Topic · 9 articles

Tutorial.

Step-by-step technical guides on Kubernetes, MCP server hardening, container security, and runtime enforcement — recent, specific, and tested on real infrastructure.

These tutorials cover changes that happened recently — migration deadlines, breaking changes, and new defaults that are not yet in most documentation. Each one is a complete walkthrough of something production systems will need to handle, with exact commands and the failure modes to watch for.

TutorialJuly 15, 20269 min read

Generate an SBOM with Syft, Filter Grype with VEX

Generate a CycloneDX SBOM with Syft, scan it with Grype, and suppress non-exploitable CVEs with VEX not_affected statements in your CI gate.

TutorialJune 29, 20267 min read

Cosign v3 Breaking Changes: Sign, Verify, Fix Harbor

Cosign v3 flips three flags on by default and breaks Harbor detection. Here are the fallback flags that keep CI signing and verification working.

TutorialJune 14, 20268 min read

Fission CVE-2026-50566: Stop the Container Escape

Find, patch, and block the CVSS 9.9 Fission container escape (CVE-2026-50566) on Kubernetes with version 1.24.0, Pod Security Standards, and a Kyverno rule.

TutorialJune 12, 20268 min read

GR00T N1.7's ZMQ Port Is an Open Robot Remote Control

The default Isaac GR00T N1.7 inference server binds to 0.0.0.0:5555 with no auth. Here is how to lock it to loopback behind mutual TLS.

TutorialJune 10, 202610 min read

npm allowScripts warning: fix "install scripts not covered" before npm 12

Run npm approve-scripts --allow-scripts-pending to list every pending package, then approve each one. npm 12 turns this warning into a hard install failure in July 2026.

TutorialJune 8, 20267 min read

Tetragon 1.7 Runtime Enforcement: Block Processes in the Kernel

Build a Tetragon TracingPolicy that kills a process at the kernel before it reads a secret, plus the CONFIG_BPF_KPROBE_OVERRIDE gotcha that breaks it.

TutorialJune 7, 20268 min read

Migrate Ingress-NGINX to Gateway API Before Retirement

A hands-on 2026 guide to migrating off the retiring Ingress-NGINX to the Gateway API with ingress2gateway 1.0 and Envoy Gateway, including the annotations that silently drop.

TutorialJune 6, 20267 min read

Kubernetes User Namespaces GA: hostUsers false Node Prep

Kernel 6.3 (not 5.12), containerd 2.0+, and /etc/subuid setup for Kubernetes 1.36 user namespaces. Covers the silent failures that cost you an afternoon.

TutorialJune 6, 20267 min read

Harden MCP Servers Against Tool Poisoning

A practical 2026 guide to securing MCP servers: inspect tool descriptions, scan for poisoning, pin versions against rug pulls, and add a runtime guardrail.

Browse other topics

Cloud 1 DevOps 1 Security 14 Tips & Tricks 6

All writing

Subscribe to the Technical Journal

Deep dives into infrastructure, security, and technical leadership. No noise, just engineering rigor. Subscribe and grab the 2026 AI-agent & infrastructure security checklist.