#Docker
All CosmicBytez Labs articles tagged #Docker, across news, security advisories, how-to guides, and projects.
- News
Docker Hub Flaw (CVE-2026-105445) Let Attackers Impersonate Users and Tamper With Images
Docker disclosed a critical flaw (CVSS 9.4) letting attackers hijack PATs to impersonate users and tamper with container images.
- Security
CVE-2026-105278: openPDC Docker Image Ships Hardcoded Admin Credential
A fixed admin login baked into openPDC's Docker image, with no forced change, gives network attackers full control (CVSS 9.8).
- News
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato hijacks exposed Docker daemons on port 2375 to install a weaponized Hermes AI agent that steals LLM API keys via Telegram commands.
- Security
CVE-2026-101065: Obot AI Agent Platform Ships With Authentication Disabled by Default
Obot's documented Docker quickstart boots with auth off and the Docker socket mounted in, letting any network caller reach the host. CVSS 9.8.
- News
New Carbonato Malware Uses AI Agents to Hijack Exposed Docker Hosts
ThreatDown: Carbonato worms through unauthenticated Docker APIs, then installs an AI agent operators command over Telegram.
- Project
Fleet + osquery: Cross-Platform Endpoint Visibility and Live Queries
Deploy Fleet in Docker to fleet-manage osquery agents across Linux, macOS, and Windows, run live SQL queries against live endpoints, and alert on drift...
- Project
Zabbix Monitoring Stack: Self-Hosted Infrastructure Health & Alerting
Deploy Zabbix 7.0 in Docker to monitor hosts, containers, and network gear, then wire trigger-based alerts straight into Discord.
- Security
Unauthenticated Root RCE in AutoAgent's Sandbox TCP Server
AutoAgent's sandbox TCP command server binds to all interfaces with no authentication, letting anyone execute root shell commands inside the...
- HOWTO
Deploying Vaultwarden: A Self-Hosted Password Manager
Stand up a lightweight, Bitwarden-compatible password vault on your own infrastructure — with Docker, TLS via reverse proxy, and an automated backup routine.
- Security
CVE-2026-66384: JFrog Artifactory Path Traversal Added to CISA KEV
CISA added CVE-2026-66384, a JFrog Artifactory Docker-cache path traversal flaw, to its KEV catalog after confirmed active exploitation.
- Security
CVE-2026-78122: docker-socket-proxy Fails to Gate Container Read Endpoints
docker-socket-proxy's CONTAINERS guard bypassed via GET requests to /archive, /export, /logs, and /top, exposing arbitrary file reads.
- Project
Step-CA: Build a Private Certificate Authority for Your Homelab
Stop accepting self-signed certificate warnings. Deploy Smallstep's step-ca as a fully automated internal PKI — complete with ACME support, Traefik...
- Project
TheHive: Self-Hosted Incident Response Case Management
Build a production-grade security incident response platform using TheHive 5, Cassandra, Elasticsearch, and MinIO — then integrate it with Wazuh alerts...
- Security
CVE-2026-56260: Crawl4AI Arbitrary File Write in Docker API
A critical CVSS 9.1 vulnerability in Crawl4AI before 0.8.7 allows attackers to write arbitrary files anywhere on the host filesystem via the Docker API's...
- Security
CVE-2026-55229: Gotenberg SSRF via LibreOffice Bypasses Built-in Protections
A server-side request forgery vulnerability in Gotenberg's LibreOffice conversion endpoint allows crafted documents to silently probe internal network...
- News
Hackers Exploit Critical Auth Bypass in Official Gitea Docker Image
Attackers are actively exploiting a critical authentication bypass in the official Gitea Docker image, allowing unauthenticated users to impersonate any...
- Project
Gophish Phishing Simulation Lab: Security Awareness Testing in Docker
Deploy a self-hosted phishing simulation platform using Gophish in Docker. Build real-world phishing campaigns, track user engagement, and run security...
- Security
CVE-2026-20896: Gitea Docker Image Authentication Bypass
All official Gitea Docker images through v1.26.2 ship with a wildcard trusted proxy setting that lets any unauthenticated attacker impersonate any user...
- Project
OWASP DefectDojo: Self-Hosted Vulnerability Management Platform
Aggregate, deduplicate, and track security findings from 100+ scanners in a unified dashboard. Build a production-grade vulnerability management pipeline...
- Project
OpenCTI: Building a Cyber Threat Intelligence Platform in Your Homelab
Deploy OpenCTI to aggregate, correlate, and visualize threat intelligence from MISP, NVD, AlienVault OTX, and Shodan — all in a self-hosted Docker stack.
