Tag: ci-cd

Two Kubernetes-native pipeline engines from CNCF, Argo Workflows and Tekton. Different philosophies, same goal: stop using Jenkins. Honest comparison.

Build container images without writing a single Dockerfile, ko for Go, Jib for Java, Paketo Buildpacks for everything else. Real benchmarks, real tradeoffs.

Cosign keyless signing uses GitHub OIDC + Fulcio + Rekor to sign container images without managing private keys. Here's how it actually works and why you want it.

Orchestrating multi-image Docker builds: docker buildx bake vs compose build, matrix targets, multi-arch, caching, and when each one actually wins.

A Software Bill of Materials tells you exactly what's in your software. Syft generates one, Grype scans it for CVEs. Together they're your supply chain paper trail.

Pulling unscanned images onto your server is a gamble. Trivy finds the CVEs. Cosign proves the image hasn't been swapped out. Here's how to add both to your workflow.

You're pulling container images from strangers on the internet. Trivy scans them for CVEs. Cosign proves they haven't been tampered with. Use both.

GitLab CE does everything and wants all your RAM. Gitea and Forgejo run on a Raspberry Pi. Here's which self-hosted git platform actually fits your setup.

Stop letting Docker Hub throttle your CI/CD. Run Harbor for RBAC, Trivy scanning, image replication, and a real UI, on infrastructure you control.

Using :latest in production is a ticking time bomb. Pin your Docker image versions or watch a surprise update break everything at 2 AM.

Your CI rebuilds node_modules from scratch every build. BuildKit, Docker's default builder since 23.0, fixes it with cache mounts, parallel stages, real secrets.

Your CI job waits 4 minutes for npm install every run. One caching strategy cuts it to 15 seconds. Here's how.