TLDR DevOps 2026-11-06

Chainguard Actions is now Generally Available: a hardened catalog of over 1,000 popular actions, delivered as drop-in replacements for the actions developers already want to use.

> Continuously verified and hardened as upstream versions ship and attack patterns emerge.

>Every action includes a HARDENING.md report detailing which vulnerabilities were found and removed.

>One-business-day SLA for new action requests.

Developers don't have to change how they work to use actions safely.

Details and a 30-day Chainguard Actions free trial.

A vulnerability in Alpine Linux's openssh-server package allows attackers to bypass password authentication and log in without knowing any password. The flaw affects releases 3.16 through 3.24 and allows remote access if the system has an account with no password set. Users should update openssh and restart sshd or disable password logins immediately.

Google donated Agent Substrate, gVisor, and OpenRL to the CNCF Sandbox and announced the general availability of Agent Substrate on GKE. Agent Substrate decouples stateful agent sessions from compute to restore idle sessions in under 500 milliseconds. The project achieves 10x standard container density and performs over 500 suspend and resume activations per second.

This post describes how to run a K3s platform of more than 15 microservices with no centralized log collection, relying on filtered Prometheus metrics and temporary verbose logging. It notes trade-offs, including the need to anticipate questions and unsuitability for audits requiring immutable trails.

Google traced intermittent GKE API timeouts to three interacting failures: Private Service Connect reordered packets, Envoy kept half-closed sockets open, and a Linux TCP bug prevented those sockets from closing. Simultaneous packet captures at multiple points exposed the reordering, and a Linux kernel patch fixed the underlying TCP bug.

Docker identifies five risks of autonomous AI agents, including prompt injection, credential exposure, and data exfiltration. It recommends isolation and governance through Docker Sandboxes and AI Governance rather than model improvements alone.

Systems now change faster than teams can track, and AI features can look healthy while giving wrong answers. The AI SRE Handbook covers what that means for reliability, how to evaluate an AI SRE, and benchmark results from 25 real Sev1-3 incidents.Download the handbook.

agent-browser is a native Rust CLI that gives AI agents a browser they can drive one shell command at a time. It reads pages as a compact accessibility tree and allows agents to interact with elements through refs. The tool supports Chrome for Testing, Mobile Safari, and various cloud browser providers.

NVIDIA Auto Ontology is a Python framework for building semantic, graph-based reasoning layers over enterprise data. The open source library builds context layers from metadata to enable deterministic query generation and more explainable AI for LLM workflows. It exposes this context to agents via MCP, CLI, and API access.

Spacelift explains the official OpenTofu MCP server, which offers seven read-only tools for searching registry documentation for providers, modules, resources, and data sources. It runs from a hosted endpoint or locally with npx and never runs tofu commands or reads state.

Grafana Cloud made trace linkage generally available in Database Observability. It connects OpenTelemetry application traces to database query data collected by Alloy, matching by query.

PagerDuty announced the PD Reliability Platform and PD Labs alongside its Paige SRE agent.

Datadog Agent Observability now supports Fireworks AI as a model provider.

OpenTelemetry JavaScript SDK 3.0 introduces ESM-only support and removes compatibility with older Node.js versions.