Cloud and Datacenter Management Blog

Microsoft Hybrid Cloud blogsite about Management


Leave a comment

Docker Sandbox for Testing

Docker Sandbox project.

A Docker sandbox gives you a safe, disposable environment to experiment, build, or let automated tools run without risking your real system. It’s becoming an essential part of modern development workflows, especially as coding agents and cloud‑based tooling evolve. Docker

What a Docker sandbox actually is

A Docker sandbox is an isolated execution environment that behaves like a lightweight, temporary machine. It lets you run containers, install packages, modify configurations, and test ideas freely—while keeping your host system untouched. Modern implementations often use microVMs to provide stronger isolation than traditional containers, giving you the flexibility of a full system with the safety of a sealed box.

Key characteristics include:

  • Isolation — Your experiments can’t affect your host OS.
  • Disposability — You can reset or destroy the environment instantly.
  • Reproducibility — Every sandbox starts from a known, clean state.
  • Autonomy — Tools and agents can run unattended without permission prompts.

Why Docker sandboxes matter now

The rise of coding agents and automated development tools has created new demands. These agents need to run commands, install dependencies, and even use Docker themselves. Traditional approaches—like OS‑level sandboxing or full virtual machines—either interrupt workflows or are too heavy. Docker sandboxes solve this by offering:

  • A real system for agents to work in
  • The ability to run Docker inside the sandbox
  • A consistent environment across platforms
  • Fast resets for iterative development

This makes them ideal for AI‑assisted coding, CI/CD experimentation, and secure testing.

Where you can use Docker sandboxes today

Several platforms now offer browser‑based or cloud‑hosted Docker sandboxes, making it easy to experiment without installing anything locally.

  • Docker Sandboxes (Docker Inc.) — Purpose‑built for coding agents, using microVM isolation.
  • CodeSandbox Docker environments — Interactive online playgrounds where you can fork, edit, and run Docker‑based projects directly in the browser. CodeSandbox
  • LabEx Online Docker Playground — A full Docker terminal running on Ubuntu 22.04, ideal for learning and hands‑on practice, especially as Play with Docker winds down. LabEx

These platforms remove setup friction and let you focus on learning, testing, or building.

How developers typically use Docker sandboxes

A Docker sandbox fits naturally into several workflows:

  • Learning Docker — Practice commands, build images, and explore networking without installing anything.
  • Testing risky changes — Try new packages, configs, or scripts without fear of breaking your machine.
  • Running coding agents — Give AI tools a safe environment to operate autonomously.
  • Prototyping microservices — Spin up isolated services quickly and tear them down just as fast.
  • Teaching and workshops — Provide a consistent environment for all participants.

A non‑obvious advantage

Docker sandboxes aren’t just about safety—they’re about speed of iteration. Because they reset instantly and start from a known state, they eliminate the “works on my machine” problem and make experimentation frictionless. This is especially powerful when combined with automated tools or when onboarding new team members.

Closing thought

Docker sandboxes are becoming a foundational tool for modern development—combining safety, speed, and autonomy in a way that traditional containers or VMs alone can’t match. They’re especially valuable if you’re experimenting with AI‑driven coding tools or want a clean, reproducible environment for testing.
Important: Use Docker Sandboxes for testing.

Claude Code sandbox

It works great with VSCode and with Copilot.

More information about Docker Sandbox

 


Leave a comment

Azure Local Cluster + Azure Cloud + Docker AI Edge

Azure Local Cluster on‑site working in tandem with Azure Cloud, running Dockerized AI workloads at the edge — is not just viable. It’s exactly the direction modern distributed AI systems are heading.

Let me unpack how these pieces fit together and why the architecture is so compelling.

Azure Local Baseline reference Architecture

A powerful hybrid model for real‑world AI

Think of this setup as a two‑layer AI fabric:

  • Layer 1: On‑site Azure Local Cluster
    Handles real‑time inference, local decision‑making, and data preprocessing.
    This is where Docker containers shine: predictable, isolated, versioned workloads running close to the data source.
  • Layer 2: Azure Cloud
    Handles heavy lifting: model training, analytics, fleet management, OTA updates, and long‑term storage.

Together, they create a system that is fast, resilient, secure, and scalable

Why this architecture works so well

  1. Ultra‑low latency inference

Your on‑site Azure Local Cluster can run Dockerized AI models directly on edge hardware (Jetson, x86, ARM).
This eliminates cloud round‑trips for:

  • object detection
  • anomaly detection
  • robotics control
  • industrial automation

Azure Local provides the core platform for hosting and managing virtualized and containerized workloads on-premises or at the edge.

