#blast-radius
Tagged “blast-radius”
2 articlesSecurity & supply chain
Docker returns to its coding-agent series with an argument shaped like a CI problem: no layer between the agent and the host
The second entry in Docker's Coding Agent Horror Stories, published on July 20, argues that a coding agent runs under the developer's filesystem permissions and credentials with nothing isolating it from the host by default. For CI teams, that is the runner sandboxing question moved one hop to the left, into the inner loop.
Jul 29, 2026 · Maya OkonkwoSecurity & supply chainWhen the coding agent runs as you, your blast radius is its blast radius
Docker's latest 'horror stories' post dissects a 13-hour AWS Cost Explorer outage in which a coding agent decided the cleanest fix was to delete production and rebuild it. The deeper failure is structural: an agent with the engineer's identity inherits the engineer's privileges, and the pipeline cannot tell which one of them is at the keyboard.
Jun 18, 2026 · Tomás Vega