KnowBite KnowBite

DevOps & SRE

DevOps & SRE knowledge cards on KnowBite — curated from specialist publications, updated throughout the day.

  2. Why Is My Kubernetes Job Still Pending? Tracing Kueue Admission with Headlamp

    You submit a Kubernetes Job and wait for its Pods to appear. A minute passes. Then another. The Job is still suspended, there are no application logs, and there may not even be a Pod to inspect. In a cluster managed by Kueue , this can be completely normal. Kueue may still be deciding whether the Job can use the requested resources. The useful question is not only “Why is the Pod pending?” It is first “Has Kueue…

    Kubernetes Blog · 2026-10-14T18:35:00Z

  4. The Shift to cgroup v2 in Kubernetes: What You Need to Know

    In Linux, cgroups (control groups) are a kernel feature used for managing system resources. Kubernetes uses cgroups to allocate resources like CPU and memory to containers, ensuring that applications run smoothly without interfering with each other. With the release of Kubernetes v1.31, support for v1 cgroup management moved into maintenance mode . Support for v2 cgroup management has been stable since Kubernetes…

    Kubernetes Blog · 2026-10-06T18:00:00Z

  6. Scaling Kubernetes Workloads with Node Swap

    Memory is often the first hard limit a Kubernetes cluster hits. Nodes run out of RAM long before they run out of CPU, and the new wave of agentic AI workloads makes this worse. These workloads demand large memory footprints to start up and run untrusted code, then sit idle waiting for the next prompt. That idle but resident memory is expensive, and it caps how many pods a node can hold. This is where swap helps…

    Kubernetes Blog · 2026-10-05T18:00:00Z

  8. Spotlight on SIG Apps

    As Kubernetes adoption has grown, the conversation has shifted beyond running containers to managing increasingly complex application lifecycles. Modern platforms support stateless web services, stateful databases, batch processing, AI workloads, and platform services. At the same time, they must remain reliable during upgrades, scaling events, and infrastructure failures. Every Kubernetes user relies on SIG Apps…

    Kubernetes Blog · 2026-09-22T18:00:00Z

  9. From baseline to Secure Software Factory: securing the systems that build your software

    In July, Docker, Snyk and Keycard published Agent Baseline, an open, vendor-neutral reference architecture that defines security outcomes for running AI agents in the enterprise. It grew out of conversations with industry leaders who want to adopt agents more broadly but need answers to three questions: What is operating, with what capabilities? Is it staying...

    Docker Blog · 2026-10-21T16:00:00Z

  10. Kubernetes v1.37: Tracking When a PersistentVolumeClaim Was Last Used (Beta)

    Kubernetes v1.37 promotes the PersistentVolumeClaimUnusedSinceTime feature gate to Beta (enabled by default). With this feature, the PersistentVolumeClaim (PVC) protection controller adds an Unused condition to each PVC, telling you whether any running pod currently references it — no custom tooling or cross-referencing required. For the API definition of PVC conditions, see the PersistentVolumeClaim API reference…

    Kubernetes Blog · 2026-09-21T18:30:00Z

  12. Kubernetes v1.37: Hardening Container Storage with Bind Mount Options and EmptyDir Permissions

    Kubernetes v1.37 brings important storage security features: emptyDir permission modes and bind mount options. They help application programmers and security professionals implement rigorous security policies, for example, prohibiting deletion of files across containers or execution of arbitrary binaries from writable volumes, directly in Kubernetes without any complicated circumvention. Linux storage and permission…

    Kubernetes Blog · 2026-09-16T18:30:00Z

  14. Kubernetes v1.37: Pod-Level Resource Managers graduated to Beta

    With the release of Kubernetes v1.37, the Pod-Level Resource Managers feature has graduated to Beta status (disabled by default)! First introduced as an Alpha feature in Kubernetes v1.36 , this enhancement builds on Pod-Level Resources by equipping Kubelet's Topology Manager, CPU Manager, and Memory Manager to use Pod-level resource declarations ( .spec.resources ) directly when making hardware placement decisions…

    Kubernetes Blog · 2026-09-15T18:30:00Z

  15. Harbor + Docker Sandboxes: Run Safe, Reproducible Agent Evals

    Harbor can now run every eval task in Docker Sandboxes Docker Sandboxes are MicroVM environments to run agents like Claude Code, Codex, Cursor, and more safely With Sandboxes, define custom network policies for fair, reproducible evals Run your evals locally or in the cloud: starting for free on Docker Sandboxes on local surfaces and scaling...