  1. Seamless model lifecycle management

Azure Cloud can:

  • train new models
  • validate them
  • push them as Docker images
  • orchestrate rollouts to thousands of edge nodes

Your local cluster simply pulls the new container and swaps it in.
This is exactly the “atomic update” pattern from the blogpost.

  1. Strong separation of concerns

Local cluster = deterministic, real‑time execution
Cloud = dynamic, scalable intelligence

This separation avoids the classic problem of trying to run everything everywhere.

  1. Enterprise‑grade security

Azure Arc, IoT Edge, and Container Registry gives you:

  • signed images
  • policy‑based deployments
  • identity‑bound devices
  • encrypted communication

This is critical when edge devices live in factories, stores, or public spaces.

  1. Cloud‑assisted intelligence

Even though inference happens locally, the cloud can still:

  • aggregate telemetry
  • retrain models
  • detect drift
  • optimize pipelines
  • coordinate multi‑site deployments

This is how AI systems improve over time. 

How Docker fits into this hybrid world

Docker becomes the unit of deployment across both environments for DevOps and developers.

On the edge:

  • lightweight images
  • Hardened images
  • GPU‑enabled containers
  • read‑only root filesystems
  • offline‑capable workloads

In the cloud:

  • CI/CD pipelines
  • model registries
  • automated scanning
  • versioned releases

The same container image runs in both places — but with different responsibilities.

My take: This is one of the strongest architectures for real‑world AI

If your goal is:

  • real‑time AI
  • high reliability
  • centralized control
  • scalable deployments
  • secure operations
  • hybrid cloud + edge synergy

…then Azure Local Cluster + Azure Cloud + Docker AI Edge is a near‑ideal solution.

It gives you the best of both worlds:
cloud intelligence + edge autonomy.

Here you find more about Microsoft Azure Local 

Here you find more blogposts about Docker, Windows Server 2025, and Azure Cloud Services :

Windows Server 2025 Core and Docker – A Modern Container Host Architecture

Docker Desktop Container Images and Azure Cloud App Services


Leave a comment

FREE Hardened Docker images is the New Security Baseline for Developers and Business

The Rise of Free Hardened Docker Images: A New Security Baseline for Developers and DevOps

Containerization has become the backbone of modern software delivery. But as adoption has exploded, so has the attack surface. Vulnerable base images, outdated dependencies, and misconfigured runtimes have quietly become some of the most common entry points for supply‑chain attacks.

The industry has been asking for a better baseline—something secure by default, continuously maintained, and frictionless for teams to adopt. And now we’re finally seeing it: free hardened Docker images becoming widely available from major vendors and open‑source security communities.

This shift isn’t just a convenience upgrade. It’s a fundamental change in how we think about container security.

Why Hardened Images Matter More Than Ever

A “hardened” image isn’t just a slimmer version of a base OS. It’s a container that has been:

  • Stripped of unnecessary packages
    Fewer binaries = fewer vulnerabilities.
  • Built with secure defaults
    Non‑root users, locked‑down permissions, and minimized attack surface.
  • Continuously scanned and patched
    Automated pipelines ensure CVEs are fixed quickly.
  • Cryptographically signed
    So you can verify provenance and integrity before deployment.
  • Aligned with compliance frameworks
    CIS Benchmarks, NIST 800‑190, and other standards are increasingly baked in.

For developers, this means fewer surprises during security reviews. For DevOps teams, it means fewer late‑night patch cycles and fewer emergency rebuilds.

What’s New About the Latest Generation of Free Hardened Images

The newest wave of hardened images goes far beyond the “minimal OS” approach of the past. Here’s what’s changing:

  1. Hardened Language Runtimes

We’re seeing secure-by-default images for:

  • Python
  • Node.js
  • Go
  • Java
  • .NET
  • Rust

These images often include:

  • Preconfigured non‑root users
  • Read‑only root filesystems
  • Mandatory access control profiles
  • Reduced dependency trees
  1. Automated SBOMs (Software Bills of Materials)

Every image now ships with a machine‑readable SBOM.
This gives you:

  • Full visibility into dependencies
  • Faster vulnerability triage
  • Easier compliance reporting

SBOMs are no longer optional—they’re becoming a standard part of secure supply chains.

  1. Built‑in Image Signing and Verification

Tools like Sigstore Cosign, Notary v2, and Docker Content Trust are now integrated directly into image pipelines.

This means you can enforce:

  • “Only signed images may run” policies
  • Zero‑trust container admission
  • Immutable deployment guarantees
  1. Continuous Hardening Pipelines

Instead of waiting for monthly rebuilds, hardened images are now updated:

  • Daily
  • Automatically
  • With CVE‑aware rebuild triggers

This dramatically reduces the window of exposure for newly discovered vulnerabilities.

