Tag: security

Sysbox vs gVisor vs Kata

Containers aren't security boundaries, Sysbox, gVisor, and Kata fix that. Here's which isolation runtime fits your actual threat model.

Trivy vs Grype vs Docker Scout

Trivy, Grype, and Docker Scout go head-to-head on speed, CVE coverage, CI integration, and cost. Pick the right scanner for your home lab or pipeline.

Beyond Akismet: Spam Protection for 2026

Akismet's licensing terms are increasingly hostile to small sites. Here are 11 spam-protection options, hosted APIs, CAPTCHA widgets, and DIY honeypots, that actually work in 2026.

Sec-Fetch & UA Client Hints in 2026: What Actually Leaks

Ran 9 real headless tools against an echo server. Sec-Fetch alone catches almost none of them. Here's what actually leaks, WAF rules that work, and where Anubis fits in.

CrowdSec Collections & Bouncers: fail2ban for 2026

CrowdSec is fail2ban with community threat intel: scenario collections plus pluggable bouncers for Caddy or Traefik. Block millions of bad IPs from day one.

Distroless Images: When Minimal Goes Too Far

Distroless containers are tiny, secure, and loved by security teams, until you need to debug one at 2 AM. Here's when Google distroless actually pays off vs when it's just container hipster points.

Incident Response for Self-Hosters

You've been compromised. Now what? A practical incident response playbook for self-hosters who didn't think they'd need one until right now.

CVE-2026-31431: The 9-Year Linux Root Bug

CVE-2026-31431 (copy.fail) lets any local user become root on virtually every Linux system since 2017. Here's what it is, why it matters, and how to fix it.

OpenCanary: Honeypots for Your Home Lab

A honeypot sits quietly on your network pretending to be valuable. Touch it and you've found an intruder. Deploy OpenCanary in Docker, dead simple.

nftables: Modern Linux Firewalling

iptables is being phased out. nftables is faster, cleaner, and already the default on modern Linux. Here's how to actually use it without wanting to quit.

Suricata vs Snort: Network Intrusion Detection That Actually Works

Snort invented network intrusion detection. Suricata multi-threaded its way past it. Here's how to set up real IDS/IPS on your home lab and actually understand what it's telling you.

SBOMs and Supply Chain Security

A Software Bill of Materials tells you exactly what's in your software. Syft generates one, Grype scans it for CVEs. Together they're your supply chain paper trail.