lockc

lockc es un software de código abierto para proporcionar auditoría de seguridad de tipo MAC Control de Acceso Obligatorio para cargas de trabajo en contenedores. La razón principal por la que lockc existe es que los contenedores no contienen. Los contenedores no son tan seguros ni aislados como l...

yolobox

██╗ ██╗ ██████╗ ██╗ ██████╗ ██████╗ ██████╗ ██╗ ██╗ ╚██╗ ██╔╝██╔═══██╗██║ ██╔═══██╗██╔══██╗██╔═══██╗╚██╗██╔╝ ╚████╔╝ ██║ ██║██║ ██║ ██║██████╔╝██║ ██║ ╚███╔╝ ╚██╔╝ ██║ ██║██║ ██║ ██║██╔══██╗██║ ██║ ██╔██╗ ██║ ╚██████╔╝███████╗╚██████╔╝██████╔╝╚██████╔╝██╔╝ ██╗ ╚═╝ ╚═════╝ ╚══════╝ ╚═════╝ ╚═════╝...

nanoclaw

Un asistente de IA que ejecuta agentes de forma segura en sus propios contenedores. Ligero, diseñado para ser fácilmente entendido y completamente personalizado según tus necesidades. nanoclaw.dev • documentación • 中文 • 日本語 • 한국어 • • Por qué construí NanoClaw OpenClaw es un proyecto impresionante...

sysbox

Introduction Sysbox is an open-source and free container runtime a specialized "runc", originally developed by Nestybox acquired by Docker on 05/2022, that enhances containers in two key ways: Improves container isolation: Linux user-namespace on all containers i.e., root user in the container ha...

agentbox

Agentbox - Sandbox de Agentes de Codificación No hay una forma perfecta de aislar agentes todavía, pero los contenedores son un inicio práctico. Agentbox es un sandbox para agentes de codificación basado en Docker, originalmente inspirado por Batrachian Toad, y ahora generalizado para más...

kata-containers

Kata Containers Добро пожаловать в Kata Containers! Этот репозиторий содержит код Kata Containers для релизов 2.0 и новее. Если вы хотите узнать о Kata Containers, посетите основной веб-сайт Kata Containers. Введение Kata Containers — это проект с открытым исходным кодом и сообщество, работающие...

gvisor

Что такое gVisor? gVisor обеспечивает надёжный уровень изоляции между работающими приложениями и операционной системой хоста. Это прикладное ядро, реализующее Linux-подобный интерфейс. В отличие от Linux, оно написано на безопасном для памяти языке Go и работает в пользовательском пространстве...

CVE-2024-10220-Kubernetes-gitRepo-Volume-Vulnerability

CVE-2024-10220-Kubernetes-gitRepo-Volume-Vulnerability By Mark Mallia Containerization and the Power of Automation Containerization is the backbone of modern application delivery: it bundles an entire runtime stack into a single, immutable image that can be rolled out on any host in a cluster...

The vulnerability of the Container Isolation FS Filter driver for Windows operating systems allows a hacker to compromise the integrity of the protected information.

The vulnerability of the Container Isolation FS Filter driver for Windows operating systems is related to the incorrect handling of symbolic references before accessing a file. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink()

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface vti6 component. An unprivileged local user, particularly within a user namespace, could exploit a vulnerability related to incorrect network namespace handling during the movement of a vti6 tunnel. This issue can lead to a kerne...

CVE-2026-58196 ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol MCP servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go, whose host-side HTTP...

kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink()

A flaw was found in the Linux kernel's IPv6 Virtual Tunnel Interface vti6 component. An unprivileged local user, particularly within a user namespace, could exploit a vulnerability related to incorrect network namespace handling during the movement of a vti6 tunnel. This issue can lead to a kerne...

CVE-2026-82430 Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

Description When launching a Docker or OCI worker, the setuid-root worker-launcher first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory. The file is opened...

CVE-2026-82430

Apache Storm's setuid-root worker-launcher suffers from a time-of-check time-of-use (TOCTOU) race condition : it changes ownership of the worker directory to the untrusted topology user before reading the supervisor-written command file, which is opened without O_NOFOLLOW or owner re-verification...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework developed by Docker Inc., distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby versions prior to 28.0.0. When firewalld is reloaded, Docker fails to recreate...

CVE-2026-62313

Incus (system container and VM manager) prior to 7.3.0 contains a bypass of the project-level restriction restricted.containers.privilege=isolated. The check only rejects an explicitly set security.idmap.isolated=false or empty value, but does not enforce the restriction when the key is omitted e...

CVE-2026-62313 Incus: Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `security.idmap.isolated`

Incus is a system container and virtual machine manager. Prior to version 7.3.0, project-level enforcement of restricted.containers.privilege=isolated can be trivially bypassed, allowing a user to create a non-isolated shared host idmap container in a project that is configured to forbid them. Th...

Linux Distros Unpatched Vulnerability : CVE-2026-63295

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is...

CVE-2026-63295

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges such as enforcing restricted.containers.privilege=isolated, LXD fails to enforce the...

CVE-2026-63295

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container privileges such as enforcing restricted.containers.privilege=isolated, LXD fails to enforce the...