Tag
9 items tagged Docker.
Deciding what a cloud workload exposes: public and private subnets, security groups that reference each other instead of address ranges, egress control, TLS and DNS, proven with connection tests on a three-tier layout.
The secrets lifecycle for a cloud workload: credentials recovered from image history and deleted layers, a build that leaves nothing behind, Secrets in etcd before and after encryption at rest, rotation, and Vault TTLs.
Build the same Go service as a single-stage image and as a multi-stage image on a distroless base, then compare size, package count, scanner findings and the user it runs as.
How Trivy finds OS and application vulnerabilities, secrets and misconfigurations in container images, how to make the results actionable, and how to wire it into CI without slowing builds down.
A declarative Jenkins pipeline with secrets scanning, SAST, image scanning and least-privilege credential handling — and the agent, plugin and Docker decisions that keep it that way.
Build a deliberately weak image, scan it with Trivy, and rebuild it until the gate for fixable HIGH and CRITICAL findings passes: current base, non-root user, patched packages, no pip in the runtime image.
Container build and runtime tooling; the default way to package applications as OCI images.