Can Docker (CE) survive in a sea of AI generated CVE's?

Maybe, maybe not...

AI-assisted vulnerability discovery has turned into an afternoon’s work. Point an LLM at a codebase, wait a few hours, get a credible list of all exploits, a working demonstration on how to exploit it, and if you want, a fully structured CVE report. That’s the reality that every single software vendor is now faced with, and when your software is open source, its even easier for the “wanna be” hackers to import your codebase into their LLM of choice.

The only real defense of this is to a) either continuously run scans yourself, and fix any/all issues you find, or b) accept the CVE’s and patch them as they come in (which btw, is thick and fast). Either way, its now a massive burden to manage, and it also means you need to ship software updates significantly more frequently than you ever have before. What’s worse, is that some of the vulnerabilities the LLM uncovers may actually be detrimental to your core functionality, and so what do you do then? deprecate the feature? re-engineer it? ignore the CVE? Tricky tricky.

Docker-CE, the open source container runtime that popularized containerization sits somewhat in a half-way house now. Its not used by any commercial entity, and is supported almost exclusively by Docker and Mirantis. Neither of them actually use it natively themselves (instead they use the upstream project and their own closed source variant). Unlike Kubernetes, with tens of thousands of contributors, Docker has almost no one. Worse, the ecosystem has pretty much abandoned it, with all 3rd party software vendors exclusively supporting Kubernetes as a platform and API. And thats all cool, the money follows demand, but there are still countless hundreds of thousands of environments running Docker today. All of them are reliant on Docker-CE being supported, safe, secure, and receiving frequent patches. As of today, Docker IS still getting patched, sure, but for how much longer will those patches NOT introduce breaking changes, and for how long can they keep up with the massive influx of AI-generated bug / security reports?

If I had to place a bet, my bet would fall on Docker throwing up their hands, and the CE product itself stopping being a compiled release, and instead simply being source code that you need to take responsibility for (and secure). There is no intrinsic commercial benefit for Docker to continue to support this product that is not tied in any way to their revenue.

What does that mean for you, as a Docker user?

Well, if you run Docker in your environment (managed by Portainer, or not), you need to seriously accelerate your migration to Kubernetes. Doing nothing and deferring the problem is not a solution you should consider. The overwhelming number of contributors to Kubernetes means it will remain one of the fastest iterating pieces of infrastructure software of our time. If you want a secure environment, then this is your only option. There are even distros like Portainer’s kubesolo.io that give you the benefit of Kubernetes in the resource footprint of Docker, so there really is no excuse.

Now I understand that from an operational complexity standpoint Kubernetes > Docker, and i get it.. its true... However, there are ways and means to minimize this. For one, the “all-in-one” single binary distro’s like k3s or kubesolo, make the installation and maintenance a breeze. But secondly, when you couple Kubernetes with a product like d2k (github.com/portainer/d2k) from Portainer, it even lets you manage Kubernetes using Docker native tooling... and using the Docker CLI (but without inheriting any of the security risk)... Kinda best of both worlds. Of course, eventually you will become conversant with Kubernetes, and tools like d2k phase out, and thats OK.. that is the intended outcome.

So, if you run Docker today, please reconsider your “do nothing” approach, and start to build out a plan to move to Kubernetes... but don’t “boil the ocean” and attempt a massive infrastructure transformation, as that just elongates the project with “wants” vs “needs”... what you need is to get onto a stable and secure base platform, and for that its a far simpler project.

Neil