AWS Firecracker focuses on one aspect of security – restricting the blast-radius of an attack emanating from a container or function.
Linux Firewalls: How to Actually Secure a Cloud Server (iptables, nftables, firewalld, ufw)
A practical guide to the four major Linux firewall technologies - iptables, nftables, firewalld, and ufw. Covers real-world cloud server hardening with concrete examples, from locking down SSH to b...
Apple’s Containerization Framework and the Future of Secure Computing
The container revolution transformed how we deploy and manage applications, but it also inherited fundamental security and resource…
Container Escape Techniques: Breaking Out of the Digital Jail
How Attackers Break Free From Containerized Environments and What Defenders Need to Know
Review: AWS App Mesh – A service mesh for EC2, ECS, and EKS
It seems to me like everyone is talking about service meshes these days - definitely a hot topic in the world of containers a...
Attacking & Auditing Docker Containers Using Open Source tools
Container Platform Comparison: Cloudflare Containers vs Rivet Containers vs Fly Machines - Rivet
**Rivet is an open-source, self-hostable serverless alternative to Cloudflare Workers, Durable Objects, and Containers. Check out Rivet Containers and visit our GitHub.**
Moving Beyond Containers - Introducing Boxer by Daniel Phillips @Wasm I/O 2025
Your agent needs a computer, not a container — introducing @cloudflare/computer
Agents need more than just a container to scale. We're introducing @cloudflare/computer, an agent runtime that dynamically orchestrates between fast, efficient isolates and full Linux containers to give every agent a computer of its own.
anthropic-experimental/sandbox-runtime
A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.
Boxer: Smaller, Faster, Safer
Boxer offers a lightweight, secure, and near-universally deployable alternative to traditional containers using WebAssembly.
Quantifying Frontier LLM Capabilities for Container Sandbox Escape
AI agents are demonstrating rapid improvement in capabilities: the length of some tasks that frontier models can complete autonomously—measured in human-equivalent time—has been doubling approximately every seven months (METR, 2025; AI Security Institute, 2025a). In cybersecurity, current models achieve non-trivial success (Zhang et al., 2025) on professional-level Capture the Flag challenges, and recent evaluations report 13% success rates on exploiting real-world web application vulnerabilities (Zhu et al., 2025b). These results indicate that modern models can already perform multi-step vulnerability discovery and exploitation.
How Sandstorm Works: Containerize data, not services
Take control of your web by running your own personal cloud server with Sandstorm.
ybzeek/The-Loom
A high-throughput, database-free ingestion engine for the AT Protocol (Bluesky) Firehose, engineered for consumer hardware constraints.
Containers From Scratch • Liz Rice • GOTO 2018
Sooraj on Twitter / X
IronClaw (@near_ai, Rust) is the most architecturally serious alternative. Built by @ilblackdragon as a direct response to OpenClaw's security failures. Tools and channels run in isolated WASM containers with capability-based permissions. Credentials live in an encrypted vault… https://t.co/3VkLn4f0Ai— Sooraj (@iAnonymous3000) February 16, 2026