Tag: ci-cd

Cosign Keyless: Sign Without Keys

Cosign keyless signing uses GitHub OIDC + Fulcio + Rekor to sign container images without managing private keys. Here's how it actually works and why you want it.

Docker Bake vs Compose Build

Orchestrating multi-image Docker builds: docker buildx bake vs compose build, matrix targets, multi-arch, caching, and when each one actually wins.

SBOMs and Supply Chain Security

A Software Bill of Materials tells you exactly what's in your software. Syft generates one, Grype scans it for CVEs. Together they're your supply chain paper trail.

Woodpecker CI vs Drone CI: Lightweight Pipelines for People Who Hate Waiting

Jenkins needs a server. GitHub Actions needs GitHub. If you're self-hosting your Git and want CI that doesn't weigh more than the code it's testing, Drone CI and its community fork Woodpecker CI are worth knowing about. One changed its license. The other exists because of that decision.

Container Security: Scan and Sign Your Images Like You Mean It

Pulling unscanned images onto your server is a gamble. Trivy finds the CVEs. Cosign proves the image hasn't been swapped out. Here's how to add both to your workflow.

Gitea vs Forgejo vs GitLab CE: Self-Hosted Git Without the Existential Crisis

You want to self-host your git. Noble. Responsible, even. But now you're staring down three options and a Reddit thread that's somehow both 4 years old and still being argued about. Gitea, Forgejo, GitLab CE, let's cut through the noise and figure out which one won't ruin your weekend.

Trivy + Cosign: Scan and Sign Your Images

You're pulling container images from strangers on the internet. Trivy scans them for CVEs. Cosign proves they haven't been tampered with. Use both.

Docker BuildKit: Stop Building Images the Slow Way

Cache mounts, secret mounts, parallel stages, BuildKit turns your Dockerfile from a slow linear disaster into something that actually respects your time.

Lazydocker & Dive: Fix Your Docker CLI

Learn how lazydocker and dive make Docker manageable from your terminal. TUI dashboards, image layer analysis, CI integration, and optimization tips.

Private Docker Registry with Harbor

Stop letting Docker Hub throttle your CI/CD. Run Harbor for RBAC, Trivy scanning, image replication, and a real UI, on infrastructure you control.

Docker BuildKit: Stop Waiting for Your Images to Build

Docker BuildKit is the default builder since Docker 23.0, but most people aren't using it right. Here's how to actually speed up your builds.

CI Pipeline Caching: Speed Up Every Build

Your CI job waits 4 minutes for npm install every run. One caching strategy cuts it to 15 seconds. Here's how.