Join us

ContentUpdates and recent posts about Sigstore..
Link
@devopslinks shared a link, 6ย months, 2ย weeks ago
FAUN.dev()

CVE-2025-49844 - The Redis CVSS 10.0 vulnerability and how we responded

Report URI closed the door on Redis CVE-2025-49844 fast. They rolled out ACL-based command blocks and jumped to Redis8.2.2, now running on a freshRedis Sentinel-based HA setup. To prove the fix stuck, they ran command counter checks and layered in enforced blocking rulesโ€”then pushed it all out fleet.. read more ย 

CVE-2025-49844 - The Redis CVSS 10.0 vulnerability and how we responded
Link
@kaptain shared a link, 6ย months, 2ย weeks ago
FAUN.dev()

A fully functional Kubernetes cluster with 1 million active nodes.

Pushing Kubernetes to 1M nodes isnโ€™t just hardwareโ€”it's architectural judo. Networking flips to exclusive IPv6.Less chatter, more breathing room. etcd hits a wall.Write throughput stalls at scale, so they swap it out. Entermem_etcd, a Rust-built replacement pushing over 1M buffered writes per second.. read more ย 

A fully functional Kubernetes cluster with 1 million active nodes.
Link
@kaptain shared a link, 6ย months, 2ย weeks ago
FAUN.dev()

Debug Builds with Visual Studio Code

Docker droppedBuildx debuggingfor VS Code. Set breakpoints in your Dockerfiles. Peek into image layers. Even jump into an interactive shell mid-build. It runs on theDebug Adapter Protocol, so editors likeNeovimandJetBrains IDEscan join the party too... read more ย 

Debug Builds with Visual Studio Code
Link
@kaptain shared a link, 6ย months, 2ย weeks ago
FAUN.dev()

Connect Codex to MCP Servers via MCP Toolkit

OpenAI Codex just leveled up. It now hooks into Dockerโ€™sModel Context Protocol (MCP) Toolkit, which means it can tap directly into 200+ infrastructure toolsโ€”likeNeo4j graph databasesโ€”as if they were built-in features. With MCP, Codex doesnโ€™t just code. It runs containers, spins up data models, eats .. read more ย 

Connect Codex to MCP Servers via MCP Toolkit
Link
@kaptain shared a link, 6ย months, 2ย weeks ago
FAUN.dev()

Announcing Istio 1.27.2

Istio 1.27.2 locks down TLS secret access in Gateway API mode. Now, both the namespace and service account have to match. No more half-matching your way in. It also drops the install order dependency betweenistioctlโ€™s pilot and CNI. You can now install those in whatever order your chaos-loving soul .. read more ย 

Announcing Istio 1.27.2
Link
@kaptain shared a link, 6ย months, 2ย weeks ago
FAUN.dev()

Hardened Images: crafted by humans, protected by AI

Docker just wired anAI guardrailstraight into its Hardened Image (DHI) pipeline. It scans upstream diffs, catches regressions before they ship, and stops bad logic in its tracks. Case in point: it flagged a logic bug that slipped past the usual coding copilots. A real fix landed upstream. Win for cu.. read more ย 

Hardened Images: crafted by humans, protected by AI
Link
@kaptain shared a link, 6ย months, 2ย weeks ago
FAUN.dev()

How to Allocate Kubernetes Resource Ownership

Resource ownership in Kubernetes isnโ€™t just a nice-to-have anymoreโ€”itโ€™s turning into table stakes. Teams are usingnamespaces, RBAC, labels, quotas, and admission controllersto draw clear lines around who owns what, how much they can use, and what rules they follow. Tools likeKyverno,LimitRanges, and.. read more ย 

How to Allocate Kubernetes Resource Ownership
News FAUN.dev() Team
@kaptain shared an update, 6ย months, 2ย weeks ago
FAUN.dev()

Mirantis Launches Pelagia for Enhanced Ceph Management on Kubernetes

#open so...ย  #pelagiaย  #cephย  #rookย  #kuberne...ย 
Rook Pelagia Kubernetes Ceph

Mirantis introduces Pelagia, an open source tool to streamline Ceph storage management on Kubernetes, advancing automation and integration with GitOps workflows.

News FAUN.dev() Team
@kaptain shared an update, 6ย months, 2ย weeks ago
FAUN.dev()

Mirantis Releases k0rdent 1.2.0 - The Open Source Distributed Container Management Platform

Kubernetes k0rdent

Mirantis releases k0rdent 1.2.0, advancing Kubernetes management with new features, ARM64 support, and improved observability using OpenTelemetry.

Mirantis Releases k0rdent 1.2.0 - The Open Source Distributed Container Management Platform
Story
@laura_garcia shared a post, 6ย months, 3ย weeks ago
Software Developer, RELIANOID

๐—ฅ๐—˜๐—Ÿ๐—œ๐—”๐—ก๐—ข๐—œ๐—— ๐—ถ๐˜€ ๐——๐—ข๐—ฅ๐—”-๐—ฟ๐—ฒ๐—ฎ๐—ฑ๐˜†! ๐Ÿš€

Weโ€™re proud to announce our compliance with the ๐—˜๐—จ ๐——๐—ถ๐—ด๐—ถ๐˜๐—ฎ๐—น ๐—ข๐—ฝ๐—ฒ๐—ฟ๐—ฎ๐˜๐—ถ๐—ผ๐—ป๐—ฎ๐—น ๐—ฅ๐—ฒ๐˜€๐—ถ๐—น๐—ถ๐—ฒ๐—ป๐—ฐ๐—ฒ ๐—”๐—ฐ๐˜ (๐——๐—ข๐—ฅ๐—”) โ€” ensuring our solutions meet the highest standards of ๐˜€๐—ฒ๐—ฐ๐˜‚๐—ฟ๐—ถ๐˜๐˜†, ๐—ฟ๐—ฒ๐˜€๐—ถ๐—น๐—ถ๐—ฒ๐—ป๐—ฐ๐—ฒ, ๐—ฎ๐—ป๐—ฑ ๐—ผ๐—ฝ๐—ฒ๐—ฟ๐—ฎ๐˜๐—ถ๐—ผ๐—ป๐—ฎ๐—น ๐—ฐ๐—ผ๐—ป๐˜๐—ถ๐—ป๐˜‚๐—ถ๐˜๐˜† for the financial sector. Our load balancing technology helps financial institutions achieve cyber resi..

dora compliant RELIANOID
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.