Anthropic Mythos and its ability to find new vulnerabilities got a lot of buzz... A great way to counter it is to reduce the attack surface removing the software components you don't need, so Mythos can't find zero day vulnerabilities in them. Can't exploit what's not there 🙂

Nice to be able to compare the reverse engineered version of Claude Code with the original source code version 🙂

If you are in Amsterdam for KubeCon this session on Tuesday will be great to see AND it's powered by Ivan's Iximiuz Labs!

This week was a pretty cool Chainguard Assemble event and it was a great reminder that you can't have good Dockerfiles without good base images! But can you "assemble" your own Wolfi-based base container images?

Adding a bit more context to the last post... Full stack reachability isn't just a collection of data from different tools dumped into one place (looking at you ASPM :-))

The AI code tsunami is already here... The software iceberg you are shipping to prod is becoming 10x bigger. And like with regular icebergs you don't see and don't know the biggest and the most dangerous part of it.

The best tutorial out there (and i've seen all of them :-)) if you are interested in understanding the container image internals (and with awesome diagrams, as usual, that makes the tutorial 10x better): "How Container Images Actually Work: Layers, Configs, Manifests, Indexes, and More"

Having a good vulnerability scanner / SBOM generator that produces complete and accurate results AND that's not brittle when it comes to obfuscation and evasion is significantly harder than what the vendors are doing now (but still doable).

Good news... AWS EC2 VMs finally support nested virtualization, which is great for AI sandboxing that uses microVMs like Firecracker (no need for super expensive bare metal instances). Bad news... It's only for the C8i, M8i and R8i EC2 instance types.

So many SomethingSomethingClaw projects and products everywhere 🙂

First time going to Bsides Seattle or any other Bsides! Already got pretty good interest and great questions about the talk on day 1 🙂

And now Google is getting into AI sandboxes reusing and rebranding their existing code execution tech 🙂 github.com/GoogleCloudP...

Quentin Deslandes will speak on 'bpfilter: an eBPF-based firewall for fast packets filtering!' as part of our Kernel & Low Level Systems track at SCaLE 23x. Full details: www.socallinuxexpo.o...

Docker sandboxes now appear to use micro-VMs... Now it's getting interesting :-)

Looks like the hidden TeammateTool in Claude Code is getting a lot of interest... The version I reversed engineered, 2.1.9, unfortunately doesn't have it, but now there's a reason to do it again 🙂

Cool blog about "anti-patterns and patterns for achieving secure generation of code via AI" by the Ralph Loop guy himself ( TLDR: security needs to be deterministic and LLM prompts don't give you that 🙂 ): ghuntley.com/secure-codeg...

Pretty cool... hardened open source container images from the german government container.gov.de , gitlab.opencode.de/open-code/oci

Don't give your LLM a gun if you don't want it to shoot... Asking nicely in the system prompt doesn't work 🙂 The code "Explore" agent from Claude Code code snippet I shared earlier is a good "bad" example of that.

Cool follow up post about the design behind the Sprites agent sandboxes from Fly dot IO (from Thomas Ptacek himself :-)) fly.io/blog/design-...

The code "Explore" agent from the reverse engineered Claude Code (much bigger system prompt compared to "Bash" :-))

A snippet of the reverse engineered Claude Code showing its "Bash" agent (one of the smallest system prompts in CC :-))

if you want to learn about Manus AI sandboxing... I know I do 🙂 manus.im/blog/manus-s...

Pretty cool, sandboxes from Fly dot IO sprites.dev

Reverse engineering Claude Code is a fun way to start the new year 🙂 It's the biggest AI coding agent out there and it's a Bun app compiled to an executable. A teaser 😉 ripgrep.node resvg.js tree-sitter.js ripgrep.js ripgrep.node resvg.wasm tree-sitter.wasm ...

What if you could make your container vulnerabilities disappear... so you can later exploit them whenever you want 😉 I'll show what it looks like at Besides Seattle this February

Interesting to hear someone (not a rando) saying that "AI guardrails don't work" (so all those AI Security companies selling guardrails are selling snake oil. He didn't say this part out loud :-)) www.youtube.com/watch?v=J998...

