--- title: "Containers" description: "11 posts about Containers, summarised, each linking to the original." --- # Containers > 11 posts about Containers, summarised, each linking to the original. ## Articles ### [Test and deploy bootable containers with bootc virtualization kit (bcvk)](https://yomu.fyi/post/test-and-deploy-bootable-containers-with-bootc-virtualization-kit-bcvk.md) - Company: [Red Hat](https://yomu.fyi/company/red-hat.md) - Author: Andre Luiz Facina - Published: Oct 13, 2026 - Type: Tutorial Managing a traditional operating system across multiple hosts often leads to configuration drift, slow updates, and painful rollbacks. Bootable containers solve this by packaging the entire OS as an OCI container image, including the kernel, initrd, bootloader, and applications. Red Hat Enterprise Linux 10 introduced image mode deployment, and the bootc container virtualization kit (bcvk) enables end-to-end testing of these images on a laptop using familiar Podman and libvirt packages. The tool offers three deployment modes: ephemeral for rapid testing, persistent for long-term development, and disk image for creating bootable artifacts. Users build a custom bootc image via a Containerfile with the containers.bootc=1 label, then deploy it identically across virtual and physical infrastructure, reducing environmental drift. ### [Use Paicku to containerize and test any app with buildpacks and Node.js](https://yomu.fyi/post/use-paicku-to-containerize-and-test-any-app-with-buildpacks-and-node-j.md) - Company: [Red Hat](https://yomu.fyi/company/red-hat.md) - Author: Costas Papastathis - Published: Oct 7, 2026 - Type: Tutorial Paicku is a command-line tool and Node.js library that wraps the Pack CLI to containerize applications using Cloud Native Buildpacks. It can be installed globally via npm install -g paicku or run with npx. It downloads and configures Pack for the host OS and container runtime, eliminating manual setup. Users build images with npx paicku build, defaulting to builder paketobuildpacks/builder-ubi8-base, and can list available builders with the suggest command. The Node.js librarys createPaicku function provides a build method returning an image object with run and stop for integration tests; an example test builds an app, starts the container, and asserts HTTP 200. Paicku detects Docker or Podman and supports any language a builder supports, such as Node.js and Java, by only changing the application path. ### [Why your non-root container dropped its capabilities (and how to fix it)](https://yomu.fyi/post/why-your-non-root-container-dropped-its-capabilities-and-how-to-fix-it.md) - Company: [Red Hat](https://yomu.fyi/company/red-hat.md) - Author: Nandan Hegde - Published: Oct 5, 2026 - Type: Problem & solution A platform engineer traces why a non-root OpenShift container configured with CAP\_NET\_RAW still fails ping with Operation not permitted. The root cause is that SCC is only an admission-time gate that does not enforce runtime privileges. CRI-O translates the PodSpec into an OCI spec with the capability in the Bounding, Effective, and Permitted sets but deliberately omits ambient capabilities. During the runtime’s UID transition from root to the target non-root user, the kernel clears both Permitted and Effective sets, leaving an empty CapEff. The only mechanism that survives a UID transition for non-root processes is ambient capabilities, which CRI-O intentionally avoids to preserve the Kubernetes assumption that switching to a non-root user drops capabilities. To resolve this, file capabilities can be applied directly to the binary via setcap, avoiding the need for ambient capabilities. ### [Streamline: custom video pipelines with Cloudflare Stream and Workers](https://yomu.fyi/post/streamline-custom-video-pipelines-with-cloudflare-stream-and-workers.md) - Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md) - Author: Taylor Smith - Published: Oct 2, 2026 - Type: Announcement Cloudflare released Streamline, a developer playground that demonstrates how to build custom video pipelines using its Developer Platform. Streamline combines Workers, Containers, and Durable Objects to create long-running media processing sessions that can render dynamic annotations or burn in subtitles on livestreams and hosted videos. The architecture consists of a Media Engine running in a Container, controlled by a Worker application that handles orchestration and preview via Durable Objects. The Media Engine uses FFmpeg for processing and supports inputs from RTMPS, HLS, or webcam, with output to Cloudflare Stream or WebSocket preview. Streamline is open source, with repositories for the media engine and an example application, and a public playground is available for testing. ### [VM Sandboxes: Full computers for agents](https://yomu.fyi/post/vm-sandboxes-full-computers-for-agents.md) - Company: [Modal](https://yomu.fyi/company/modal.md) - Published: Oct 1, 2026 - Type: Announcement Modal has launched VM Sandboxes in general availability, providing agents with full Linux VMs accessible via a single flag. The VMs support Docker stacks, local databases, dev servers, and other real-machine features that agents increasingly require, as demonstrated by Ramp’s internal agent driving the entire software development lifecycle. Modal built a custom runtime on the Rust-based Cloud Hypervisor, layering innovations in host filesystems, lazy image loading, memory bursting, and snapshotting to preserve the same APIs and sub-second cold starts as their existing gVisor Sandboxes. Early customers like Linear, Legora, and Snorkel have launched over 20 million VMs, using them for coding sessions, legal agent evaluations, and agent simulations that require multiple containers and real-world environments. Modal recommends using VM Sandboxes when workloads need Docker, FUSE filesystems, or niche kernel features, while gVisor remains the default for compatible workloads. ### [Runtime Roundup: VM Sandboxes, Multi-node clusters, and more](https://yomu.fyi/post/runtime-roundup-vm-sandboxes-multi-node-clusters-and-more.md) - Company: [Modal](https://yomu.fyi/company/modal.md) - Published: Oct 1, 2026 - Type: Announcement Modal announced several new features at its inaugural Runtime conference. VM Sandboxes provide agents with full Linux computer access, supporting Docker stacks, databases, graphical environments, and kernel experimentation, already used at Linear, Legora, and Snorkel for coding agents and evals. Sandbox