Quentin Deslandes will speak on 'bpfilter: an eBPF-based firewall for fast packets filtering!' as part of our Kernel & Low Level Systems track at SCaLE 23x. Full details: www.socallinuxexpo.o...

Docker sandboxes now appear to use micro-VMs... Now it's getting interesting :-)

Looks like the hidden TeammateTool in Claude Code is getting a lot of interest... The version I reversed engineered, 2.1.9, unfortunately doesn't have it, but now there's a reason to do it again 🙂

Cool blog about "anti-patterns and patterns for achieving secure generation of code via AI" by the Ralph Loop guy himself ( TLDR: security needs to be deterministic and LLM prompts don't give you that 🙂 ): ghuntley.com/secure-codeg...

Pretty cool... hardened open source container images from the german government container.gov.de , gitlab.opencode.de/open-code/oci

Don't give your LLM a gun if you don't want it to shoot... Asking nicely in the system prompt doesn't work 🙂 The code "Explore" agent from Claude Code code snippet I shared earlier is a good "bad" example of that.

Cool follow up post about the design behind the Sprites agent sandboxes from Fly dot IO (from Thomas Ptacek himself :-)) fly.io/blog/design-...

The code "Explore" agent from the reverse engineered Claude Code (much bigger system prompt compared to "Bash" :-))

A snippet of the reverse engineered Claude Code showing its "Bash" agent (one of the smallest system prompts in CC :-))

if you want to learn about Manus AI sandboxing... I know I do 🙂 manus.im/blog/manus-s...

Pretty cool, sandboxes from Fly dot IO sprites.dev

Reverse engineering Claude Code is a fun way to start the new year 🙂 It's the biggest AI coding agent out there and it's a Bun app compiled to an executable. A teaser 😉 ripgrep.node resvg.js tree-sitter.js ripgrep.js ripgrep.node resvg.wasm tree-sitter.wasm ...

What if you could make your container vulnerabilities disappear... so you can later exploit them whenever you want 😉 I'll show what it looks like at Besides Seattle this February

Interesting to hear someone (not a rando) saying that "AI guardrails don't work" (so all those AI Security companies selling guardrails are selling snake oil. He didn't say this part out loud :-)) www.youtube.com/watch?v=J998...

If you are building AI agents in Rust, Skreaver is a pretty cool project to check out. It aims to be the Tokio of agent systems.

In the battle of autonomous coding agents between Github Copilot and Google Jules fixing a bug in #DockerSlim , GitHub Copilot won while Jules got lost so many times before coming up with anything relevant 🙂

Want to be prepared for #Kubernetes 1.35 next week? Check out the @rawkode.academy 1.35 Cheatsheet!

Wonder why I mentioned React2shell... Those vulnerable Next.js apps often run in containers and guess what happens to the exploits if those containers are Minted and reinforced with what I've built 😉 Powered by #DockerSlim tech.

Pretty nice video about React2Shell from Theo, the big Next.js vulnerability that's making its rounds: www.youtube.com/watch?v=UiCE... It also show the fundamentally different approach from developers vs security people to the security vulnerabilities.

Is there anything interesting going on with Next.js ;)

MinIO's community edition is now in maintenance mode. Silent license changes. $96K paywalls. Locked GitHub threads. Abandoned Docker images during a critical CVE. A masterclass in how NOT to sunset an open source project. SeaweedFS, your time is now.

Funny that there are more vendors trying to sell you stuff around MCP than the actual MCP Server users :-)

The #KubeCon / #CloudNativeCon in Atlanta was super exciting! Demo'ed the new Podman container runtime support minifying container images with #DockerSlim (now #PodmanSlim :-)) Here's a short demo version:

SCaLE is the most family friendly conference I've ever been to I regularly bring my kids (Saturday night is game night) and there are parents in the audiences with strollers. SCaLE is a community, and we do our best to make sure everyone is welcome

FYI: most of the #kubecon #cloudnativecon NA videos are up on youtube, should hopefully be all there by end of next week! www.youtube.com/@cncf/videos

I wish the ContribFest sessions at KubeCon were longer... Not enough time to do anything significant. And this year in Atlana they were super short or, at least, it felt like it 🙂

Come hear me talk about building modular platforms tomorrow at 3! sched.co/27Faa

Today at #KubeCon we demystified building AI-assisted DevOps tools. The LLM prompts don't need to be uber fancy. Don't need a lot of tools. It can be kubectl CLI wrapped in a tool object. MCP servers have their place, but they can't be thin API wrappers because LLMs will struggle to use those.