If you are building AI agents in Rust, Skreaver is a pretty cool project to check out. It aims to be the Tokio of agent systems.

In the battle of autonomous coding agents between Github Copilot and Google Jules fixing a bug in #DockerSlim , GitHub Copilot won while Jules got lost so many times before coming up with anything relevant 🙂

Want to be prepared for #Kubernetes 1.35 next week? Check out the @rawkode.academy 1.35 Cheatsheet!

Wonder why I mentioned React2shell... Those vulnerable Next.js apps often run in containers and guess what happens to the exploits if those containers are Minted and reinforced with what I've built 😉 Powered by #DockerSlim tech.

Pretty nice video about React2Shell from Theo, the big Next.js vulnerability that's making its rounds: www.youtube.com/watch?v=UiCE... It also show the fundamentally different approach from developers vs security people to the security vulnerabilities.

Is there anything interesting going on with Next.js ;)

MinIO's community edition is now in maintenance mode. Silent license changes. $96K paywalls. Locked GitHub threads. Abandoned Docker images during a critical CVE. A masterclass in how NOT to sunset an open source project. SeaweedFS, your time is now.

Funny that there are more vendors trying to sell you stuff around MCP than the actual MCP Server users :-)

The #KubeCon / #CloudNativeCon in Atlanta was super exciting! Demo'ed the new Podman container runtime support minifying container images with #DockerSlim (now #PodmanSlim :-)) Here's a short demo version:

SCaLE is the most family friendly conference I've ever been to I regularly bring my kids (Saturday night is game night) and there are parents in the audiences with strollers. SCaLE is a community, and we do our best to make sure everyone is welcome

FYI: most of the #kubecon #cloudnativecon NA videos are up on youtube, should hopefully be all there by end of next week! www.youtube.com/@cncf/videos

I wish the ContribFest sessions at KubeCon were longer... Not enough time to do anything significant. And this year in Atlana they were super short or, at least, it felt like it 🙂

Come hear me talk about building modular platforms tomorrow at 3! sched.co/27Faa

Today at #KubeCon we demystified building AI-assisted DevOps tools. The LLM prompts don't need to be uber fancy. Don't need a lot of tools. It can be kubectl CLI wrapped in a tool object. MCP servers have their place, but they can't be thin API wrappers because LLMs will struggle to use those.

"Where’s My Pod? End-to-End Tracing for Kubernetes With OpenTelemetry - Artem Tkachuk & JP Phillips, Netflix" - one of the select few talks I hope to attend during #KubeCon in Atlanta - kccncna2025.sched.com/event/27FaO

The first day of #KubeCon is today :-) The kids workshops are very cool!

AWS Deprecates Two Dozen Services (Most of Which You've Never Heard Of) #devopsish

If you don't know about Iximiuz Labs, you are missing out. You get lots of playgrounds with different Cloud-Native tools, challenges & more. We'll be using the Labs to accelerate building the new capabilities for #DockerSlim, so we can Mint awesome containers the easy way labs.iximiuz.com

📣Call for Volunteers: If you'd like to help with setup or be a friendly face welcoming folks at #Rejekts2025 Atlanta on Nov 8, please sign up here & we'll be in touch👉🏽 forms.gle/R1sSnytKmMXB... 🗒️Please note that tasks will be assigned based on the event's needs and may vary from your preferences.

📣VENUE ANNOUNCEMENT: #Rejekts2025 Atlanta will be held at The Historic Academy of Medicine located within Georgia Institute of Technology.🎓 We're looking forward to the academic atmosphere, full length & lightning talks + fantastic exchange of ideas on Nov 8! To register👉🏽 pretix.eu/rejekts/reje...

Looking forward to my hands on KubeCon session in Atlanta! Join me even if you don't care about #DockerSlim 🙂 We'll get to learn about building AI assistant & MCP server capabilities in #Golang applications. We'll turn Ivan's Iximiuz Labs into Mint Containers Labs for this session to start asap

The new remote code execution in Redis is fun (aka RediShell). Let's see what minifying the Redis container with DockerSlim and its auto-generates seccomp profile will do to mitigate the exploits 🙂

Should've been at #ContainerDays this year... Looks like slimming containers came up in the discussions there :)