Tag: security

Read-Only Docker Containers: What Breaks

Turn on read_only: true and watch nginx, Postgres, Redis, Python and Node fail in specific ways. Real errors, plus the minimum tmpfs and volume set for each.

PHP2Shell: Is Your Homelab Running PHP?

PHP2Shell is two unauthenticated PHP RCE flaws. Find every PHP container in your homelab, patch to the fixed release, and keep Cloudflare's WAF as a seatbelt.

Keycloak vs Authentik vs Authelia

Keycloak, Authentik and Authelia compared on realms, LDAP and AD federation, SAML, OIDC, clustering and RAM, with Compose files and a pick for each use case.

Outline: The Team Wiki That Needs SSO

Outline has no password login, so self-hosting it means pairing it with an OIDC provider. Here is a working Docker stack with Postgres, Redis, and Dex.

Firewall Rule Audit: Find the Dead Rules

Find unused firewall rules on a Linux box with nftables counters, then retire them safely with a snapshot-and-diff routine, a jq script, and a systemd timer.

Home Lab Threat Model: What's Exposed

Mass scanners find a new home lab IP within hours. Audit what the internet can reach, from UPnP to Docker ports to IPv6, then build a threat model that fits.

Kyverno: K8s Policy Without Rego

Kyverno on k3s: validate, mutate, generate, verify signed images, handle exceptions, and test policies in CI. Plus the CEL policy types replacing ClusterPolicy.

AppArmor Profiles for Docker, Step by Step

Docker puts every container under the docker-default AppArmor profile. See what it blocks, then build a tested nginx profile with audit deny and complain mode.

Catch Your Self-Hosted Apps Phoning Home

Self-hosted is not silent. Audit outbound calls with DNS query logs, watch live connections, block egress with Docker networks, then flip telemetry opt-outs.

Pre-Commit Hooks That Catch Secrets

A secret that reaches git push is already gone. Compare gitleaks, TruffleHog, and detect-secrets as pre-commit hooks, with working configs you can copy.

gVisor vs Firecracker vs Kata for Agents

Letting a coding agent run npm install and arbitrary shell? Compare gVisor, Firecracker, and Kata on startup, KVM needs, Docker fit, and network egress.

Prompt Injection vs Your Coding Agent

Prompt-level defenses against injection are probabilistic and lose to a patient attacker. Here's the capability-level design that holds, with working configs.