Tag: devops

Cosign keyless signing uses GitHub OIDC + Fulcio + Rekor to sign container images without managing private keys. Here's how it actually works and why you want it.

Orchestrating multi-image Docker builds: docker buildx bake vs compose build, matrix targets, multi-arch, caching, and when each one actually wins.

nerdctl is the containerd-native docker CLI replacement — when it's a drop-in, when it's not, and why you'd bother switching at all.

Trivy, Grype, and Docker Scout go head-to-head on speed, CVE coverage, CI integration, and cost. Pick the right scanner for your home lab or pipeline.

Authelia is a bouncer. Authentik is the whole security desk. Pick the right self-hosted SSO for your home lab — with working configs, gotchas, and a migration path.

OpenTelemetry plus the Grafana LGTM stack gives you Datadog-class traces, metrics, and logs for $0/month. Deploy an OTel Collector and instrument your app fast.

K3s, K0s, and MicroK8s all slim down Kubernetes for home labs and edge — but they make very different tradeoffs. Here's how to pick the right one without losing a weekend.

Per-container control over Docker image updates with labels. Auto-update or notify via Discord, Slack, ntfy—no sidecar needed.

You've been compromised. Now what? A practical incident response playbook for self-hosters who didn't think they'd need one until right now.

rsync is not a backup. Restic, Borg, and Kopia do deduplication, encryption, and incremental snapshots properly. Here's which one fits your home lab and why.

A Software Bill of Materials tells you exactly what's in your software. Syft generates one, Grype scans it for CVEs. Together they're your supply chain paper trail.

Jenkins needs a server. GitHub Actions needs GitHub. If you're self-hosting your Git and want CI that doesn't weigh more than the code it's testing, Drone CI and its community fork Woodpecker CI are worth knowing about. One changed its license. The other exists because of that decision.