https://www.msbiro.net/tags/security/ Recent content in Security on Cloud Native & Open Source: A Team Lead’s Working Journal https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- 0.165.0 en-us Fri, 04 Sep 2026 05:05:00 +0000 https://www.msbiro.net/posts/kubernetes-1-37-security-leaders/ Fri, 04 Sep 2026 05:05:00 +0000 https://www.msbiro.net/posts/kubernetes-1-37-security-leaders/ Kubernetes 1.37 security: three stable advances in workload identity and SELinux, plus three alpha features shaping the future of cloud native security. https://www.msbiro.net/posts/shadow-ai-cicd-kubernetes-threat-model/ Mon, 27 Jul 2026 00:00:00 +0000 https://www.msbiro.net/posts/shadow-ai-cicd-kubernetes-threat-model/ Shadow AI turns ungoverned coding assistants and agents into a live threat across CI/CD. A stage-by-stage threat model from developer laptop to Kubernetes pod, with the executive controls and tooling that contain the risk. https://www.msbiro.net/posts/kubernetes-1-36-security-release/ Tue, 21 Apr 2026 12:35:00 +0000 https://www.msbiro.net/posts/kubernetes-1-36-security-release/ Kubernetes 1.36 releases tomorrow with a significant security focus: user namespace isolation and SELinux volume labeling reaching GA, the end of Ingress NGINX, and a set of long-overdue removals that tighten the security posture of every cluster. https://www.msbiro.net/posts/linux-70-what-platform-security-leaders-should-know/ Thu, 16 Apr 2026 10:11:00 +0000 https://www.msbiro.net/posts/linux-70-what-platform-security-leaders-should-know/ Linux 7.0 is not a single-headline release, but it closes several real security gaps that cloud-native platforms have been working around for years. Here is what platform and security leaders should understand, plan for, and ask their teams. https://www.msbiro.net/posts/docker-sandboxes-ai-agents/ Tue, 07 Apr 2026 12:22:00 +0000 https://www.msbiro.net/posts/docker-sandboxes-ai-agents/ Docker Sandboxes (sbx) promises to run AI coding agents in isolated microVMs with zero risk to your host. I installed it, broke it, fixed it, and ran GitHub Copilot CLI inside a sandbox on my MacBook. Here is what I found. https://www.msbiro.net/posts/actui-security-hardening-dependabot-openssf-scorecard/ Thu, 02 Apr 2026 08:00:00 +0000 https://www.msbiro.net/posts/actui-security-hardening-dependabot-openssf-scorecard/ Back from KubeCon EU 2026 with a free Copilot Pro+ subscription, I turned my attention to the security posture of apple-container-tui. Here's how I added Dependabot and OpenSSF Scorecard using GitHub Actions, spec-kit, and the GitHub CLI. https://www.msbiro.net/posts/investing-in-the-future-12-5-million-to-fortify-open-source-security/ Fri, 20 Mar 2026 05:45:00 +0000 https://www.msbiro.net/posts/investing-in-the-future-12-5-million-to-fortify-open-source-security/ A major coalition of tech giants including Microsoft, Google, AWS, and GitHub has announced a $12.5 million investment to strengthen open-source security. Managed by OpenSSF and Alpha-Omega, this funding aims to scale security defenses using AI and support overworked maintainers. Discover why this is a pivotal moment for the OSS ecosystem. https://www.msbiro.net/posts/notepad-plusplus-sdlc-compromise-2026/ Tue, 03 Feb 2026 22:00:00 +0000 https://www.msbiro.net/posts/notepad-plusplus-sdlc-compromise-2026/ Deep dive into the Notepad++ supply chain attack: how state-sponsored hackers compromised the hosting provider, hijacked updates, and what we can learn about SDLC security. https://www.msbiro.net/posts/docker-hardened-images-free/ Thu, 18 Dec 2025 09:00:00 +0100 https://www.msbiro.net/posts/docker-hardened-images-free/ Docker has made a significant move by releasing their Hardened Images catalog as free and open source. This post explores what this means for developers, the inclusion of Helm charts and MCP servers, and how the enterprise model supports this initiative. https://www.msbiro.net/posts/the-case-for-hardened-container-image-catalogs/ Sat, 29 Nov 2025 10:00:00 +0000 https://www.msbiro.net/posts/the-case-for-hardened-container-image-catalogs/ Why traditional vulnerability scanning isn't enough and how a hardened image catalog is essential for modern enterprise security and regulatory compliance. https://www.msbiro.net/posts/external-secrets-operator-releases-resume/ Sun, 14 Sep 2025 22:51:03 +0000 https://www.msbiro.net/posts/external-secrets-operator-releases-resume/ External Secrets Operator resumes releases on September 22 with clearer governance and a new contribution ladder—see what changed and how to get involved https://www.msbiro.net/posts/external-secrets-operator-team-needs-help/ Fri, 15 Aug 2025 02:30:03 +0000 https://www.msbiro.net/posts/external-secrets-operator-team-needs-help/ The External Secrets Operator project faces challenges with long-term maintenance and needs new contributors. Learn about the situation, its impact on the Kubernetes community, and how you can help support this essential open-source