip archives. Teams previously chose between dependency headroom and sub-second startup. A Reddit thread from a month earlier shows what that cost: stripping whitespace and docstrings from installed packages to stay under the limit. By Steef-Jan Wiggers ## Red Hat edge platforms: Choosing the right one for your use case DevFeed: [Red Hat edge platforms: Choosing the right one for your use case]() Original publisher: [Read original article]() Author: Daniel Froehlich Published: 2026-09-11T13:01:48Z Content type: article Language: en Sources: [Red Hat](), [Red Hat Developer]() Topics: [Edge](), [Containers](), [Kubernetes](), [Architecture & Design](), [Hardware](), [Availability](), [Microservice]() Tags: [containers](), [deployment](), [edge](), [edge-computing](), [hardware](), [high-availability](), [kubernetes](), [management-tools](), [microservices](), [red-hat](), [virtual-machines]() ### AI overview This article introduces a series about choosing Red Hat edge platforms for specific deployment needs. It compares Red Hat Enterprise Linux and Red Hat OpenShift across workload types, platform sizes, hardware requirements, Kubernetes use cases, availability, storage, and management needs. ### Source excerpt Choosing the right platform for an edge deployment is one of the most consequential decisions an organization makes--and one of the most confusing. The options range from a single-board computer running a handful of containers to a full Kubernetes cluster with high availability, software-defined storage, and centralized management. Pick too small, and you hit a wall when requirements grow. The post Red Hat edge platforms: Choosing the right one for your use case appeared first on Red Hat Developer. ## Presentation: How To Run on Three Clouds at Once, and When Not To DevFeed: [Presentation: How To Run on Three Clouds at Once, and When Not To]() Original publisher: [Read original article]() Author: Ross McFarlane, Kevin Holditch Published: 2026-09-11T11:00:00Z Content type: article Language: en Sources: [InfoQ]() Topics: [networking](), [Databases](), [Kubernetes]() Tags: [amazon](), [architecture](), [architecture-design](), [availability](), [aws](), [cloud](), [cloud-architecture](), [cloud-computing](), [cloud-networking](), [cockroach-labs](), [cockroachdb](), [containers](), [databases](), [devops](), [disaster-recovery](), [engineering](), [europe](), [financial-applications](), [fintech](), [form3-multicloud-architecture](), [infoq](), [kubernetes](), [microservices](), [networking](), [presentation](), [qcon-london-2026](), [qcon-software-development-conference](), [resilience](), [transcripts](), [us]() ### AI overview A presentation on Form3's move from one cloud to a triple-active multi-cloud architecture, covering cross-cloud networking, distributed databases, Kubernetes operators, and regional disaster-recovery expectations. ### Source excerpt Ross McFarlane and Kevin Holditch discuss Form3's evolution from a single-cloud setup to a triple active multi-cloud architecture. They share key engineering strategies for cross-cloud networking, distributed databases with CockroachDB and NATS, custom Kubernetes operators, and navigating distinct regional disaster recovery expectations across the UK, Europe, and US financial markets. By Ross McFarlane, Kevin Holditch ## Kubernetes v1.37: Scheduler Preemption for In-Place Pod Resize (Alpha) DevFeed: [Kubernetes v1.37: Scheduler Preemption for In-Place Pod Resize (Alpha)]() Original publisher: [Read original article]() Author: Natasha Sarkar Published: 2026-09-10T18:30:00Z Content type: article Language: en Sources: [Kubernetes Blog]() Topics: [Kubernetes](), [Containers]() Tags: [containers](), [cpu](), [feature](), [kubernetes](), [memory](), [node](), [resource](), [scale]() ### AI overview Kubernetes v1.37 adds an alpha scheduler-preemption feature for in-place Pod resizes. It can preempt lower-priority workloads to make capacity available for valid, higher-priority resize requests that are deferred on full nodes. ### Source excerpt In Kubernetes, resource allocation has historically been a static decision made during a Pod's initial scheduling and placement. With the graduation of the core in-Place Pod resize feature to General Availability in v1.35, application developers and cluster operators gained the powerful ability to dynamically adjust CPU and memory allocations of running containers without incurring disruptive restarts or application downtime. However, in-place resizing introduced a unique resource scheduling gap: if a running Pod requested a resource scale-up that exceeded the host node's allocatable headroom, the Kubelet was forced to mark the request as Deferred. The Pod would remain parked in this state indefinitely, waiting for resources on the node to naturally free up. To bridge this scheduling gap, Kubernetes v1.37 introduces scheduler preemption for in-place Pod resize (Alpha), behind the InPlacePodVerticalScalingSchedulerPreemption feature gate. This feature allows the Kubernetes scheduler to actively free up capacity on a fully-utilized node by preempting lower-priority workloads, enabling the pending in-place resizes of critical, higher-priority applications to succeed. The "deferred" resize challenge To understand why this preemption mechanism is needed, it is helpful to look at how Kubernetes handles running Pod resizing. When a user or controller (such as the Vertical Pod Autoscaler) updates the resource requests of an active container, the Kubelet evaluates whether the underlying node has enough spare allocatable capacity to fulfill