If you are starting your dockerized application from an ENTRYPOINT or a CMD you might have noticed that the application simply gets killed after 10 seconds of issuing a docker stop command on the container. This happens because your application does not get a chance to process the SIGTERM signal issued by docker.
There are many solutions, but they also have some shortcomings:
… [Read More]
In the age of the ransomware attacks having a current backup is paramount. But can you have an easy backup procedure and be sure that, even in the event of the full backup server compromise your data is not lost? While there are many backup tools and vendors out there that promise it (e.g. velero/restic/duplicity, see the referecence section belo), they are complicated and/or proprietary, requiring you to trust whoever is providing it.
… [Read More]In its default configuration a docker container has pretty good baseline security. The technology behind containers is mature and time proven (chroot 1979, zones 2004, LXC 2007). Breaking out of one is like breaking out of a VM. Possible, but hard - I’am talking side channels, row hammering, cache busting
… [Read More]A better alternative is to have an internal DNS blackhole, like pi-hole
… [Read More]