- Project
Building a SOAR Platform with Shuffle in Your Homelab
Deploy Shuffle, the open-source SOAR platform, to automate security workflows and orchestrate your homelab tools — from Wazuh alerts to enrichment lookups...
- HOWTO
Docker Security Hardening: Locking Down Container Environments
A practical, step-by-step guide to hardening Docker deployments — from non-root users and read-only filesystems to capability drops, resource limits, and...
- Security
CVE-2026-36576: Critical OS Command Injection in docker-wkhtmltopdf-aas
A CVSS 9.8 OS command injection vulnerability in openlabs docker-wkhtmltopdf-aas allows unauthenticated remote code execution via a crafted POST request to…
- Project
Building a Wazuh XDR + SIEM Homelab
Deploy a full Wazuh stack in Docker to gain host-based intrusion detection, file integrity monitoring, vulnerability scanning, and active response across your…
- News
Open Source DockSec Uses AI to Cut Through Vulnerability
DockSec, an OWASP incubator project, combines multiple container security scanners with AI-generated plain-English remediation guidance and exact Dockerfile.
- Project
Runtime Security Monitoring with Falco: Detect Container
Deploy Falco on a Docker host to monitor container syscalls at the kernel level, write custom homelab detection rules, and route real-time alerts through.
- Project
Pi-hole v6 + Unbound: Network-Wide DNS Sinkhole with Recursive Resolution
Deploy Pi-hole v6 as a network-wide DNS sinkhole backed by Unbound as a self-hosted recursive resolver — eliminating ads, trackers, and malware domains...
- Project
Build a Production Monitoring Stack with Prometheus and Grafana
Deploy a full observability stack — Prometheus metrics collection, Grafana dashboards, AlertManager notifications, and three exporters — all containerized...
- Project
Building a Production-Ready Reverse Proxy with Traefik v3
Deploy Traefik v3 as a Docker-native reverse proxy with automatic Let's Encrypt TLS, label-based routing, and security middleware — no more port juggling...
- HOWTO
OpenVAS / Greenbone: Open-Source Vulnerability Scanning
Deploy Greenbone Community Edition to run authenticated vulnerability scans, configure scan targets, and generate actionable remediation reports for your...
- News
Malicious KICS Docker Images and VS Code Extensions Hit
Threat actors hijacked the official checkmarx/kics Docker Hub repository by overwriting existing image tags — including v2.1.20 and alpine variants — and...
- Project
Self-Hosted Password Manager with Vaultwarden
Deploy a fully self-hosted, Bitwarden-compatible password manager using Vaultwarden on Docker with Caddy reverse proxy, automatic TLS, WebSocket...
- HOWTO
Container Security Scanning with Trivy: Images, IaC, and CI/CD
Learn how to use Trivy to scan container images, Dockerfiles, Kubernetes manifests, and Terraform for vulnerabilities and misconfigurations — then...
- Project
Keycloak SSO: Self-Hosted Identity Provider for Your Homelab
Deploy Keycloak with Docker Compose and PostgreSQL to build a centralised single sign-on platform for your homelab services, with OIDC integration for...
- News
Trivy Hack Spreads Infostealer via Docker, Triggers Worm
The Trivy supply chain attack has expanded dramatically beyond GitHub Actions: malicious Docker Hub images (versions 0.69.4–0.69.6) carry an infostealer,...
- HOWTO
Multi-Stack Docker Infrastructure with Traefik and Authentik
Deploy a production-grade Docker infrastructure with Traefik reverse proxy, Authentik single sign-on, automated TLS certificates, and multi-network...
- HOWTO
Business Central Docker Containers: Development Environment
Deploy Microsoft Dynamics 365 Business Central in Docker containers for development, testing, and demonstration. Covers container setup, management, and...
- HOWTO
Docker Windows Containers: Native Engine Setup Guide
Deploy Docker Engine natively on Windows without Docker Desktop. Covers installation, Windows container mode, lifecycle management, and troubleshooting.
- Project
Homelab Media Server with Full ARR Stack
Deploy a complete self-hosted media automation system with Plex, Sonarr, Radarr, Prowlarr, and more. Includes Traefik reverse proxy, Authentik SSO, and...
- Project
Kubernetes Homelab Cluster with K3s
Build a production-grade K3s cluster on Proxmox/bare metal with Longhorn storage, Traefik ingress, cert-manager, and ArgoCD for GitOps.
- HOWTO
Docker Security Fundamentals: Protecting Your Containers
Learn essential Docker security practices including image scanning, runtime protection, network isolation, and secrets management for production environments.
- HOWTO
Self-Hosting a Password Manager: Vaultwarden Setup Guide
Deploy your own password manager with Vaultwarden (Bitwarden-compatible). Includes secure configuration, SSL setup, and backup procedures.