the increase. If the node's resources are fully utilized and cannot satisfy the new limits, the Kubelet sets the container's resizeStatus (reported in the Pod's status.containerStatuses[]) to Deferred. Unlike an Infeasible resize request (which is immediately rejected because it exceeds physical machine boundaries, namespace limit ranges, or admission quotas) a Deferred status indicates that the request is valid but is temporarily unable t ## The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE DevFeed: [The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE]() Original publisher: [Read original article]() Author: Eviatar Garzi Published: 2026-09-10T10:00:43Z Content type: article Language: en Sources: [Unit 42]() Topics: [Kubernetes]() Tags: [api](), [containers](), [cryptographic](), [identity](), [json](), [kubernetes](), [linux](), [malware](), [node](), [open-source](), [research](), [secrets](), [spiffe](), [spire](), [spoof](), [spoofing](), [threat-research](), [tool]() ### AI overview Research on a post-exploitation technique in which root access to a Kubernetes node can let an attacker spoof cgroup metadata used by SPIRE workload attestation, impersonate co-located workloads, and obtain SVIDs. ### Source excerpt Learn how root access on a compromised K8s node allows attackers to utilize SPIFFE/SPIRE metadata to spoof and harvest co-located workload identities. The post The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE appeared first on Unit 42. ## Simplify and support your TorchServe workloads using Ray Serve Deep Learning Containers DevFeed: [Simplify and support your TorchServe workloads using Ray Serve Deep Learning Containers]() Original publisher: [Read original article]() Author: Ananth Raghavendra Published: 2026-09-09T15:51:29Z Content type: tutorial Language: en Sources: [Artificial Intelligence]() Topics: [Inference](), [model-deployment](), [Amazon Elastic Kubernetes Service](), [Containers](), [vlm](), [GPU](), [PyTorch]() Tags: [amazon-eks](), [containers](), [gpu](), [inference](), [intermediate-200](), [pytorch](), [technical-how-to](), [vulnerabilities]() ### AI overview The article introduces AWS Ray Serve Deep Learning Containers as a maintained, pre-tested inference option for teams moving from unmaintained TorchServe workloads. It demonstrates deploying a vision-language model on Amazon EKS using a single GPU node. ### Source excerpt TorchServe is no longer maintained, leaving teams to own the entire GPU inference stack. The AWS Ray Serve Deep Learning Container is a supported, pre-tested container with the framework, GPU drivers, and serving layer already assembled. This post walks through deploying a vision-language model on Amazon EKS using the Ray Serve DLC on a single GPU node. ## Introducing worker topologies for self-hosted Appwrite DevFeed: [Introducing worker topologies for self-hosted Appwrite]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-07T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Self-hosted](), [Containers](), [Coroutines](), [Docker Compose]() Tags: [announcements](), [compose](), [container](), [containers](), [coroutines](), [self-hosted]() ### AI overview Appwrite introduces two worker topologies for self-hosted instances. The combined topology is now the default and runs background work in two containers, while the separate topology preserves one container per queue and scheduler for installations needing independent scaling or resource controls. ### Source excerpt Self-hosted Appwrite now runs all background workers in a single container by default. Learn how the combined topology works and when to scale out with separate workers. ## Appwrite 2.0 is now available for self-hosting DevFeed: [Appwrite 2.0 is now available for self-hosting]() Original publisher: [Read original article]() Author: Atharva Deosthale Published: 2026-09-07T00:00:00Z Content type: release Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Self-hosted](), [PostgreSQL](), [Containers]() Tags: [containers](), [postgresql](), [products](), [self-hosting](), [upgrade]() ### AI overview Appwrite 2.0 is available for self-hosting. It introduces a rebuilt Console, PostgreSQL as the default database for new installations, a coroutine-based server engine, and a combined worker topology that reduces the default instance from 33 to 16 containers. Existing installations retain their current database when upgraded. ### Source excerpt Appwrite 2.0 brings a rebuilt Console, PostgreSQL as the default database, and a combined worker topology that runs your instance on 16 containers instead of 33. ## 7 Simple Home Lab HA Projects for This Weekend DevFeed: [7 Simple Home Lab HA Projects for This Weekend]() Original publisher: [Read original article]() Author: Brandon Lee Published: 2026-09-05T12:22:03Z Content type: tutorial Language: en Sources: [Virtualization Howto]() Topics: [Homelab](), [Availability](), [Pi-hole](), [Docker](), [Containers]() Tags: [availability](), [containers](), [dns](), [docker](), [high-availability](), [home-lab](), [home-server](), [server](), [servers]() ### AI overview This article presents seven simple high-availability projects for a home lab. Its detailed example recommends running two DNS servers, separating them across Docker hosts, configuring primary and secondary DNS addresses, and synchronizing the DNS platforms. ### Source excerpt A lot of times we think about high availability being some complicated or complex thing that we just think in the home lab it isn't worth doing. However, HA doesn't... The post 7 Simple Home Lab HA Projects for