https://www.msbiro.net/tags/containers/ Recent content in Containers on Cloud Native & Open Source: A Team Lead’s Working Journal https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- 0.164.0 en-us Wed, 24 Jun 2026 09:30:00 +0100 https://www.msbiro.net/posts/hardened-images-catalog-2026-non-negotiable/ Wed, 24 Jun 2026 09:30:00 +0100 https://www.msbiro.net/posts/hardened-images-catalog-2026-non-negotiable/ Why hardened container image catalogs are non-negotiable in 2026: the technological case, the DORA mandate, and the NIS2 obligations explained. https://www.msbiro.net/posts/cve-2026-31431-copy-fail-linux-kernel-privilege-escalation/ Fri, 01 May 2026 09:00:00 +0100 https://www.msbiro.net/posts/cve-2026-31431-copy-fail-linux-kernel-privilege-escalation/ CVE-2026-31431 Copy Fail is a local privilege escalation in the Linux kernel exploitable with a 732-byte Python script. This post covers what it is, how to fix it, what to do when patching isn't immediate, and why runtime detection is the control that actually matters. https://www.msbiro.net/posts/ubuntu-2604-lts-security-container-workloads/ Thu, 30 Apr 2026 07:00:00 +0100 https://www.msbiro.net/posts/ubuntu-2604-lts-security-container-workloads/ Ubuntu 26.04 LTS 'Resolute Raccoon' just shipped. For teams running RHEL or Ubuntu on servers, this post breaks down what actually changed in security and container/Kubernetes workloads compared to 24.04 LTS, and whether it justifies starting the golden master rebuild now. https://www.msbiro.net/posts/kubernetes-1-36-security-release/ Tue, 21 Apr 2026 12:35:00 +0000 https://www.msbiro.net/posts/kubernetes-1-36-security-release/ Kubernetes 1.36 releases tomorrow with a significant security focus: user namespace isolation and SELinux volume labeling reaching GA, the end of Ingress NGINX, and a set of long-overdue removals that tighten the security posture of every cluster. https://www.msbiro.net/posts/trivy-supply-chain-attack/ Sat, 21 Mar 2026 07:32:37 +0000 https://www.msbiro.net/posts/trivy-supply-chain-attack/ A comprehensive analysis of the March 2026 Trivy supply chain incident: from malicious GitHub Actions to the self-propagating CanisterWorm. https://www.msbiro.net/posts/datadog-state-of-devsecops-2026-report/ Fri, 06 Mar 2026 09:00:00 +0000 https://www.msbiro.net/posts/datadog-state-of-devsecops-2026-report/ Exploring the critical findings of the Datadog State of DevSecOps 2026 report, focusing on exploitable vulnerabilities, unmaintained libraries, and CI/CD security risks. https://www.msbiro.net/posts/back-to-basics-containers-linux-processes/ Fri, 20 Feb 2026 06:31:29 +0000 https://www.msbiro.net/posts/back-to-basics-containers-linux-processes/ Containers are Linux processes with namespaces and cgroups, nothing more. This article breaks down what Kubernetes securityContext, resource limits, and container escapes actually do at the kernel level, and shows you how to debug containers using standard Unix tools like nsenter and /proc. https://www.msbiro.net/posts/the-case-for-hardened-container-image-catalogs/ Sat, 29 Nov 2025 10:00:00 +0000 https://www.msbiro.net/posts/the-case-for-hardened-container-image-catalogs/ Why traditional vulnerability scanning isn't enough and how a hardened image catalog is essential for modern enterprise security and regulatory compliance. https://www.msbiro.net/posts/runc-container-breakout-vulnerabilities-2025/ Fri, 07 Nov 2025 06:45:00 +0000 https://www.msbiro.net/posts/runc-container-breakout-vulnerabilities-2025/ A summary of the recently disclosed runc container breakout vulnerabilities (CVE-2025-31133, CVE-2025-52565, and CVE-2025-52881) and the recommended actions. https://www.msbiro.net/posts/markitdown-apple-containers/ Tue, 04 Nov 2025 01:30:00 +0100 https://www.msbiro.net/posts/markitdown-apple-containers/ A hands-on test of Microsoft's MarkItDown, a powerful tool for AI workflows, and a first look at Apple's new container technology on an M4 MacBook. https://www.msbiro.net/posts/from-dev-to-prod-making-distroless-images-your-default/ Tue, 17 Jun 2025 10:10:03 +0000 https://www.msbiro.net/posts/from-dev-to-prod-making-distroless-images-your-default/ Explore the importance of using distroless container images to reduce security vulnerabilities in production. This post covers practical advice on adopting distroless images using multi-stage builds, along with comprehensive debugging techniques including the open-source cdebug tool, Docker Debug, and Kubernetes' kubectl debug with ephemeral containers. Learn how strategic container image choices improve security, efficiency, and maintainability from development through production.