Blog

Security research, threat intelligence insights, and product updates.

March 1, 2026

24 Hours of Docker Exploitation — What Attackers Do With an Exposed Docker API

Our honeypot sensors emulate exposed Docker daemons and record everything attackers do. We pulled a 24-hour snapshot: 3,964 events from 144 IPs, container escapes via nsenter, SSH key backdoors locked with chattr, a self-replicating worm from 100 IPs, and cron persistence — all before anyone touched the application layer.

honeypots threat intelligence research Docker container security container escape malware

February 24, 2026

Introducing SikkerGuard — Automatic Firewall Protection in a Docker Container

SikkerGuard pulls SikkerAPI's threat blacklist and blocks malicious IPs at the kernel level using iptables and ipset. One Docker container, one API key, zero maintenance. Free tier included.

iptables ipset firewall network updates Release SikkerGuard Docker Blocking