Container Runtime Hardening: Rootless, Read-Only, and Fewer Capabilities
Scanning tells you what is inside the image. These four settings decide what it can do once it is running — and what breaks when you turn them on.
4 min readRead post →
category
Security
7 posts in this category.
Container Supply Chain: How I Stopped Trusting Base Images
Tags move underneath you and nobody tells you. Pinning digests, gating on real CVEs, emitting an SBOM, and signing what my pipeline actually built.
4 min readRead post →
Kill the Long-Lived Cloud Keys in Your Pipeline
An access key sitting in CI secrets has no expiry and no owner. Replacing it with OIDC federation means the pipeline authenticates per run instead of carrying a permanent password.
3 min readRead post →
Kubernetes Security Baseline: RBAC, Pod Security, and Default-Deny
Out of the box a cluster lets almost anything run as root with a mounted token and an open network. Three labels, one role cleanup, and a default-deny policy fix most of it.
3 min readRead post →
Security Gates in CI That Don't Make Every Pull Request Crawl
A scanner that blocks on every historic finding gets bypassed within a week. Baselines, severity floors, and the split between fast PR checks and slow nightly ones.
3 min readRead post →
Secrets Management Habits That Keep You Out of Trouble
The .env file I committed once, how I cleaned it up, and the boring habits that keep API keys out of git history for good.
3 min readRead post →
Linux Server Hardening: The 20% That Stops 80% of Attacks
Effective Linux hardening isn't a security checklist that makes the machine unusable. It's SSH config, patching, least privilege, and logging.
2 min readRead post →