Sidecars run alongside main sandboxes with isolation but share a host, allowing agent code in the main sandbox while trusted operations run in a sidecar the agent cannot access, avoiding network round trips in execution-heavy loops. Modal Clusters, now generally available via @modal.clustered, enable multi-node jobs for training or serving trillion-parameter models, powering post-training at Decagon and real-time inference at Runway. Sticky Sessions maintain client state by routing to the same container using a session token, critical for voice model serving, while Endpoint Candidates allow mirroring production traffic to compare quality, latency, throughput, and cost before promoting. ### [Cloudflare Containers, rebuilt to scale agent sandboxes](https://yomu.fyi/post/cloudflare-containers-rebuilt-to-scale-agent-sandboxes.md) - Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md) - Author: Thomas Lefebvre - Published: Sep 30, 2026 - Type: Announcement Cloudflare Containers have been rebuilt to meet the needs of agent sandboxes, which require on-demand creation, fast startup, and the ability to pause and resume. The new durable\_object scheduling policy lets application code choose each sandbox’s image and instance type at runtime, replacing the previous deploy-time configuration. A redesigned runtime reduces median container startup from over four seconds to 648 milliseconds, and filesystem snapshots are available in public beta for saving and restoring workspaces. Each container retains its Durable Object as a persistent, programmable controller that manages its lifecycle and outbound traffic. These changes make Containers a more flexible complement to Workers and Durable Objects for agents needing a full Linux workspace. ### [From Dockerfile to Kit: the Docker Sandboxes Kit Specification](https://yomu.fyi/post/from-dockerfile-to-kit-the-docker-sandboxes-kit-specification.md) - Company: [Docker](https://yomu.fyi/company/docker.md) - Author: Jin Kim - Published: Sep 24, 2026 - Type: Announcement The Docker Sandbox Kit Specification v3 defines how an agent declares the networks, credentials, and volumes it needs, so these grants travel with the artifact rather than living in shell history or dashboards. A Kit is an ordinary OCI image whose manifest carries a descriptor annotation vnd.docker.sandbox.kit.descriptor, so it builds with docker buildx, pulls with docker pull, and gets scanned and signed by existing tooling. Capability types like network-policy@2 and credential@1 are versioned independently, and each normative statement in the specification is covered by a conformance check or a written waiver. Two Kit types exist: a workload supplies the root filesystem, while a mixin adds overlays such as a CLI with its network rule; the runtime rejects required capabilities it cannot satisfy. Composition uses strict provides/requires resolution, so authority changes appear as diffs, and a conforming runtime can gate upgrades that widen the grant set. ### [How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers](https://yomu.fyi/post/how-cloudflare-addressed-a-cross-tenant-data-exposure-vulnerability-in.md) - Company: [Cloudflare](https://yomu.fyi/company/cloudflare.md) - Author: Hrushikesh Deshpande - Published: Sep 24, 2026 - Type: Incident / postmortem Security researcher Oren Yomtov reported a vulnerability in Cloudflare Containers and Sandboxes through the bug bounty program, demonstrating that a Workers Paid account could recover residual disk blocks from previous containers on the same host. The issue arose from Linux device mapper thin provisioning with skip\_block\_zeroing enabled, which left unzeroed 64 KiB blocks when a 4 KiB write triggered allocation, allowing the remaining 60 KiB to retain prior data. Researchers recovered directory structures, database pages, and structurally complete SQLite databases from 18 of 24 placements across four continents, using ext4 checksums to distinguish foreign blocks. Cloudflare removed skip\_block\_zeroing, retired all running container disks, and cleared cached image snapshots created before the mitigation, completing cleanup by September 19. Retained disk-I/O telemetry showed no evidence of malicious exploitation, and the researchers confirmed secure deletion of recovered data. ### [Build OpenJDK container images locally using the standalone S2I tool](https://yomu.fyi/post/build-openjdk-container-images-locally-using-the-standalone-s2i-tool.md) - Company: [Red Hat](https://yomu.fyi/company/red-hat.md) - Author: Francisco De Melo Junior - Published: Sep 23, 2026 - Type: Tutorial Red Hat provides the Red Hat build of OpenJDK for running Java applications on Red Hat OpenShift 4. Developers can use the standalone Source-to-Image (S2I) CLI to build and test OpenJDK container images locally before deploying to a cluster. S2I produces reproducible images by injecting source code into a builder image and running its assemble script. The toolkit supports flags such as –loglevel for detailed output, –environment-file to pass custom JVM settings like G1GC and MaxRAMPercentage, and –as-dockerfile to output a Dockerfile. After building, the image can be tested locally with docker run, then uploaded to the cluster for deployment. ### [Scaling to 1 million concurrent sandboxes in seconds](https://yomu.fyi/post/scaling-to-1-million-concurrent-sandboxes-in-seconds.md) - Company: [Modal](https://yomu.fyi/company/modal.md) - Published: Jul 16, 2026 - Type: Problem & solution Modal rebuilt its sandbox platform to support millions of concurrent sandboxes and tens of thousands of creations per second, removing all central bottlenecks from the control plane. The new architecture eliminates central coordination and durable datastores from the critical path, using horizontally scaled scheduling servers that run a fast load-balancing algorithm against in-memory cached worker state from Redis streams. Workers are contacted directly via RPC to create sandboxes, and sandbox metadata is written asynchronously, avoiding O(sandboxes) and O(nodes) operations that limited previous systems. In a benchmark, Modal created 1 million sandboxes in under a minute with median time-to-interactivity under half a second, though the long tail is attributed to kernel and network contention like the rtnl lock. The system is designed to scale without practical limits, supporting use cases like reinforcement learning and background agents that require massive concurrent sandbox creation.