security tool. https://www.msbiro.net/posts/kubernetes-133-user-namespace-isolation-security-matters/ Fri, 16 May 2025 09:30:03 +0000 https://www.msbiro.net/posts/kubernetes-133-user-namespace-isolation-security-matters/ Kubernetes 1.33 enables user namespace isolation by default for pods, greatly enhancing security by mapping container root users to unprivileged host UIDs. This post explores the feature’s security benefits including process isolation and lateral movement prevention, infrastructure requirements like Linux kernel 6.3 and compatible container runtimes, and how to enable user namespaces in your pod specifications. Learn why this advancement is crucial for securing Kubernetes workloads in modern environments. https://www.msbiro.net/posts/openssf-opensource-project-security-baseline/ Wed, 26 Feb 2025 11:30:03 +0000 https://www.msbiro.net/posts/openssf-opensource-project-security-baseline/ The OpenSSF Open Source Project Security Baseline is a new initiative providing a structured set of security checks across three levels that open-source projects can implement to demonstrate a strong security posture. This practical framework helps maintainers improve software security and certification, fostering safer open-source ecosystems. Learn about the baseline, its levels, and how to get involved. https://www.msbiro.net/posts/bsides-galway-february-22-2025/ Sun, 17 Nov 2024 13:30:03 +0000 https://www.msbiro.net/posts/bsides-galway-february-22-2025/ BSides Galway debuts its first-ever local security conference on February 22nd, 2025, at the University of Galway. Bringing together cybersecurity professionals, enthusiasts, and students, the event fosters learning, networking, and community—all in the globally renowned BSides format. Learn about tickets, CFP, and opportunities to get involved in Ireland’s newest infosec event. https://www.msbiro.net/posts/cyberark-conjur-131-released/ Thu, 07 Dec 2023 08:30:03 +0000 https://www.msbiro.net/posts/cyberark-conjur-131-released/ CyberArk has released Conjur 13.1, a point update focusing on under-the-hood improvements that enhance the resiliency of Conjur followers. Key changes include major upgrades to the underlying container base image, PostgreSQL, and etcd versions, as well as enhanced flexibility in vault synchronization and secret segregation. This release is recommended for all Conjur Enterprise users seeking improved performance and stability. https://www.msbiro.net/posts/the-value-of-community-contributions-exploring-cncf-openssf/ Wed, 01 Nov 2023 16:44:03 +0000 https://www.msbiro.net/posts/the-value-of-community-contributions-exploring-cncf-openssf/ This post explores the importance and impact of contributing to open-source community foundations, focusing on the Cloud Native Computing Foundation (CNCF) and the Open Source Security Foundation (OpenSSF). It shares personal experiences of involvement, the benefits of stepping outside one’s comfort zone, and practical links to join projects, events, and working groups. Gain insights into how participation fosters ecosystem growth and professional development. https://www.msbiro.net/posts/resolving-podman-log-rotation-issue-conjur-enterprise-129/ Wed, 24 May 2023 17:30:03 +0000 https://www.msbiro.net/posts/resolving-podman-log-rotation-issue-conjur-enterprise-129/ This post addresses a log rotation issue seen in CyberArk Conjur 12.9 container deployments running on Podman. Unlike Docker, Podman requires the container to be recreated with the AUDIT_WRITE capability added and a specific permission set on the Nginx log directory for proper log rotation. The resolution was developed collaboratively with CyberArk support and is now documented for future updates. Essential guidance for operators using Podman with Conjur containers. https://www.msbiro.net/posts/sighup-secure-container-how-choose-base-image-security/ Thu, 13 Apr 2023 12:30:03 +0000 https://www.msbiro.net/posts/sighup-secure-container-how-choose-base-image-security/ This post discusses how to choose the right OCI base image for your workloads, emphasizing the importance of security, vulnerability management, and timely updates. It showcases SIGHUP’s Secure Containers service, which offers a curated, proactively patched container catalog with support, SLAs, and automation benefits to help teams maintain secure, compliant container supply chains. https://www.msbiro.net/posts/new-job-devsecops-teamleader/ Wed, 25 May 2022 11:30:03 +0000 https://www.msbiro.net/posts/new-job-devsecops-teamleader/ Starting May 16, 2022, I embarked on a new journey as Senior DevSecOps Engineer at SIGHUP. This post marks the beginning of a shift towards cloud-native infrastructure security topics, including tools like CyberArk Conjur. While previous content remains available, expect fresh insights into securing modern cloud environments. My role as organizer of the LetsConnect user group continues, and I look forward to connecting at upcoming events.