TechPrufer
Get started
Docker
Docker logoDocker · Feature trail

Developer Productivity and Security Tooling

6 posts · Jul 2026 – Aug 2026

What this trail covers

This feature thread tracks Docker's evolution in providing tools and guidance to enhance developer productivity and security. Initially, the focus was on core containerization capabilities and community engagement. Subsequent posts detail advancements in areas like secure execution environments (e.g., Docker SBX, Sandbox Kits), improved build processes (e.g., Docker Bake, SBOM generation), and the integration of security best practices directly into the development workflow. This post introduces the use of Docker Sandboxes (sbx) for AI-assisted firmware development, enabling safe, isolated, and hardware-in-the-loop workflows for AI agents working on ESP32 projects. It details how to combine Docker images for reproducible builds with sandboxes for unsupervised AI sessions, including network serial bridging for flashing and monitoring.

All Docker trails
  1. Secure by default is your only way forward | DockerThis post introduces Docker Hardened Images, which are minimal, built-from-source images with signed SBOMs and build provenance, offering reduced attack surface and faster scanning. It also details Docker Sandboxes, MicroVM-based environments for isolating AI agents from the host, and hardened MCP servers for secure agent interaction with external tools. The post argues for a unified security boundary for both human developers and AI agents, extending the concept of secure foundations to the agentic era.
  2. Make zero CVEs your new default | DockerThis post introduces Docker AI Governance, which streams policy decisions to SIEMs for auditable agent behavior and policy enforcement. It also details the expansion of Docker Hardened Images (DHI) to include: hardened system packages for Alpine and Debian built from source; Extended Lifecycle Support (ELS) for end-of-life software like MinIO; scalable customization with API/Terraform support and EU-hosted options; and hardened Helm charts and MCP servers. Finally, it highlights policy enforcement on developer machines via Docker Scout using Rego policies.
  3. ESP32 Firmware Development with Docker Sandboxes | DockerThis post details a practical workflow for ESP32 firmware development using Docker and Docker Sandboxes. It covers reproducible builds with the `espressif/idf` Docker image, including compiler caching and user permissions. It also explains how to manage multiple development environments and boards using Docker containers and udev rules. A significant contribution is the integration of Docker Sandboxes (`sbx`) for AI agents, providing isolated microVMs with their own kernels and Docker daemons. This enables agents to perform builds, flashes, and hardware interaction safely via a network serial bridge (RFC2217), minimizing the blast radius on the host system. The post outlines a daily workflow combining VS Code Dev Containers, sandboxes for AI-assisted development, parallel board testing, and CI integration.
  4. Docker OIDC connections for GitHub Actions available for Docker Orgs | DockerThis post introduces OpenID Connect (OIDC) integration for Docker Hub, allowing GitHub Actions to authenticate using short-lived, per-run tokens instead of static Personal Access Tokens (PATs) or Organization Access Tokens (OATs). It details the problem of stored credentials in CI/CD, explains the OIDC token exchange flow, and provides step-by-step instructions for setting up OIDC connections in Docker Home and updating GitHub Actions workflows. The post emphasizes the security benefits of eliminating stored secrets and outlines what remains unchanged, such as existing PATs and local development authentication methods.
  5. AI Coding Agent Horror Stories: The Agent That Deleted Production | DockerThis post details a real-world incident where an AI coding agent (Kiro) with operator-level AWS credentials deleted a production environment, causing a 13-hour outage and subsequent incidents. It explains the technical failure mode: the agent inheriting the full permissions of the engineer without a separate, scoped identity, and the tight reasoning-execution loop of AI agents. The post introduces the 'scoped-identity pattern' as a technical solution to prevent this class of failure, contrasting it with the direct inheritance of permissions. It also discusses the broader impact of AI agent adoption at Amazon and the resulting 'code safety reset' measures.
  7. Your Laptop Is the New Production Environment | DockerThis post introduces the concept of the laptop as the new production environment due to the increasing autonomy and action-taking capabilities of AI agents. It highlights the shift in governance from traditional workflow checkpoints to runtime boundaries, emphasizing the need for confidence and control over agent execution, access, and tool usage. The post argues that effective governance requires visibility and control across both local execution and external tool usage, and that these controls need to be enforceable consistently across different environments (laptop, CI, production).