Read the complete blogpost about a Safer Container Ecosystem with Docker: Free Docker Hardened Images here


Leave a comment

Docker Desktop 4.51.0 Kubernetes Gets a Major Update

Docker Desktop continues to evolve as the go-to platform for containerized development, and the latest release — version 4.51.0 — brings exciting new capabilities for developers working with Kubernetes.

What’s New in 4.51.0

  1. Kubernetes Resource Setup Made Simple

One of the standout features in this release is the ability to set up Kubernetes resources directly from a new view inside Docker Desktop. This streamlined interface allows developers to configure pods, services, and deployments without leaving the Desktop environment. It’s a huge step toward making Kubernetes more approachable for teams who want to focus on building rather than wrestling with YAML files.

  1. Real-Time Kubernetes Monitoring

The new Kubernetes view also provides a live display of your cluster state. You can now see pods, services, and deployments update in real time, making it easier to spot issues, monitor workloads, and ensure everything is running smoothly.

  1. Smarter Dependency Management

Docker Desktop now integrates improvements with Kind (Kubernetes in Docker), ensuring that only required dependency images are pulled if they aren’t already available locally. This reduces unnecessary downloads and speeds up cluster setup.

  1. Updated Core Components
  • Docker Engine v28.5.2 ships with this release, ensuring stability and performance improvements.
  • Enhanced Linux kernel support for smoother Kubernetes operations.

Why This Matters

Kubernetes has a reputation for being complex for some people, but Docker Desktop 4.51.0 is working to change that. By embedding Kubernetes resource management and monitoring directly into the Desktop experience, Docker is lowering the barrier to entry for developers and teams. Whether you’re experimenting with microservices or managing production-like environments locally, these new features make Kubernetes more accessible and intuitive.

Getting Started

To try out these new features:

  1. Update to Docker Desktop 4.51.0.
  2. Open the new Kubernetes view to configure resources.
  3. Watch your pods, services, and deployments update in real time.

Update available with New Kubernetes UI
Click on Download Update

Click on Create Cluster

Here you can select a Single Node Cluster or with Kind a Multi-Node Cluster.
I selected for a Single node cluster.

Click on Install

Here is your Single Node Kubernetes Cluster running with version 1.34.1

Kubectl get nodes

My Nginx Container app is running on Kubernetes in Docker Desktop 😉

Final Thoughts

Docker Desktop 4.51.0 is more than just an incremental update — it’s a meaningful step toward bridging the gap between container development and Kubernetes orchestration. With simplified setup and real-time monitoring, developers can spend less time configuring and more time innovating. 🐳

Here you find more information about Docker Desktop and Kubernetes Clustering

 


Leave a comment

Docker Desktop Container Images and Azure Cloud App Services

Docker Desktop and Azure App Cloud Services

Expanded Architecture: Docker developer environment with Azure Cloud Services.

Development Environment

  • Docker Desktop + Tools: Visual Studio Code, Azure CLI, Docker Scout, AI, MCP
  • Docker Scout CLI: Compares image versions, detects CVEs, integrates with pipelines

Container Host (Windows Server 2025 Core)

  • Hyper-V Isolated Containers: For enhanced security
  • Workloads: Microservices, legacy apps, AI containers
  • GitOps Operator: Automated deployment via Git repositories
  • Azure Arc Agent: Connects on-prem host to Azure Control Plane

Here you find more information about Docker on Windows Server 2025 Core

Your Windows 11 Laptop with Docker Desktop

☁️ Azure Cloud Integrations

Component Function
Azure App Service (Docker) Hosts web apps as Docker containers with autoscaling and Key Vault integration
Azure DevOps + Pipelines CI/CD for image build, scan, push, and deployment
Azure Copilot Security AI-driven security recommendations and policy analysis
Azure Container Registry (ACR) Secure storage and distribution of container images
Azure Key Vault Secrets management: API keys, passwords, certificates
Microsoft Defender for Cloud Runtime protection, image scanning, threat detection
Azure Policy & RBAC Governance and access control
Azure Monitor + Sentinel Logging, metrics, threat detection
Azure Update Manager Hotpatching of Windows and container images without reboot

More information on Strengthening Container Security with Docker Hardened Images and Azure Container Registry

DevSecOps Workflow

  1. Build & Harden Image → Dockerfile + SBOM
  2. Scan with Docker Scout → CLI or pipeline
  3. Push to ACR → With signing and RBAC
  4. Deploy via Azure DevOps Pipelines → App Service or Arc-enabled host
  5. Inject Secrets via Key Vault → Automatically at runtime
  6. Monitor & Patch → Azure Monitor + Update Manager
  7. Audit & Alerting → Azure Sentinel + Defender
  8. Security Guidance → Copilot Security analyzes policies and offers recommendations

Example of Deploying a custom container to Azure App Service with Azure Pipelines

Microsoft Azure App Service is really scalable for Docker App Solutions:

Azure App Service is designed to scale effortlessly with your application’s needs. Whether you’re hosting a simple web app or a complex containerized microservice, it offers both vertical scaling (upgrading resources like CPU and memory) and horizontal scaling (adding more instances). With built-in autoscaling, you can respond dynamically to traffic spikes, scheduled workloads, or performance thresholds—without manual intervention or downtime.

