532 posts tagged with "Security"
Cybersecurity, smart contract audits, and best practices
Kubernetes 1.36 Ships User Namespaces to GA: What Rootless Containers Change for Multi-Tenant PaaS Isolation
Kubernetes 1.36 graduates user namespaces to GA, remapping container root to an unprivileged host UID. What that changes for packing multiple tenants on shared bare metal — the CVEs it defuses, the version matrix your fleet must clear, and the shared-kernel risks it does not fix.
Kubernetes v1.36 Ships Admission Policies That Can't Be Deleted: Closing the Bootstrap Window in Your Fleet's Guardrails
Kubernetes v1.36's manifest-based admission control loads policies from files before the API server serves its first request — undeletable via any RBAC. What it forecloses for a multi-tenant self-hosted PaaS, and the Cluster API bootstrap sequencing that makes guardrails live before the first tenant pod.
Your Base Image Is Six Months Stale: Making Renovate's FROM-Line Patching a Self-Hosted PaaS Default
A git-push PaaS rebuilds your app on every push — and never touches the FROM line between pushes. How a platform-run Renovate loop with digest pinning and health-gated automerge bounds base-image staleness from unbounded to about a day, the exact renovate.json to do it, and where the loop still falls short of buildpack rebase.
Webhook Signature Verification for Git-Push Deploys: What a Self-Hosted PaaS Has to Get Right That GitHub's Own Docs Gloss Over
On a git-push PaaS, the webhook endpoint is a remote build trigger — and HMAC verification is its entire security boundary. A 10-point audit checklist covering the raw-body trap, the === timing leak, the timingSafeEqual length-throw, the SHA-1 header ghost, and the replay gap GitHub's docs never assemble into one place.
Nine Seconds, Zero Backups: What the PocketOS Wipe Demands From a PaaS That Doesn't Manage Your Database
A Cursor agent deleted PocketOS's production database and every backup in nine seconds. The real failures were architectural: co-located backups and an omnipotent API token. Here is the backup design that survives a rogue agent — and what a PaaS that doesn't manage your database still owes you.
Why Self-Hosted PaaS Secrets Managers Still Default to Plaintext Env Vars: A Survey of Coolify, Dokploy, and CapRover
Coolify, Dokploy, and CapRover all hand your production credentials to anyone with dashboard access — a feature-by-feature survey of how each stores secrets, why plaintext env vars are an architectural default, and what a Sealed Secrets or External Secrets Operator pattern on Kubernetes buys instead.
The Tailscale Kubernetes Operator Exposes kube-apiserver Without Touching the Public Internet
84% of internet-observable Kubernetes API servers answer to the public internet. The Tailscale operator's API server proxy replaces the IP allowlist with identity-authenticated tailnet access — here is what changes for a self-hosted fleet, what it costs, and what Headscale users shouldn't assume.
CVE-2026-18381: When Your Operator's CRD Field Becomes a Token Exfiltration Bootstrap
A user-editable upload URL in a Red Hat OpenShift operator let anyone with CR edit access steal its service-account token — no exploit needed, just a redirect. Here's the audit checklist for finding the same bug shape in your own operators.
Ingress-NGINX Retired in March 2026 — Here's Exactly What Ingress2Gateway Migrates, and What It Doesn't
Ingress-NGINX officially retired in March 2026. Here's the annotation-by-annotation breakdown of what Ingress2Gateway migrates cleanly to Gateway API, what it can't touch, and why the gaps are riskier for a multi-tenant fleet than a single app.