Docker
guest@6admin.io:~$ ls ~/tags/docker
Docker has run in a microVM since 2016
MicroVMs are often presented as the new thing that would finally compete with containers. A post on dave.recoil.org is a reminder that Docker Desktop has run its containers inside a minimal VM, built on MirageOS, since 2016. A short editorial on a false debate.
One Blocking Pin, Four CVEs: The Band-Aid That Wins Is the One That Disappears
How a security audit on a Dockerized Foreman stack turned into merged contributions in Foreman core, Dynflow and Jenkins.
Ansible CI Toolkit v1: the year I stopped trusting my own image
The hardened sequel: ansible and ansible-lint merged into one image, Kerberos/WinRM for Windows targets, non-root, base pinned by digest, a pip constraints lock, transitive Galaxy pins and cosign signing. Built by a CHANGELOG that reads like a CVE diary.
A persistent volume is not durable data
After a hard power loss, PowerDNS's MySQL comes back empty. The host records are gone, nobody noticed and the only reason the story ends well is that the source of truth had survived.
The log driver that stopped the container from starting
A dirty power loss, a corrupted Swarm overlay, an internal DNS that no longer resolves and containers that refuse to start because their log driver cannot resolve a name. The anatomy of a cascade and why the real fault was elsewhere.
Docker vs jails, the honest comparison
The recurring FreeBSD-jails-versus-containers debate misses the point, because it pits a badly measured memory footprint against reality instead of talking about isolation, portability and ecosystem.
Containers, micro-VMs and Firecracker: why isolation is not what you think
Containers share the kernel. A container escape is a kernel escape. Firecracker micro-VMs bring hardware isolation at container speed. The chroot and the link are two different things.
Kubernetes, or not
Kubernetes is rarely the right first choice. An honest tour of the floors below it: podman and quadlet on one host, docker-compose, Docker Swarm, then docker or podman with Nomad and Consul and the real threshold where Kubernetes finally earns its keep.
Hardening Docker Swarm
Hardening Docker Swarm: secrets, encrypted overlay network, node roles and the cluster's exposure surface.
Docker hardening
Docker hardening: the daemon, capabilities, mounts and why a container escape is a kernel escape.
Docker Swarm to Kubernetes: why I abandoned Swarm
Swarm works well for small deployments. But no rootless, no CSI, no autoscaling and a MACVLAN pinned to a single node: the four walls that forced the migration.
Scale-to-zero: Sablier wakes Swarm and Kubernetes on demand
Sablier wakes a sleeping container when someone knocks at the reverse proxy, then scales it back to zero. Scale-to-zero on Docker, Swarm and Kubernetes, with the real Traefik config, the two strategies and the true price of handing it the Docker socket.
The :ro flag on the Docker socket protects nothing
Mounting the Docker socket read-only is a reassuring and perfectly useless ritual. The flag acts at the VFS level, the socket speaks network I/O, the two never meet.
One Ansible image for GitLab CI, built right from a Paris basement
Why I stopped using the official Ansible images in CI and built my own on Alpine: multi-stage venv, pinned ansible-core, collections installed at build time. Episode one: the 2022 public release of an image born much earlier, with its honest list of early sins.
PwnMachine: the self-hosted bug bounty workstation
PwnMachine, the Docker-based pentest workstation for bug bounty, with Traefik, PowerDNS and Let's Encrypt.
Docker rootless: the daemon without privileges
Docker in rootless mode, the daemon running as a normal user and why it matters on a multi-tenant server.
Twelve-Factor App: the Heroku method that survived containers
Adam Wiggins's twelve factors, written for Heroku in 2011, remain the best checklist for shipping an application as a service: config in the environment, stateless processes, dev/prod parity, logs as event streams, then their translation into containers and Kubernetes.