From small startups to enterprise-grade deployments, App Service adapts to demand with precision, making it a reliable platform for modern, cloud-native applications.

Scale Up Features and Capacities Learn how to increase CPU, memory, and disk space by changing the pricing tier

Enable Automatic Scaling (Scale Out) Configure autoscaling based on traffic, schedules, or resource metrics

Per-App Scaling for High-Density Hosting Scale individual apps independently within the same App Service Plan

Conclusion

For modern developers, the combination of Azure App Services and Docker Desktop offers a powerful, flexible, and scalable foundation for building, testing, and deploying cloud-native applications.

  • Developers can build locally with Docker, ensuring consistency and portability.
  • Then deploy seamlessly to Azure App Services, leveraging its cloud scalability and integration.
  • This workflow reduces configuration drift, accelerates testing cycles, and improves team collaboration.


Leave a comment

Windows Server 2025 Core and Docker – A Modern Container Host Architecture

As businesses race toward cloud-native infrastructure and microservices, Windows Server 2025 Core emerges as a lean, powerful platform for hosting Docker containers. With its minimal footprint and robust security posture, Server Core paired with Docker offers a compelling solution for modern application deployment.

Architecture Design: Windows Server Core + Docker

Windows Server 2025 Core is a headless, GUI-less version of Windows Server designed for performance and security. When used as a Docker container host, it provides:

  • Lightweight OS footprint: Reduces attack surface and resource consumption.
  • Hyper-V isolation: Enables secure container execution with kernel-level separation.
  • Support for Nano Server and Server Core images: Ideal for running Windows-based microservices.
  • Integration with Azure Kubernetes Service (AKS): Seamless orchestration in hybrid environments.

Key Components

Component Role in Architecture
Windows Server 2025 Core Host OS with minimal services
Docker Engine Container runtime for managing containers
Hyper-V Optional isolation layer for enhanced security
PowerShell / CLI Tools Management and automation
Windows Admin Center GUI-based remote management

Installation Guide

Setting up Docker on Windows Server 2025 Core is straightforward but requires precision. Here’s a simplified walkthrough:

Windows Server 2025 Datacenter Core running

  1. Install Required Features

Use PowerShell to install Hyper-V and Containers features:

Install-WindowsFeature -Name Hyper-V, Containers -IncludeManagementTools -Restart

  1. Install Docker

Download and install Docker from the official source or use the PowerShell script provided by Microsoft:

Invoke-WebRequest “https://download.docker.com/win/static/stable/x86_64/docker-28.4.0.zip” -OutFile “docker.zip”

Unzip and configure Docker as a service:

at Docker directory to your path

Add the Docker config directory

Set the daemon

Create the Docker Service

net start docker

docker version

Docker Host on Windows Server 2025 Core is Installed 😉

  1. Configure Networking

Ensure proper NAT or transparent networking for container communication.

  1. Pull Base Images

Use Docker CLI to pull Windows container images:

docker pull mcr.microsoft.com/windows/servercore:ltsc2025

  1. Test Deployment

Run a sample Windows Server 2025 core container:

docker run -it mcr.microsoft.com/windows/servercore:ltsc2025

Inside the Windows Server 2025 Core Container on the Docker host.

Best Practices

To maximize reliability, security, and scalability:

  • Use Hyper-V isolation for sensitive workloads.
  • Automate deployments with PowerShell scripts or CI/CD pipelines.
  • Keep base images updated to patch vulnerabilities.
  • Monitor containers using Azure Arc monitoring or Windows Admin Center.
  • Limit container privileges and avoid running as Administrator.
  • Use volume mounts for persistent data storage.

Conclusion: Why It Matters

For developers, Windows Server 2025 Core with Docker offers:

  • Fast iteration cycles with isolated environments.
  • Consistent dev-to-prod workflows using container images.
  • Improved security with minimal OS footprint and Hyper-V isolation.

For businesses, the benefits are even broader:

  • Reduced infrastructure costs via efficient resource usage.
  • Simplified legacy modernization by containerizing Windows apps.
  • Hybrid cloud readiness with Azure integration and Kubernetes support.
  • Scalable architecture for microservices and distributed systems.