"Where’s My Pod? End-to-End Tracing for Kubernetes With OpenTelemetry - Artem Tkachuk & JP Phillips, Netflix" - one of the select few talks I hope to attend during #KubeCon in Atlanta - kccncna2025.sched.com/event/27FaO

The first day of #KubeCon is today :-) The kids workshops are very cool!

AWS Deprecates Two Dozen Services (Most of Which You've Never Heard Of) #devopsish

If you don't know about Iximiuz Labs, you are missing out. You get lots of playgrounds with different Cloud-Native tools, challenges & more. We'll be using the Labs to accelerate building the new capabilities for #DockerSlim, so we can Mint awesome containers the easy way labs.iximiuz.com

📣Call for Volunteers: If you'd like to help with setup or be a friendly face welcoming folks at #Rejekts2025 Atlanta on Nov 8, please sign up here & we'll be in touch👉🏽 forms.gle/R1sSnytKmMXB... 🗒️Please note that tasks will be assigned based on the event's needs and may vary from your preferences.

📣VENUE ANNOUNCEMENT: #Rejekts2025 Atlanta will be held at The Historic Academy of Medicine located within Georgia Institute of Technology.🎓 We're looking forward to the academic atmosphere, full length & lightning talks + fantastic exchange of ideas on Nov 8! To register👉🏽 pretix.eu/rejekts/reje...

Looking forward to my hands on KubeCon session in Atlanta! Join me even if you don't care about #DockerSlim 🙂 We'll get to learn about building AI assistant & MCP server capabilities in #Golang applications. We'll turn Ivan's Iximiuz Labs into Mint Containers Labs for this session to start asap

The new remote code execution in Redis is fun (aka RediShell). Let's see what minifying the Redis container with DockerSlim and its auto-generates seccomp profile will do to mitigate the exploits 🙂

Should've been at #ContainerDays this year... Looks like slimming containers came up in the discussions there :)

We’re back again… with the new Go release 😎

Running apps/code in a sandbox always requires you to run extra commands or write sandbox API glue code... What if you didn't have to... what if you could run an app in a sandbox without doing anything special simply by running the app the same way you normally do...

📣PSA: Registration for #Rejekts2025 Atlanta is now open!🎉 Keep in mind this time Rejekts is a one-day event that will be held on Nov 8. As with previous events, registration is free😊 To register👉🏽 pretix.eu/rejekts/reje...

fun reverse engineering bun.js app binaries... it's not as bad as I thought it would be even manually without extra tools :-)

It feels like sandboxing in AI is starting to approach the vector databases buzz at its peak... New options pop up every day, hard to keep up

I keep bumping into more and more AI app/agent sandboxing, ephemeral deployment and observability use cases with an experimental version of DockerSlim/Mint that runs code in local or remote environments. What are good/popular cloud sandbox environments people use/like?

Now that SEP-1391 introduces async tool calls in MCP can we officially forget about A2A :-)

interesting... the npm saga continues and it appears even CrowdStrike's npm packages are impacted

The schedule for #Rejekts2025 Atlanta is out👉🏾 cfp.cloud-native.rejekts.io/cloud-native... Congrats to those who made it. We look forward to a great time with the community in Atlanta! 🤗

Looking forward to #KubeCon / #CloudNativeCon in Atlanta & exploring/building integrated AI Assistant and MCP Server capabilities in #DockerSlim . Join the session even if you don't care about the project if you're curious about learning more about building AI Assistants and MCP Servers in #Golang 🙂

Looks like the talk about minimal base container images, "Move Over Chainguard: We’re Building Our Own Minimal Images", isn't going to make it to the Rejekts conference either, which means there'll be more time to work on it 🙂 Happy to do a hallway track preview for it at KubeCon in Atlanta!

Our "Move Over Chainguard: We’re Building Our Own Minimal Images" KubeCon talk got rejected (too many great talks to choose from, so i'm not surprised) Who still wants to see this talk :-)

a bit of trivia ( #golang and AI agent related)... guess what value ends up in MainConfig.KeyOne (and why) when the YAML config file is loaded and guess how confused Gemini CLI and even Claude Code were with it 🙂