Migration guides and published scan data. Every command and figure here can be re-run against the public repo.
Our redis-slim build has declared SSPL-1.0 since it was created in January. Redis stopped being SSPL-only in May. The field was correct on day one, which is how it stayed wrong for nine months.
43% of our images scan clean. One of the rest has 132 unique CVEs. Both numbers are honest; the gap is about what the scanner can see, not how carefully either image was built.
An automated CVE patcher bumped a module nobody had a vulnerability in, and four builds broke the same way. Harmonizing a dependency family's versions is not the same thing as patching one.
KRaft, Log4j 2, a renamed StorageTool class: Kafka 4.x changed four things upgraders hit blind, because the errors don't mention that a major version happened.
Most CI failures in a dependency-heavy pipeline are someone else's outage wearing a convincing error message. How to classify one in about two minutes before you start debugging.
Distroless images remove the shell an attacker would use, and the one you would use. Here are the techniques that still work, in the order you should reach for them.
Almost every non-root container failure is one of four things. What each looks like, why the fix is not chmod 777, and how to make a directory writable in the image itself.
A clean Grype report can mean your image is clean, or it can mean the scanner never identified the software inside it. Here is the difference, and how to tell which one you have.
What actually breaks when you move a container image to Minimal: the missing shell, the non-root UID, and the tag you should not have pinned. With the commands to verify what you pulled.
Subscribe via RSS.