    Docker Blog · 2026-10-14T21:45:27Z

  16. Kubernetes v1.37: Memory QoS Graduates to Beta

    Memory QoS has graduated to Beta in Kubernetes v1.37 and is now enabled by default. On Linux nodes running cgroup v2, the feature uses the memory controller to give the kernel better guidance on how to treat container memory. It was first introduced as Alpha in v1.22, and expanded in v1.36 with tiered memory reservation. This post covers what changed in v1.37, what the Beta promotion means for cluster operators, and…

    Kubernetes Blog · 2026-09-14T18:30:00Z

  18. Kubernetes Changed Block Tracking API - Beta Differences

    Changed Block Tracking (CBT) support for CSI drivers shipped as Alpha in September 2025. With the March 2026 v1.0.0 release of the external-snapshot-metadata project, the feature moved to Beta . If you aren't yet familiar with changed block tracking for storage in Kubernetes, the Alpha announcement covers the motivation, the three primary components (the CSI SnapshotMetadata gRPC service, the SnapshotMetadataService…

    Kubernetes Blog · 2026-09-14T18:30:00Z

  19. Trust Docker for the agents you don’t

    At WeAreDevelopers, Docker introduced Cloud Sandboxes, the open Sandbox Kit specification, and a commitment to bring Kits to the CNCF for neutral governance.

    Docker Blog · 2026-10-01T18:26:12Z

  20. Kubernetes v1.37: Native Histograms Graduates to Beta

    I'm excited to announce that native histogram support for Kubernetes metrics is graduating to Beta and is enabled by default in Kubernetes v1.37! Native histograms (previously introduced as Alpha in Kubernetes v1.36 under KEP-5808 ) bring high-resolution, low-cardinality observability to Kubernetes metrics. By adopting Prometheus Native Histograms , Kubernetes components now expose latency and duration metrics with…

    Kubernetes Blog · 2026-09-11T18:30:00Z

  22. Kubernetes v1.37: Scheduler Preemption for In-Place Pod Resize (Alpha)

    In Kubernetes, resource allocation has historically been a static decision made during a Pod's initial scheduling and placement. With the graduation of the core in-Place Pod resize feature to General Availability in v1.35, application developers and cluster operators gained the powerful ability to dynamically adjust CPU and memory allocations of running containers without incurring disruptive restarts or application…

    Kubernetes Blog · 2026-09-10T18:30:00Z

  24. Kubernetes v1.37: Introducing Node Lifecycle Conditions

    Kubernetes has many ways to describe what is happening on a Node. Readiness, taints, Pod state, labels, annotations, and provider-specific APIs each expose part of the picture. What has been missing is a shared, Kubernetes-owned way to say that a Node is draining , undergoing maintenance, or undergoing Graceful Node Shutdown . Kubernetes v1.37 introduces five well-known Node conditions that provide that description…

    Kubernetes Blog · 2026-09-09T18:30:00Z

  26. Kubernetes v1.37: Advancing Workload-Aware Scheduling

    AI/ML and complex batch workloads continue to push the boundaries of Kubernetes scheduling. Following the foundational workload-centric enhancements introduced in previous releases, Kubernetes v1.37 delivers the next major milestone in the Workload-Aware Scheduling (WAS) journey. In this release, the core Workload and PodGroup APIs—enabling gang scheduling—along with Workload-Aware Preemption (WAP) and shared DRA…

    Kubernetes Blog · 2026-09-08T18:30:00Z

  28. Kubernetes v1.37: KubeletInUserNamespace (aka Rootless mode) Graduates to Beta

    Kubernetes v1.37 promotes the KubeletInUserNamespace feature gate to beta. With this feature enabled, all of the node components (kubelet, CRI and OCI runtimes, CNI plugins, and kube-proxy) can run as a non-root user on the host, using a Linux user namespace . This technique is also known as rootless mode . The work started as an experiment in 2018, and was merged into Kubernetes v1.22 (2021) as an alpha feature…

    Kubernetes Blog · 2026-09-04T18:30:00Z

  29. Meet the Ecosystem: Partners and Customers at WeAreDevelopers with Docker

    Meet the partners and customers bringing practical AI, security, and development sessions to the Docker Pavilion at WeAreDevelopers. The post explains why a strong ecosystem matters to developers, announces the sessions and speakers, and invites attendees to connect with the teams building and using these technologies.

    Docker Blog · 2026-09-22T15:06:15Z

  32. Below the Harness: Governing a Multi-Model, Multi-Harness World

    We believe the future is a multi-model, multi-harness world. And we think it needs a new trust model. In 1988, Norm Hardy described a problem that had been quietly breaking systems for years: the confused deputy. A program that takes action using its permissions instead of yours. Today, every AI agent is that deputy. It...

    Docker Blog · 2026-09-02T13:00:00Z

  34. Secure by default is your only way forward

    The newest worker on your team builds with whatever it finds and never asks what deserves your trust. Our answer is a hardened foundation and a boundary built for agents.

    Docker Blog · 2026-08-31T13:00:00Z

  36. MinIO End of Life: How to Stay Patched and Audit-Ready with Docker ELS

    MinIO reached end of life in February 2026. Docker Extended Lifecycle Support (ELS) keeps end-of-life software like it patched, compliant, and audit-ready for up to five years, covering versions upstream no longer supports all the way up to entire projects.

    Docker Blog · 2026-08-24T13:00:00Z