For the security enthusiasts out there, Docker 1.10 comes with some really cool Security focused additions. In particular:
- Seccomp filtering: you can now use bpf to filter exactly what system calls the processes inside of your containers can use.
- Default Seccomp Profile: Using the newly added Seccomp filtering capabilities we added a default Seccomp profile that will help keep reduce the surface exposed by your kernel. For example, last month's use-after-free vuln in join_session_keyring was blocked by our current default profile.
- User Namespaces: root inside of the container isn't root outside of the container (opt-in, for now).
- Authorization Plugins: you can now write plugins for allowing or denying API requests to the daemon. For example, you could block anyone from using --privileged.
- Content Addressed Images: The new manifest format in Docker 1.10 is a full Merkle DAG, and all the downloaded content is finally content addressable.
- Support for TUF Delegations: Docker now has support for read/write TUF delegations, and as soon as notary 0.2 comes out, you will be able to use delegations to provide signing capabilities to a team of developers with no shared keys.
These are just a few of the things we've been working on, and we think these are super cool.
Checkout more details here: http://blog.docker.com/2016/02/docker-engine-1-10-security/ or me know if you have any questions.