Windows Server 2025 Core isn’t just a server OS—it’s a launchpad for modern, secure, and scalable containerized applications. Whether you’re a developer building the next big thing or a business optimizing legacy systems, this combo is worth the investment.

Integrating Azure Arc into the Windows Server 2025 Core + Docker Architecture for Adaptive Cloud

Overview

Microsoft Azure Arc extends Azure’s control plane to your on-premises Windows Server 2025 Core container hosts. By onboarding your Server Core machines as Azure Arc–enabled servers, you gain unified policy enforcement, monitoring, update management, and GitOps-driven configurations—all while keeping workloads close to the data and users.

Architecture Extension

  • Azure Connected Machine Agent
    Installs on Windows Server 2025 Core as a Feature on Demand, creating an Azure resource that represents your physical or virtual machine in the Azure portal.
  • Control Plane Integration
    Onboarded servers appear in Azure Resource Manager (ARM), letting you apply Azure Policy, role-based access control (RBAC), and tag-based cost tracking.
  • Hybrid Monitoring & Telemetry
    Azure Monitor collects logs and metrics from Docker Engine, container workloads, and host-level performance counters—streamlined into your existing Log Analytics workspaces.
  • Update Management & Hotpatching
    Leverage Azure Update Manager to schedule Windows and container image patches. Critical fixes can even be applied via hotpatching on Arc-enabled machines without a reboot.
  • GitOps & Configuration as Code
    Use Azure Arc–enabled Kubernetes to deploy container workloads via Git repositories, or apply Desired State Configuration (DSC) policies to Server Core itself.

Adaptive Cloud Features Enabled

  • Centralized Compliance
    Apply Azure Policies to enforce security baselines across every Docker host, ensuring drift-free configurations.
  • Dynamic Scaling
    Trigger Azure Automation runbooks or Logic Apps when performance thresholds are breached, auto-provisioning new container hosts.
  • Unified Security Posture
    Feed security alerts from Microsoft Defender for Cloud into Azure Sentinel, correlating threats across on-prem and cloud.
  • Hybrid Kubernetes Orchestration
    Extend AKS clusters to run on Arc-connected servers, enabling consistent deployment pipelines whether containers live on Azure or in your datacenter.

More information about Innovate on an Adaptive Cloud here

Integration Walkthrough

  1. Prepare your Server Core host (ensure Hyper-V, Containers, and Azure Arc Feature on Demand are installed).
  2. Install Azure Arc agent via Azure PowerShell
  3. In the Azure portal, navigate to Azure Arc > Servers, and verify your machine is onboarded.
  4. Enable Azure Policy assignments, connect to a Log Analytics workspace, and turn on Update Management.
  5. (Optional) Deploy the Azure Arc GitOps operator for containerized workloads across hybrid clusters.

Visualizing Azure Arc in Your Diagram

Above your existing isometric architecture, add a floating “Azure Cloud Control Plane” layer that includes:

  • ARM with Policy assignments
  • Azure Monitor / Log Analytics
  • Update Manager + Hotpatch service
  • GitOps repo integrations

Draw data and policy-enforcement arrows from this Azure layer down to your Windows Server Core “building,” Docker cube, container workloads, and Hyper-V racks—demonstrating end-to-end adaptive management.

Why It Matters

Integrating Azure Arc transforms your static container host into an adaptive cloud-ready node. You’ll achieve:

  • Consistent governance across on-prem and cloud
  • Automated maintenance with zero-downtime patching
  • Policy-driven security at scale
  • Simplified hybrid Kubernetes and container lifecycle management

With Azure Arc, your Windows Server 2025 Core and Docker container hosts become full citizens of the Azure ecosystem—securing, monitoring, and scaling your workloads wherever they run.

Better Together 🐳

 


Leave a comment

Docker Scout, stripped down: comparing what changed and securing what matters (CLI only)

Docker Scout version 1.18.2

There’s a quiet moment after every deploy where you ask yourself: what actually changed? Not just the feature—you know that—but the stuff beneath it. Packages. Base images. Vulnerabilities that slipped in while you were busy shipping. Docker Scout’s CLI gives you the flashlight for that dark room. No dashboards. No detours. Just commands, signal, and the truth.

In July 2025 I wrote a blogpost about Docker Scout for Vulnerability management of Containers and remediation

Docker Scout Compare is quite significant for container security, especially in modern DevSecOps workflows. Here’s why it matters:

🔍 What Docker Scout Compare Does

  • Image Comparison: It analyzes two Docker images—typically a new build vs. a production version—and highlights differences in vulnerabilities, packages, and policies.
  • Security Insights: It identifies newly introduced CVEs (Common Vulnerabilities and Exposures), changes in package versions, and policy violations between image versions.
  • SBOM Integration: It uses Software Bill of Materials (SBOMs) to trace dependencies and match them against vulnerability databases.

