Containers · 8 min
Hardening container images without slowing your pipeline
Distroless bases, digest pins, and a scan policy that fails the build only when the finding is reachable — not when the CVE feed is loud.
Read →Cloud Security / DevOps / Data Protection
Engineering notes on the systems that keep data safe.
I’m a security architect writing long-form, implementation-level articles on DevOps, containers, and DSPM/DLP. No noise — just the ideas that actually ship.
- DevOps
- Containers
- DSPM / DLP
- Cloud Security
~/notes/posture.sh
$ scan --scope cluster --fail-on highscanning 42 workloads · 6 namespaces✓ image digest pinned 38/42! privileged containers 2✗ secrets in env 1$ kubectl get ns --show-labelsNAME STATUS AGEprod Active 412dbuild Active 89d$ dlp policy diff --from main+ block exfil via object store~ classify unstructured at restposture score 72 → 81
12+
Years
4
Domains
6
Articles
Latest writing
View all articlesDSPM / DLP · 11 min
What DSPM actually measures in a Kubernetes estate
Classification without inventory is a dashboard. Map stores, identities, and egress paths first — then the DLP rule has somewhere to live.
Read →DevOps · 9 min
Policy as code that security and platform teams both keep
OPA and Kyverno only work when the exception path is a pull request with an expiry. Otherwise you have a wiki with YAML.
Read →Explore by topic
DevOps
Pipelines, policy as code, and the controls that survive a real release train.
Containers
Image hardening, runtime isolation, and Kubernetes posture that does not stall delivery.
DSPM / DLP
Finding shadow data, classifying it, and stopping exfil without breaking the business.
Cloud Security
Identity, blast radius, and the control planes that actually decide who can take the data.
Built, broken, documented.
Twelve years across cloud, containers, and data protection. I write up the designs that survived contact with production — and the ones that did not.