docker/docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-10-23 18:09:02 +03:00
Code Activity

docs: explain Sandboxes response to eMudhra CA compromise

Browse Source 
Cached template images and existing sandboxes need updates after the external eMudhra certificate authority compromise. Add guidance for recreating sandboxes with refreshed images or updating CA certificates in place.
This commit is contained in:
David Karlsson
2026-10-21 12:52:37 +00:00
parent a1e520f672
commit ace4411f47
1 changed files with 53 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
content/manuals/security/security-announcements.md
View File

@@ -17,6 +17,59 @@ aliases:
[Subscribe to security RSS feed](/security/security-announcements/index.xml)
## Docker Sandboxes response to eMudhra CA compromise
_Last updated October 21, 2026_
Following the eMudhra certificate authority compromise, Docker rebuilt the
sandbox template images for all built-in kits with updated CA certificates.
Refresh cached images and update existing sandboxes to receive this protection.
On October 20, 2026, researchers disclosed the compromise of private keys for
eight eMudhra intermediate certificate authorities. An attacker with these keys
could impersonate websites or services to clients that still trust the
compromised certificates. See the
[incident report](https://emudhra.we-have-a-problem.com/) for details.
Updating the `sbx` CLI alone doesn't update existing sandboxes.
### Recreate sandboxes with updated images
Recreate each sandbox using `--pull always` to fetch the updated images instead
of reusing cached copies. For example, for a Codex sandbox, run these commands
on your host:
```console
$ sbx stop <sandbox-name>
$ sbx rm <sandbox-name>
$ sbx create --name <sandbox-name> --pull always codex <workspace-path>
```
Replace `codex` with your agent and restore any options you used to create the
sandbox, such as `--clone` or additional kits. Before removing a sandbox, save
any files you need from inside it, including unpushed commits in clone mode.
Removing a sandbox deletes its filesystem.
Use `--pull always` when creating additional sandboxes from built-in kits.
Pulling updated images doesn't change sandboxes that already exist.
### Update CA certificates in existing sandboxes
If you need to keep an existing sandbox, update its `ca-certificates` package.
For Ubuntu-based Docker templates, run these commands on your host while the
sandbox is running:
```console
$ sbx exec <sandbox-name> -- sudo apt-get update
$ sbx exec <sandbox-name> -- sudo apt-get install --only-upgrade -y ca-certificates
```
Restart applications in the sandbox after updating. Tools that bundle their
own CA certificates may also need updates. See the incident report's
[patched software versions](https://emudhra.we-have-a-problem.com/#developers).
For custom templates, update the trust store using the base distribution's
security updates and rebuild the images before creating more sandboxes.
## Docker Sandboxes 0.42.0 security update: CVE-2026-77179 and CVE-2026-79994
Two vulnerabilities in Docker Sandboxes were fixed on September 7 in the