This Weekend appeared first on Virtualization Howto. ## Kubernetes v1.37: KubeletInUserNamespace (aka Rootless mode) Graduates to Beta DevFeed: [Kubernetes v1.37: KubeletInUserNamespace (aka Rootless mode) Graduates to Beta]() Original publisher: [Read original article]() Author: Akihiro Suda Published: 2026-09-04T18:30:00Z Content type: release Language: en Sources: [Kubernetes Blog]() Topics: [Kubernetes](), [Vulnerabilities](), [Containers]() Tags: [containers](), [feature](), [kubernetes](), [linux](), [production](), [v1](), [vulnerabilities]() ### AI overview Kubernetes v1.37 promotes KubeletInUserNamespace, or rootless mode, to beta. It lets Kubernetes node components run as a non-root host user in a Linux user namespace, reducing the impact of container-breakout vulnerabilities while complementing conventional hardening such as seccomp. ### Source excerpt Kubernetes v1.37 promotes the KubeletInUserNamespace feature gate to beta. With this feature enabled, all of the node components (kubelet, CRI and OCI runtimes, CNI plugins, and kube-proxy) can run as a non-root user on the host, using a Linux user namespace. This technique is also known as rootless mode. The work started as an experiment in 2018, and was merged into Kubernetes v1.22 (2021) as an alpha feature (Kubernetes Enhancement Proposal KEP-2033). This feature should not be confused with user namespaces for pods (hostUsers: false with the UserNamespacesSupport feature gate, GA since v1.36), which puts pods in user namespaces but still runs the node components as root. These two features do not conflict. Moreover, they can be combined to nest Kubernetes inside Kubernetes without resorting to the full privileged: true. Why run the node components in a user namespace? Because the node components have historically had container-breakout vulnerabilities that could compromise full root privileges on the host. Examples of such vulnerabilities include: CVE-2022-0811 ("cr8escape"): CRI-O could be tricked into setting arbitrary sysctls, such as kernel.core_pattern, resulting in arbitrary code execution as root on the host CVE-2023-27561: runc could be tricked into bypassing the masked paths of a container via a volume mount race, exposing the host's procfs files (a regression of CVE-2019-19921) CVE-2024-10220: the kubelet could be made to execute arbitrary commands as root via gitRepo volumes (gitRepo volumes had a similar vulnerability, CVE-2018-11235, back in 2018 too) CVE-2025-31133: runc could be tricked into bind-mounting attacker-controlled paths and writing to the host's procfs files, such as /proc/sysrq-trigger and /proc/sys/kernel/core_pattern CVE-2026-53488: containerd could be tricked into executing arbitrary commands on the host, via crafted labels in a container image By running the node components in a user namespace, the potential damage is confined to th ## Rootless Podman: Preserving Source IPs DevFeed: [Rootless Podman: Preserving Source IPs]() Original publisher: [Read original article]() Author: Jan Rodak Published: 2026-09-04T14:25:02Z Content type: article Language: en Sources: [blog.podman.io]() Topics: [podman](), [Containers](), [Networks](), [Access Control](), [Logging]() Tags: [blog](), [bridge](), [container](), [containers](), [ipv4](), [ipv6](), [logging](), [networks](), [podman](), [port](), [rate-limiting](), [routing](), [tips-and-tricks]() ### AI overview This article explains how Pesto, a companion tool from the passt project, addresses Rootless Podman's inability to preserve incoming client source IPs on bridge networks. Pesto updates pasta's forwarding table so traffic reaches containers without source-address rewriting, while retaining existing port-mapping capabilities. The article also documents configuration steps, traffic flow, supported networking features, and limitations when switching from the current forwarder. ### Source excerpt Rootless Podman has a long-standing limitation reported since 2020: containers on bridge networks can't see the real source IP of incoming connections. The `rootlessport` userspace proxy rewrites the source to the container's own subnet address, breaking IP-based access control, logging, and rate limiting. Pesto, a new companion tool from the passt project solves this. Pesto [...] ## BGP-Free Core with SR-MPLS DevFeed: [BGP-Free Core with SR-MPLS]() Original publisher: [Read original article]() Published: 2026-09-03T05:30:00Z Content type: article Language: en Sources: [ipSpace.net blog]() Topics: [SR-MPLS](), [BGP](), [networking](), [Network](), [Routing (disambiguation)](), [Containers](), [Linux](), [GitHub]() Tags: [bgp](), [containers](), [edge](), [examples](), [github](), [is-is](), [linux](), [mpls](), [netlab](), [network](), [router](), [routing](), [sr-mpls]() ### AI overview This article demonstrates how to build a BGP-free transport core with SR-MPLS using netlab. It describes a lab topology with IS-IS, BGP, Linux container hosts, and PE routers, then shows how SR-MPLS labels provide end-to-end connectivity without BGP routes on the core router. ### Source excerpt The beauty of SR-MPLS is that it's a drop-in replacement for the traditional (LDP- or RSVP-based) MPLS control plane. For example, you could replace LDP with SR-MPLS in a network using MPLS to implement a BGP-free transport core, and it just keeps working. This scenario was the first "fun" scenario in the ITNOG10 Segment Routing workshop. The core network uses the same topology as in the previous examples; I added two hosts and BGP routing. Simplest possible network using a BGP-free core Read more ... [Next page]()