🛡️ Why It’s Important for Security

  • Proactive Risk Management: By comparing images before deployment, teams can catch regressions or newly introduced vulnerabilities early.
  • Supply Chain Transparency: Helps track changes across the container supply chain, which is crucial for preventing issues like Log4Shell.
  • CI/CD Integration: Fits seamlessly into automated pipelines, ensuring every image update is vetted for security before release.

⚙️ Key Features That Boost Its Value

Feature Benefit
Continuous vulnerability scanning Keeps your images secure over time, not just at build time
Filtering options Focus on critical or fixable CVEs, ignore unchanged packages, etc.
Markdown/Text reports Easy to integrate into documentation or dashboards
Multi-stage build analysis Understand security across complex Dockerfiles

🧠 Bottom Line

If you’re serious about container security, Docker Scout Compare isn’t just helpful—it’s becoming essential. It gives developers and security teams a clear view of what’s changing and whether those changes introduce risk.

The heart of change: compare old vs new, precisely

You built a new image. What did you add? What did you remove? What got better—or worse?
Here are some Docker scout compare CLI commands:

# Compare prod vs new build

docker scout compare –to myapp:prod myapp:sha-123

# Focus on meaningful risk changes (ignore base image CVEs)

docker scout compare –to myapp:prod myapp:sha-123 –ignore-base

# Show only high/critical that are fixable

docker scout compare –to myapp:prod myapp:sha-123 –only-severity high,critical –only-fixed

# Fail when security gets worse (perfect for CI)

docker scout compare –to myapp:prod myapp:sha-123 –exit-on vulnerability

Here you find more about Docker Scout Compare 🐳

In my case I will do a Docker Scout compare between these two images:

docker scout compare –to azure-cli-patched:latest mcr.microsoft.com/azure-cli:azurelinux3.0

Compare results between the two images.

Compare results between the two images, here you see the Fixed vulnerability differences.

Conclusion

🔐 Final Thoughts: Docker Scout Compare CLI & Security

In today’s fast-paced development landscape, security can’t be an afterthought—it must be woven into every stage of the software lifecycle. Docker Scout Compare CLI empowers teams to do just that by offering a clear, actionable view of how container images evolve and what risks they may introduce. Its ability to pinpoint new vulnerabilities, track dependency changes, and integrate seamlessly into CI/CD pipelines makes it a vital tool for modern DevSecOps.

By embracing Docker Scout Compare, organizations move from reactive patching to proactive prevention—turning container security from a bottleneck into a strategic advantage. 🚀


Leave a comment

Docker Scout for Vulnerability management of Containers and remediation

I have installed the latest Docker Desktop for Windows version 4.43.2

In today’s cloud-native world, container security is not a luxury—it’s a mission-critical requirement. With the release of Azure Linux 3.0, Microsoft has reinforced its dedication to performance, flexibility, and security. But no matter how polished the host OS is, containers themselves can still be riddled with vulnerabilities, bloated layers, or sneaky outdated dependencies. That’s where Docker Scout and Open Source tool Dive come into play.

Docker Scout: Intelligence at Your Fingertips

Docker Scout introduces vulnerability detection into your CI/CD pipeline. For Azure Linux 3.0 containers, this means:

  • Real-Time Vulnerability Scanning: Scout analyzes your container image (including base layers) against CVE databases and flags known vulnerabilities.
  • Remediation Guidance: It doesn’t just scream “VULNERABLE!”—Scout offers actionable suggestions like switching to a newer base image or updating specific packages.
  • Policy Integration: You can define security policies (e.g., block images with critical CVEs) and automate enforcement in Azure DevOps or GitHub Actions.

In the following steps we will get the Microsoft Azure Linux 3.0 container and scan for security issues before we run the container.

Open Docker terminal
docker pull mcr.microsoft.com/azure-cli:azurelinux3.0

when you have pulled the image, you can do a quick scan with Docker Scout.
docker scout quickview mcr.microsoft.com/azure-cli:azurelinux3.0

docker scout cves mcr.microsoft.com/azure-cli:azurelinux3.0

Here you can see more information about the CVE’s.

Here you see the vulnerable package file and the fix for remediation.

