Tag: security

Outline: The Team Wiki That Needs SSO

Outline has no password login, so self-hosting it means pairing it with an OIDC provider. Here is a working Docker stack with Postgres, Redis, and Dex.

Firewall Rule Audit: Find the Dead Rules

Find unused firewall rules on a Linux box with nftables counters, then retire them safely with a snapshot-and-diff routine, a jq script, and a systemd timer.

Home Lab Threat Model: What's Exposed

Mass scanners find a new home lab IP within hours. Audit what the internet can reach, from UPnP to Docker ports to IPv6, then build a threat model that fits.

Kyverno: K8s Policy Without Rego

Kyverno on k3s: validate, mutate, generate, verify signed images, handle exceptions, and test policies in CI. Plus the CEL policy types replacing ClusterPolicy.

AppArmor Profiles for Docker, Step by Step

Docker puts every container under the docker-default AppArmor profile. See what it blocks, then build a tested nginx profile with audit deny and complain mode.

Catch Your Self-Hosted Apps Phoning Home

Self-hosted is not silent. Audit outbound calls with DNS query logs, watch live connections, block egress with Docker networks, then flip telemetry opt-outs.

Pre-Commit Hooks That Catch Secrets

A secret that reaches git push is already gone. Compare gitleaks, TruffleHog, and detect-secrets as pre-commit hooks, with working configs you can copy.

gVisor vs Firecracker vs Kata for Agents

Letting a coding agent run npm install and arbitrary shell? Compare gVisor, Firecracker, and Kata on startup, KVM needs, Docker fit, and network egress.

Prompt Injection vs Your Coding Agent

Prompt-level defenses against injection are probabilistic and lose to a patient attacker. Here's the capability-level design that holds, with working configs.

Stop Handing CI Jobs Root on Your Box

Self-hosted GitHub Actions, Forgejo, and GitLab runners can hand a forked pull request root on your box. Here is the isolation ladder that actually stops it.

CrowdSec Across a Home Lab: One Brain

One central CrowdSec LAPI, remote log-parsing agents, and bouncers on every box, so an SSH brute-force on one server gets blocked everywhere else too.

Docker MCP Toolkit: Trust the Sandbox?

Docker MCP Toolkit sandboxes AI agent tools in containers. Here's exactly what that isolation stops, where it silently breaks, and how to configure it safely.