Tag
Docker Compose gives you three ways to pass configuration into a container: the environment key, the env_file attribute and the .env file for interpolation. For sensitive data, do not use environment variables; Docker Compose secrets are mounted as read-only files under /run/secrets/, away from logs and the process environment.
Two years after the final NIST standards, post-quantum migration is no longer hypothetical. What has actually been migrated, what remains stuck, where the real operational problems lie, and how the timelines look from April 2026.
Four and a half years after Rust officially entered Linux 6.1, with real Apple GPU and NVMe drivers in production and several public conflicts between maintainers, it is time for a sober technical balance. What works, what still costs, and where the next phase is heading.
Kubernetes 1.35 has reached feature freeze, and three items matter. CEL-based admission policies go stable, replacing admission webhooks with expressions evaluated inside the control plane and removing an external failure point. Dynamic Resource Allocation goes stable for GPUs, NPUs and other accelerators. The new KubeletConfigSource API pushes kubelet configuration without restarting the node.
gVisor isolates containers by inserting Sentry, a kernel written in Go, between the container process and the real host kernel, shrinking the system-call surface a hostile tenant can reach. Its OCI-compatible runsc runtime drops in where runc used to sit. Use systrap mode, the default since 2023: portable, no special hardware required.
OSV-Scanner is Google's dependency scanner, announced in 2022, that queries the open OSV.dev database rather than raw CVE advisories. Because OSV pins each vulnerability to precise commit or semantic version ranges, matching against your actual dependencies becomes deterministic and produces far less noise. It reads npm, Python, Go, Ruby, PHP, Rust and Maven manifests.
CVE-based attack surface management has moved from an abstract list to an engineering practice with real prioritization. We look at how it works once EPSS, KEV and exposure context enter the same equation.
Post-quantum cryptography stopped being an academic topic once Cloudflare, Google, and Apple put ML-KEM hybrids into production. By 2025 it already covers the majority of real web traffic. A look at where adoption stands, where friction still shows up, and what to review in your own infrastructure.
OpenSSH added hybrid post-quantum key exchange with ML-KEM in version 9.9 and made it the default algorithm in 10.0. The question is no longer whether to migrate SSH to post-quantum, but how to do it without breaking old clients: enable the hybrid mode, keep a classical fallback, and verify with ssh -v that the active algorithm is the right one.
WireGuard is simple over a single link, but hand-building a multi-node mesh quickly turns into a tangle of keys and routes. Patterns that work, when pure WireGuard earns its keep, and when it is worth leaning on Tailscale or Headscale instead.
VEX, the Vulnerability Exploitability eXchange, is a structured way for a vendor to state whether a CVE listed in an SBOM actually affects a product. Log4Shell in December 2021 showed why it exists: countless Java applications carried that critical CVE while never loading the vulnerable class. VEX marks which vulnerabilities are not exploitable, so scanner noise becomes signal.
Semgrep has grown into one of the most pragmatic static analyzers in the ecosystem. A look at why it works where other SAST tools fail, and how to fit it into a pipeline without turning it into noise.
Two years after Zero Trust stopped being a marketing word, it is worth looking at how it connects with the SIEM teams run day to day. A look at useful signals, avoidable noise, and the decisions that actually change security posture.
CodeQL is GitHub's semantic code analysis engine and the heart of the GitHub Advanced Security offering. It succeeded Semmle, which GitHub acquired on September 18, 2019, and its query libraries now cover almost every language a mid-sized company uses: Rust went generally available on October 14, 2025, and Kotlin moved to an official analyzer.
Dependabot and Renovate chase the same goal with different philosophies. I compare both after years running them on my own and client projects, covering when one fits better and when the other suits a team's workflow more.
NIST published the final post-quantum cryptography standards in August 2024. Six months on, it is time to move from headline to plan: crypto inventory, crypto-agility, a realistic timeline, and the typical mistakes of teams jumping in now.
SLSA v1.0 splits software supply-chain security into three tracks (Build, Source, and Dependencies), of which only Build is stabilized, with three levels: L1, L2, and L3. If you build in GitHub Actions, reaching L2 with Sigstore-signed provenance takes a few hours and is the starting point I recommend to any team.
In August 2024, NIST published its first finalized post-quantum cryptography standards: FIPS 203 (ML-KEM) for key exchange, FIPS 204 (ML-DSA) for digital signatures, and FIPS 205 (SLH-DSA) as a hash-based alternative. They replace RSA and ECDSA before a quantum computer can break them, and hybrid implementations are already live in Chrome and Cloudflare.
CrowdSec replaces fail2ban by separating detection (agent plus LAPI) from blocking (bouncers): install the agent with the official script on Debian or Ubuntu, enable the right collections, add a bouncer for Traefik or the firewall, and optionally captcha remediation via Cloudflare Turnstile plus the shared community blocklist.
Zero Trust is not a product but a security architecture. It discards the assumption that the internal network is trusted and verifies every access explicitly, with least privilege, assuming breach is already active. The five principles: verify explicitly, least privilege, assume compromise, validate the device, and continuous visibility.
Podman is the Docker alternative with no central daemon and no root privileges required. Each container runs as a direct child process of the launching user, with rootless support since version 1.0 in 2019. If a container escapes, it does not gain host root. When Podman makes sense and what real differences to expect.
Trivy and Grype are the two leading open-source tools for container image scanning in CI/CD pipelines. Both detect CVEs in OS packages and language dependencies with less than 5% coverage difference. Trivy stands out for IaC scanning; Grype natively integrates the SBOM workflow with Syft.
Vault centraliza secretos con rotación, auditoría y políticas granulares. Guía práctica para equipos que pasan de .env a gestión seria.
eBPF (Extended Berkeley Packet Filter) is a Linux kernel technology that runs verified programs directly inside the kernel, with no modules and no source-code changes. The kernel verifier rejects any unsafe program before it runs, letting teams monitor system calls, network traffic, and I/O at a much lower CPU cost than traditional external probes.
Microsoft PC Manager is a free, official Microsoft tool that brings temporary-file cleanup, Windows startup management, one-click access to Windows Defender, and a visual disk-usage map into a single panel. It runs on Windows 10 and Windows 11, but it does not replace a full antivirus or dedicated data-recovery tools.