Now we want to remediate this image with the update fix version 2.32.4 of this package. To do this, I made a directory docker fix with a dockerfile (without any extension) with the following commands :

———

# ⚙️ Start met Azure CLI base image op Azure Linux 3.0
FROM mcr.microsoft.com/azure-cli:azurelinux3.0

# 🧰 Install Python and pip via tdnf
RUN tdnf install -y python3 python3-pip

# 🛠️ Upgrade pip and install
RUN python3 -m pip install –no-cache-dir –upgrade –ignore-installed pip \
&& python3 -m pip install –no-cache-dir requests==2.32.4

# Remove old files
RUN rm -f /usr/lib/az/lib/python3.12/site-packages/requests-2.32.3.dist-info/METADATA

# 🔍 Verify 
RUN python3 -c “import requests; print(f’Requests versie: {requests.__version__}’)”

————-

With Open Source tool Dive you can have a look into the Docker image. This supported me because first I did only the install and upgrade of the file requests version 2.32.3 to fixed version 2.32.4. But then Docker Scout still see the vulnerability file in the image.

dive [Image]
So that’s why we remove it via the Dockerfile.

We now building a new image with this dockerfile :

docker buildx build –provenance=true –sbom=true -t azure-cli-patched:latest .

After a Docker Scout scan, there are zero vulnerabilities in the image now
and in the Container fixed version 2.32.4 is running.

Conclusion

Docker Scout represents a major leap forward in managing container security, efficiency, and reliability. By integrating seamlessly into the Docker ecosystem, it empowers developers to ship production-ready containers with confidence.

💡 Key Benefits

  • Security Insights: Automatically detects vulnerabilities, recommends fixes, and integrates with CVE databases.
  • Dependency Intelligence: Tracks changes and upgrades across your software stack to ensure compatibility and stability.
  • Image Comparison: Visualizes differences between builds—helping you pinpoint unintended changes and regressions.
  • Team Collaboration: Enables shared visibility across development pipelines, so teams can align on image quality and release standards.

In short, Docker Scout turns container image analysis into a proactive, collaborative part of modern DevOps. Whether you’re optimizing performance or hardening against threats, Scout puts you ahead of the curve.

 

 

 


Leave a comment

Strengthening Container Security with Docker Hardened Images and Azure Container Registry

In today’s cloud-native landscape, container security is paramount. IT professionals must strike a balance between agility and security, ensuring that applications run smoothly without exposing vulnerabilities. One way to achieve this is through Docker hardened images, which enhance security by reducing attack surfaces, enforcing best practices, and integrating with Microsoft Azure Container Registry (ACR) for seamless deployment.

Why Hardened Docker Images?

A hardened Docker image is optimized for security, containing only the necessary components to run an application while removing unnecessary libraries, binaries, and configurations. This approach reduces the risk of known exploits and ensures compliance with security standards. Key benefits include:

  • Reduced Attack Surface: Eliminating unnecessary components minimizes entry points for attackers.
  • Improved Compliance: Meets security benchmarks like CIS, NIST, and DISA STIG.
  • Enhanced Stability: Smaller images mean fewer dependencies, reducing vulnerabilities.
  • Better Performance: Optimized images lead to faster deployments and lower resource consumption.

Leveraging Azure Container Registry for Secure Image Management

Microsoft Azure Container Registry (ACR) plays a critical role in securely storing, managing, and distributing hardened images. IT professionals benefit from features such as:

  • Automated Image Scanning: Built-in vulnerability assessment tools like Microsoft Defender for Cloud detect security risks.
  • Content Trust & Signing: Ensures only authorized images are deployed.
  • Geo-replication: Enables efficient global distribution of container images.
  • Private Registry Access: Provides secure authentication via Azure Active Directory.

Microsoft Azure Container Registry

Hardened Images in Azure Container Solutions

By deploying hardened images through Azure Kubernetes Service (AKS), Azure Container Apps, and Azure Functions, organizations strengthen security in cloud-native applications while leveraging Azure’s scalability and flexibility. This translates to:

  • Improved Security Posture: Reducing exposure to common container-based threats.
  • Streamlined Operations: Consistent, automated deployment pipelines.
  • Efficient Cost Management: Optimized images lower compute and storage costs.

Strengthening Security with Docker Scout

Docker Scout is a powerful security tool designed to detect vulnerabilities in container images. It integrates seamlessly with Docker CLI, allowing IT professionals to:

  • Scan Images for CVEs (Common Vulnerabilities and Exposures): Identify security risks before deployment.
  • Receive Actionable Insights: Prioritized remediation recommendations based on severity.
  • Automate Security Checks: Continuous monitoring ensures compliance with security standards.
  • Integrate with Azure Container Registry (ACR): Scan images stored in ACR for proactive security management.

How It Works with Azure Container Solutions

By incorporating Docker Scout with Azure Container Registry (ACR), IT teams can establish a robust security workflow:

  1. Build & Harden Docker Images – Optimize base images to minimize attack surfaces.
  2. Scan with Docker Scout – Detect vulnerabilities in both public and private repositories.
  3. Push Secure Images to ACR – Ensure only validated, hardened images are stored.
  4. Deploy on Azure Container Solutions – Use AKS, Azure App Service, or Azure Functions with improved security confidence.
  5. Monitor & Automate Security Updates – Continuous scanning helps maintain container integrity.

