Tag: container-security

How to expose a possibly-vulnerable app to the public internet and survive it: rootless containers, a file-integrity tripwire, and zero inbound SSH on the box.

Distroless containers are tiny, secure, and loved by security teams, until you need to debug one at 2 AM. Here's when Google distroless actually pays off vs when it's just container hipster points.

Pulling unscanned images onto your server is a gamble. Trivy finds the CVEs. Cosign proves the image hasn't been swapped out. Here's how to add both to your workflow.

Falco watches every syscall your containers make and screams when something sketchy happens. Like someone exec'ing a shell inside your nginx container at 3am.

You're pulling container images from strangers on the internet. Trivy scans them for CVEs. Cosign proves they haven't been tampered with. Use both.

Run Docker containers without root privileges, here's the security difference, the install steps, and the gotchas nobody tells you about.

Alpine gives you a shell and apk; Distroless gives you nothing but the app. Compare attack surface, image size, and multi-stage build complexity.

Distroless images contain only your app and its runtime, no shell, no package manager, no attack surface. Here's how to build them.

AppArmor vs SELinux: what mandatory access control actually does, writing AppArmor profiles with aa-genprof, SELinux labels and audit2allow, and when to use each.

Learn Linux capabilities to drop root privileges without breaking your apps. Master cap_drop, cap_add in Docker, and setcap for fine-grained privilege control.

Containers run as root by default, which is a real security problem. The USER instruction, numeric UID/GID, the volume mount gotcha, and distroless bases.