A developer released stealmybitcoin_poc.py, a standard-library Python script that reproduces the request sequence used to solve the 'Steal My Bitcoin' CTF challenge against PHP 8.4.26. The exploit abuses memory exhaustion during multipart session upload-progress parsing to leak heap and code addresses, then forges a HashTable to trigger a system() call via fewer than 20 HTTP requests. The author notes the script targets a local Docker lab replicating the challenge's Alpine/nginx/PHP-FPM setup rather than the live competition target.
github.com
· 2026-10-26
A blogger has published a tutorial explaining how to set up systemd-nspawn containers, describing the tool as a lightweight, namespace-based alternative to Docker that uses a writable root filesystem rather than prebuilt images. The post follows up on an earlier mention of isolating self-hosted Ollama and Open WebUI instances using the technology, and was prompted by a footnote that grew into a separate explainer on why Docker wasn't used instead.
quantum5.ca
· 2026-10-23
A developer writing a personal container runtime project shared findings about how Docker actually works under the hood. They note that containers are not a distinct Linux feature but a combination of namespaces, cgroups and networking tricks, that container images are simply folders used with chroot or pivot_root, and that Docker's runc runtime (written in Go) needs workarounds because Go lacks fork and runs multi-threaded by default.
codeandcake.dev
· 2026-10-22
The LiteLLM project's release pipeline was compromised on October 21, allowing attackers to publish a malicious version 1.107.0 to PyPI and Docker Hub containing compiled malware that steals credentials, secrets and environment variables. Affected artifacts included all seven PyPI wheels and several Docker Hub and GHCR image tags, live for roughly two to three hours before removal. The maintainer confirmed enterprise customers running the private version were not impacted, and said attackers modified only the installation package rather than the application code.
bleepingcomputer.com
· 2026-10-22
A new open-source project called Vacuula provides a self-hosted server that can repair and control Neato robot vacuums, including units left unusable after Neato's cloud services shut down. The tool currently supports Neato's Gen3 and Gen4 models (D3 through D10), with Gen2 BotVac Connected support still in development, and offers core features like maps, scheduling, zones and historical run data. Users set it up via Docker Compose or a Home Assistant add-on, running the server on their own hardware since it must stay online continuously.
github.com
· 2026-10-14
Docker disclosed a critical flaw in Docker Hub where converting a personal account into an organization could reassign that account's personal access token to a named owner without rotating the token or requiring the target's consent. An attacker could exploit this to authenticate as the target user, gaining the ability to pull, push, or delete images in their repositories, depending on the token's scope and permissions. The bug has existed since August 26, 2024, though it did not grant web access or allow changes to passwords, email, or two-factor settings.
bleepingcomputer.com
· 2026-10-13
Doory is a browser-based design tool offering templates and a blank-canvas editor for posters, slides, resumes, business cards and more, with exports to PNG, JPG, SVG, PDF, MP4 and GIF. It requires no account, is free to use, and can be self-hosted via a single docker compose command that runs the app, API, database and live collaboration.
github.com
· 2026-10-12
A developer has released Spool, a pre-1.0 open-source tool for creating and managing persistent Claude Code sessions, called 'loops', that can schedule wakes, resume sessions, and coordinate with each other. Users can interact with these loops through a web control room, Telegram, or Slack instead of monitoring individual terminal sessions. Spool itself is built by a fleet of Claude Code loops running on the tool, with human review and merging of all changes via pull requests.
github.com
· 2026-10-11
Docker has introduced Docker Agent, a CLI plugin that enables users to build, run, and share AI agents using YAML configurations without coding. The platform supports multi-agent teams, a broad tool ecosystem, and compatibility with various AI providers, all deployable via Docker or OCI registries.
github.com
· 2026-10-07
A new implementation within Linux containers removes several powerful capabilities, including audit controls, suspend prevention, and file system access, by modifying capability sets in a concise codebase. These changes aim to restrict container privileges and enhance security.
blog.lizzie.io
· 2026-10-05
A developer has released Arcadeia, an open-source, self-hosted web application for browsing, searching and managing personal photo and video collections. The tool generates animated thumbnails that preview key moments in videos automatically, and supports drag-and-drop imports, favorites, in-browser transcoding, and network storage connections. It is licensed under AGPL-3.0 and deployed via Docker.
github.com
· 2026-10-04
A Docker engineer recounts that Docker Desktop (originally Docker for Mac) was built on a custom-built lightweight VMM called hyperkit, developed from Docker's Mirage Unikernel libraries, running a minimal LinuxKit-based kernel. This architecture replaced VirtualBox, which had powered the earlier Docker Toolbox, and has since evolved into what the company now calls Docker VMM.
dave.recoil.org
· 2026-10-03
GoKawiil