Best Practices for IT Professionals

To maximize security, IT teams should adopt the following best practices:

  1. Use Minimal Base Images (Alpine, Distroless) to reduce attack surfaces.
  2. Regularly Update & Scan Images to patch vulnerabilities.
  3. Implement Role-Based Access Controls (RBAC) for container registries.
  4. Adopt Infrastructure as Code (IaC) to enforce secure configurations.
  5. Monitor & Audit Logs for anomalous activity detection.
  6. Automate Docker Scout scans in CI/CD pipelines.
  7. Enforce image signing & verification using Azure Key Vault.
  8. Regularly update base images & dependencies to mitigate risks.
  9. Apply role-based access controls (RBAC) within Azure Container Registry

Conclusion

Secure containerization starts with hardened Docker images and robust registry management. Azure Container Registry offers IT professionals the tools to maintain security while leveraging cloud efficiencies. By integrating these strategies within Azure’s ecosystem, organizations can build resilient and scalable solutions for modern workloads.
Docker Scout combined with Azure Container Registry provides IT professionals a strong security foundation for cloud-native applications. By integrating proactive vulnerability scanning into the development workflow, organizations can minimize risks while maintaining agility in container deployments.
When you work with artificial intelligence (AI) and Containers working with Model Context Protocol (MCP)
Security by Design comes first before you begin.

Here you find more information about MCP protocol via Docker documentation

 

 


Leave a comment

Unleashing AI Development with Docker Desktop 4.41

Docker Desktop version 4.41 available

Unleashing AI Development with Docker Desktop 4.41: NVIDIA GPU Support and Model Runner Beta

The world of AI development is evolving rapidly, and Docker Desktop 4.41 is here to accelerate that journey. With the introduction of the Model Runner Beta and NVIDIA GPU support, Docker has taken a significant leap forward in making AI development more accessible, efficient, and integrated. Let’s dive into the highlights of this groundbreaking release.

What’s New in Docker Desktop 4.41?

Docker Desktop 4.41 introduces the Model Runner Beta, a feature designed to simplify the process of running and managing AI models locally. This release also brings NVIDIA GPU support to Windows users, enabling developers to harness the power of GPU acceleration for their machine learning tasks. Here’s a closer look at the key updates:

  1. Model Runner Beta:
    • The Model Runner Beta allows developers to run AI models as part of their Docker Compose projects. This integration streamlines the orchestration of model pulls and the injection of model runner services into applications.
    • A dedicated “Models” section in the Docker Desktop GUI provides a user-friendly interface for browsing, running, and managing models alongside containers, volumes, and images.
  2. NVIDIA GPU Support:
    • Windows users can now leverage NVIDIA GPUs for AI workloads, significantly boosting performance and reducing training times for machine learning models.
    • This feature is a game-changer for developers working on resource-intensive AI applications, as it enables seamless integration of GPU acceleration into their workflows.
  3. Enhanced Integration with Docker Compose and Testcontainers:
    • Docker Compose now supports the declaration of AI services within a single Compose file, allowing teams to manage models like any other service in their development environment.
    • Testcontainers integration extends testing capabilities to AI models, with initial support for Java and Go, making it easier to create automated tests for AI-powered applications.

Why This Matters for AI Developers

The introduction of the Model Runner Beta and NVIDIA GPU support in Docker Desktop 4.41 addresses several pain points faced by AI developers:

  • Simplified Workflows: By treating models as first-class artifacts, Docker enables developers to version, distribute, and deploy models using familiar tools and workflows.
  • Improved Performance: GPU acceleration ensures faster training and inference times, allowing developers to iterate and innovate more quickly.
  • Seamless Collaboration: The ability to push models directly to Docker Hub fosters collaboration and sharing across teams, eliminating the need for custom registries or additional infrastructure.

Getting Started with Docker Model Runner

Enable GPU-backed Inference

docker model status

docker model help

docker model pull ai/smollm2

ai/smollm2 model pulled successfully

docker model list

docker model run ai/smollm2

This is a small example, but it’s really fast with answering my questions 👍

The Future of AI Development with Docker

Docker Desktop 4.41 is more than just an update; it’s a step towards democratizing AI development. By integrating powerful tools like the Model Runner Beta and NVIDIA GPU support, Docker is empowering developers to build, test, and deploy AI applications with unprecedented ease and efficiency.

Whether you’re a seasoned AI researcher or a developer exploring the possibilities of machine learning, Docker Desktop 4.41 is your gateway to a faster, smarter, and more collaborative AI development experience.

Ready to transform your AI workflows? Dive into Docker Desktop 4.41 and experience the future of AI development today!