8 min read
An SBOM is an ingredients list, not a safety check
What goes into a software bill of materials, what having one actually buys you, and the question it still cannot answer.
Security
18 posts tagged “Security”.
8 min read
How RSA works, without the number theory
Why a padlock anyone can check but only you can close is what actually holds up HTTPS, SSH and signed commits.
7 min read
Sign and verify your first container image with Cosign
From an unsigned image to a keyless signature anyone can verify, using Sigstore's public infrastructure. No key to lose.
8 min read
Moving Kubernetes workloads across an air gap with Hauler
Declare images and charts in one manifest, package them into a single archive, carry it across, and serve it from a binary with no dependencies.
8 min read
Scanning images, filesystems and IaC with Trivy
One scanner for container images, dependencies, Terraform and secrets: install it, read its output, and fail a build on the right things.
7 min read
Generate an SBOM from a container image with Syft
Install Syft, scan an image or a directory, choose an output format, and wire it into CI so every build produces one.
7 min read
Getting a deeper SBOM out of cdxgen
cdxgen reads your lockfiles and build system rather than the finished image. How to run it, and when that difference matters.
7 min read
CycloneDX, the security-first bill of materials
How CycloneDX models components, dependencies and vulnerabilities, and when to pick it over SPDX.
8 min read
SPDX, the licence-first bill of materials
Where SPDX came from, how its document model is shaped, and why licence teams reach for it before security teams do.
3 min read
Runtime security: Falco, immutable containers and audit logs
Watch a running cluster for attacks with Falco, stop running containers from being changed with a read-only root filesystem, and record every API request with audit logs.
4 min read
Supply chain security for Kubernetes
Everything between a commit and a running Pod can be attacked. Minimal and signed images, scanning in CI, locked-down pipelines and secrets, and checks at runtime.
4 min read
Pod security: PSA, AppArmor, seccomp and sandboxes
Enforce Pod Security Standards per namespace, limit what a container can do with AppArmor and seccomp, and isolate untrusted workloads with gVisor or Kata Containers.
4 min read
Hardening a cluster: CIS benchmarks and API access
Check a cluster against the CIS Kubernetes Benchmark with kube-bench, then control who can do what through the API server with authentication, RBAC and network policies.
7 min read
Git hooks that stop secrets before they land
A pre-commit hook that blocks AWS access key IDs, a commit-msg hook that enforces Conventional Commits, and Husky so a fresh clone arms them by itself.
3 min read
ConfigMaps and Secrets
Keep configuration out of your images with ConfigMaps, handle passwords and keys with Secrets, and know what base64 does and does not protect.
7 min read
OpenSSL commands worth remembering
Generate a key, make a CSR, inspect a certificate, debug a TLS handshake, and convert between the formats that keep breaking.
3 min read
Controlling Pod traffic with network policies
Every Pod can reach every other Pod by default. Network policies cut that down to what you allow, starting from a default deny.
6 min read
Create a pre-signed URL for a Civo object store
Upload a file to a Civo object store with s3cmd, then hand out a link that works for exactly one hour and then stops.