security
Hardening, boundaries, and being honest about what a control actually protects.
-
One Local Endpoint for Every Agent Session
An IDE assistant, a terminal agent and a background daemon can each be configured to send code to a different endpoint, and nobody can answer where code actually goes without checking every tool individually. This article routes all of them through one local proxy that logs and can refuse requests, with a complete Docker Compose example and an honest account of what it doesn't guarantee.
-
Treating Issue Bodies as Untrusted Input
An agent that reads issue bodies is reading text a contributor fully controls, and treating that text as instructions is an injection surface no amount of careful wording closes reliably. This article builds a typed action schema that rejects anything a compromised model output might try, and tests the rejection without ever calling a model.
-
From a Large Allowlist to Three Denials: Permissions for a Coding Agent
A command allowlist for an autonomous agent never converges, because the set of legitimate commands a real task needs is not enumerable in advance, and a name-based list is also easy to defeat. This article moves the boundary from command names to blast radius using kernel-level sandboxing, with a runnable script and its trade-offs.
-
Self-Hosted LLM Inference: Serving, Benchmarking and Agent Guardrails
Running models on hardware you own removes a category of decision about where debugging context goes, at the cost of a real gap on the hardest reasoning tasks, and neither fact is worth much without a way to measure it. This covers serving, a repeatable benchmark harness that replaces "it feels smarter" with a number, and the guardrails that have to exist before an agent is allowed near anything that changes state, with runnable code for all three.
-
The Label as Contract: Consent and Priority as the Whole Queue
An autonomous worker that infers permission or priority from an issue's own text is trusting content anyone can write. This covers designing a label as the sole, explicit consent gate for an agent, a deterministic priority order derived from it, and a claim mechanism that survives two runs racing for the same issue, with a complete, testable example.
-
Self-Hosted Identity with Keycloak: Central Offboarding and Forward Auth
Every internal service wants its own user database, and each one becomes a password nobody audits and an account that outlives the employment. Running a central identity provider turns offboarding into one action instead of a checklist, and this walks through why, with a runnable Keycloak setup that proves a single disable call locks a user out at the token endpoint, plus a forward-auth proxy protecting an application with no login of its own.
-
Forward Auth: Putting Real Authentication in Front of Software That Has None
Legacy admin panels, monitoring dashboards and device UIs frequently have no login of their own, yet they are exactly the systems you least want exposed. Forward auth lets a reverse proxy ask an external service, on every request, whether the caller may proceed, without changing a line of the backend. Here is the subrequest protocol, the header-spoofing mistake that undermines it, and a complete Traefik plus Keycloak stack that enforces it.
-
Enforcing Client Identity Alongside Realm Roles
A Keycloak realm role lives on the user, not on the client, so a token minted for a low-trust public application can carry the same role claim as one minted for a trusted backend. This shows how to close that gap in a FastAPI dependency by checking the azp claim against an allow-list alongside the usual signature, issuer and role checks, with a self-contained pytest suite.
-
OIDC Client Shapes: A Token-Validating API Is Not a Login Client
Configuring every OIDC client the same way conflates "users log in here" with "this service validates a token", and the wrong shape accepts flows nobody intended. This article covers the three client shapes and gives working Keycloak configuration plus a Python JWT validator that checks issuer, audience and signature.
-
Realm-as-Code: Reconciling Clients and Roles But Never Users or Signing Keys
Reconciling a Keycloak realm from a file is safe for clients, roles and role mappings, but the same "make live state match this JSON" instinct applied to users or signing keys deletes real accounts and invalidates every outstanding token. This article draws that boundary precisely, and works through a Python script against the Admin REST API that reconciles clients and realm roles idempotently against a local Keycloak container, while proving a second run changes nothing and a user created out-of-band survives every run.
-
External Secrets with Offline JWT Validation When Vault Cannot Reach the Cluster
Vault's default Kubernetes auth method needs to call back into the cluster's API server on every login, which cannot work once Vault and the cluster sit in deliberately isolated networks. Here is how to configure Vault's JWT auth method to validate service-account tokens offline, against a static public key, and wire External Secrets Operator to use it.
-
Overlay Mesh Networking with NetBird: Peer Addressing and the Public DNS Fallthrough
An overlay mesh gives every machine a stable address and a direct encrypted path to every other one, replacing a hub-and-spoke VPN. It also gives internal hostnames a silent way to resolve to the wrong place the moment the mesh resolver is not in the loop. This walks through why, and includes a runnable DNS setup that reproduces the fallthrough and the one-line fix that closes it.
-
Rootless BuildKit: What fuse-overlayfs Costs on a Cold Cache
The standard BuildKit container image needs privileged mode to use the kernel's overlayfs snapshotter, which is unwelcome on a cluster that flags privileged workloads. Rootless BuildKit avoids that by running its snapshotter in userspace via fuse-overlayfs instead, and this article measures, reproducibly, what that substitution costs on a build with a cold cache.
-
Trusting an Internal and a Public Certificate Authority in One Process
Pointing a process at an internal certificate authority by overriding its trust store is the fastest way to make it work, and it silently cuts that same process off from every publicly signed endpoint it also needs to reach, such as an external identity provider. This article shows the difference between replacing a trust store and appending to it, with a Dockerfile and a Python client that get it right.
-
A Confidential OIDC Client That Exists Only to Introspect Tokens
An API that validates access tokens by calling the OAuth2 introspection endpoint has to authenticate to that endpoint itself, and a public client such as a single-page application has no secret to do it with. This article sets up a second, confidential client whose only job is introspection, and gives the full provider configuration and the calls that use it.
-
Auto-Unsealing Vault Without Cloud KMS or a TPM, Using Tang and Clevis
Manual unsealing does not scale once other services depend on Vault being available at boot, but Vault's built-in auto-unseal options assume a cloud KMS, a TPM, or an HSM, none of which fit every environment. This shows how to bind Shamir unseal key shares to a Tang server with Clevis instead, so a host can unseal itself automatically while it is on the expected network, verified end to end including what happens when the Tang server is unreachable.
-
Runtime Secret Injection with a Vault Agent Sidecar and a Wrapped AppRole
Rendering secrets into config files during a deploy leaves plaintext sitting on disk indefinitely and turns every rotation into a redeploy. This sets up a Vault Agent sidecar that authenticates with a single-use, response-wrapped AppRole secret and renders a live secret into a file an application container reads, verified end to end with a complete docker-compose stack.
-
Vault KV-v2: Why put Silently Wipes Every Sibling Field
vault kv put writes a full new version of a KV-v2 secret, so adding one field with put silently deletes every other field that secret held. This works through why put behaves that way, what patch actually does instead, and gives a verified, runnable sequence — including the one safe way to remove a single field without racing another writer.
-
Replacing Distributed SSH Keys with a Vault Certificate Authority
Copying a public key into every host's authorized_keys file does not scale and leaves no record of who was granted access or when. This walks through standing up Vault's SSH secrets engine as a certificate authority, signing short-lived user certificates on demand, and shows a complete, runnable demonstration against a disposable sshd container.
-
Reasserting Kernel Sysctls That Docker Silently Reverts
Docker sets several networking sysctls itself whenever it starts or creates a bridge network, and it does so after boot-time hardening has already run, overwriting values you set on purpose. This walks through which values move, why systemd-sysctl cannot protect you, and a small systemd unit that reasserts the values after Docker has finished starting.
-
Migrating the SSH Port Mid-Playbook Without Locking Ansible Out
Changing sshd's port during provisioning severs Ansible's own control connection unless the validation, restart, connection update and firewall change happen in the right order. Here is that order, and the two guards that make it safe to re-run.