Topic · 13 articles

Tutorial.

Step-by-step technical guides on Kubernetes, MCP server hardening, container security, and runtime enforcement. Recent, specific, and tested on real infrastructure.

These tutorials cover changes that happened recently: migration deadlines, breaking changes, and new defaults that are not yet in most documentation. Each one is a complete walkthrough of something production systems will need to handle, with exact commands and the failure modes to watch for.

TutorialSeptember 3, 202612 min read

Fix "Xid 154, GPU recovery action changed" on GPU Nodes

Read the hex in the Xid 154 line to tell an nvidia-smi -r reset from a node reboot, and stop dcgm-exporter from hiding the Xid that actually failed.

TutorialAugust 23, 202611 min read

npm approve-scripts vs --allow-scripts: pick the right flag

Run npm approve-scripts inside a project and --allow-scripts only for global installs. Which flag, in what order, and what to commit to package.json.

TutorialAugust 23, 202610 min read

npm allowScripts: the package.json Schema, Not .npmrc

Set allowScripts in package.json to approve npm install scripts: exact schema, pinned vs name-only keys, why ignore-scripts wins, and what .npmrc holds.

TutorialAugust 18, 20269 min read

Fix "unrecognized format int32" in Kubernetes 1.34

Kubernetes 1.34 warns 'unrecognized format int32' on valid CRDs. It's a kube-apiserver false positive, not your schema; patch the control plane to fix it.

TutorialJuly 15, 202612 min read

Generate an SBOM with Syft, Filter Grype with VEX

Generate a CycloneDX SBOM with Syft, scan it with Grype, and suppress non-exploitable CVEs with VEX not_affected statements in your CI gate.

TutorialJune 29, 20267 min read

Cosign v3: Sign, Verify, and Fix the Harbor Break

Cosign v3 flips three flags by default and breaks Harbor detection. Get the sign-and-verify loop and the two fallback flags that keep CI working.

TutorialJune 14, 20268 min read

Fission CVE-2026-50566: Stop the Container Escape

Find, patch, and block the CVSS 9.9 Fission container escape (CVE-2026-50566) on Kubernetes with version 1.24.0, Pod Security Standards, and a Kyverno rule.

TutorialJune 12, 202612 min read

GR00T N1.7's ZMQ Port Is an Open Robot Remote Control

The default Isaac GR00T N1.7 inference server binds to 0.0.0.0:5555 with no auth. Here is how to lock it to loopback behind mutual TLS.

TutorialJune 10, 202612 min read

npm allowScripts warning: fix "install scripts not covered" before npm 12

npm allowScripts warning explained. Run npm approve-scripts --allow-scripts-pending, approve what you trust, and set strict-allow-scripts so npm 12 fails loudly.

TutorialJune 8, 202610 min read

Tetragon 1.7 Runtime Enforcement: Block Processes in the Kernel

Build a Tetragon TracingPolicy that kills a process at the kernel before it reads a secret, plus the CONFIG_BPF_KPROBE_OVERRIDE gotcha that breaks it.

TutorialJune 7, 20268 min read

Migrate Ingress-NGINX to Gateway API Before Retirement

A hands-on 2026 guide to migrating off the retiring Ingress-NGINX to the Gateway API with ingress2gateway 1.0 and Envoy Gateway, including the annotations that silently drop.

TutorialJune 6, 20267 min read

Kubernetes User Namespaces GA: hostUsers false Node Prep

Kernel 6.3 (not 5.12), containerd 2.0+, and /etc/subuid setup for Kubernetes 1.36 user namespaces. Covers the silent failures that cost you an afternoon.

TutorialJune 6, 20267 min read

Harden MCP Servers Against Tool Poisoning

A practical 2026 guide to securing MCP servers: inspect tool descriptions, scan for poisoning, pin versions against rug pulls, and add a runtime guardrail.

Browse other topics

AI 5 Checklist 1 Cloud 5 DevOps 15 Hardware 1 Infrastructure 1 Leadership 1 Mobility 1 Robotics 1 Security 18 Tips & Tricks 15

All writing

Subscribe to the Technical Journal

Deep dives into infrastructure, security, and technical leadership. No noise, just engineering rigor. Subscribe and grab the infrastructure security checklist I work from.