InfoQ - Cloud Native Computing Foundation

Buildpacks Move the Container Hardening Control Point Away From the Dockerfile

Mark Silvester — Mon, 10 Aug 2026 07:00:00 GMT

Cloud Native Buildpacks, which graduated within the CNCF in July 2026, move base image choice out of per-service Dockerfiles into a single builder owned by platform engineering, enabling fleet-wide patching. BellSoft's hardened Paketo builder is the latest sign that vendors now treat the builder, not the Dockerfile, as the container security control point.

By Mark Silvester

Pods as Workers, Not Agents: Rethinking the Deployment Unit for AI Agents on Kubernetes

Mark Silvester — Thu, 06 Aug 2026 06:00:00 GMT

Running AI agents on Kubernetes raises a key question: should each agent get its own Pod? The kagent project argues no—agents are bursty, short-lived, can spawn subagents, and may wait for human approval, making one Pod per agent wasteful. Agent-substrate adds a control plane to schedule logical “Actors” onto long-lived worker Pods.

By Mark Silvester