Join us

ContentUpdates and recent posts about Sigstore..
Link
@faun shared a link, 1 year, 1 month ago
FAUN.dev()

Impromptu disaster recovery

K3s reconciler threw a fit. A botched YAML reformat doubled up resources and obliterated the author’s cluster, courtesy of the clumsy hands of language models. It’s a vivid postcard from the island of LLM limitations. Luckily, Hetzner’s system rebuild stepped in to save the day. But it wasn’t painle.. read more  

Impromptu disaster recovery
Link
@faun shared a link, 1 year, 1 month ago
FAUN.dev()

v1.33: From Secrets to Service Accounts: Image Pulls Evolved

Kubernetes drops ephemeral KSA tokens into the mix for image pulls, putting long-lived credentials in the rearview mirror. Granular access? Absolutely rocks. Compliance? Consider it handled... read more  

Link
@faun shared a link, 1 year, 1 month ago
FAUN.dev()

How to build small and secure Docker images for Rust (FROM scratch)

This Dockerfile allows for the creation of minimal and secure Docker images for Rust projects. It utilizes multi-stage builds to avoid unnecessary dependencies and reduces the size of the final image... read more  

Link
@faun shared a link, 1 year, 1 month ago
FAUN.dev()

v1.33: Streaming List responses

Kubernetesunleashed a game-changer:streaming encoding for List responses. What used to hog70-80GBnow zips by on a sleek3GB. That's a20x improvementin memory conservation. Say goodbye to those aggravating Out-of-Memory errors. This upgrade tackles mammoth datasets while babysitting your cluster's sta.. read more  

v1.33: Streaming List responses
Link
@faun shared a link, 1 year, 1 month ago
FAUN.dev()

From Edge to Enterprise: The StarlingX Advantage

StarlingXtackles low-latency like a boss, perfect for edge and enterprise clouds. It weaves together real-time Linux and OVS DPDK, all while juggling up to5,000 nodes. It scales effortlessly, sprinting from humblesingle-nodesetups to sprawlingtens-of-thousandsin multi-region clouds. Timing precision.. read more  

From Edge to Enterprise: The StarlingX Advantage
Link
@faun shared a link, 1 year, 1 month ago
FAUN.dev()

v1.33: Fine-grained SupplementalGroups Control Graduates to Beta

Kubernetes v1.33 rolls in a snazzy beta feature: control over supplemental group merging in containers. It sharpenssecurityby exposing those sneaky implicit GIDs. But don't get too cozy—this power comes with strings. You’ll need CRI runtimes that play nice, or your pods will get the boot on unsuppor.. read more  

Link
@faun shared a link, 1 year, 1 month ago
FAUN.dev()

Major Updates to VS Code Docker: Introducing Container Tools

Dockertransforms intoContainer Tools, handing developers the keys to tool customization and runtime selection. A pivotal shift for those who dwell in the land of containers... read more  

Major Updates to VS Code Docker: Introducing Container Tools
Link
@faun shared a link, 1 year, 1 month ago
FAUN.dev()

Uber’s Journey to Ray on Kubernetes

Uber tossed manual ML resource wrangling for a slick Kubernetes-Ray duo, amping up scalability and slashing inefficiencies.With dynamic resource pools, elastic sharing, and smart scheduling, they rev up utilization and demolish GPU waste—no micromanaging required... read more  

Uber’s Journey to Ray on Kubernetes
Link
@faun shared a link, 1 year, 1 month ago
FAUN.dev()

Microservices Are a Tax Your Startup Probably Can’t Afford

Premature microservicesare like planting seeds in concrete. They'll stall your startup's momentum. A monolith is your friend here—simple, reliable, with the vast realm of open-source at your disposal. A crispmonorepotightens team synergy and sidesteps the quagmire of complexity, unlike those headach.. read more  

Microservices Are a Tax Your Startup Probably Can’t Afford
Link
@faun shared a link, 1 year, 1 month ago
FAUN.dev()

Cutting Kubernetes Costs with kube-downscaler

kube-downscaleris your go-to for scheduling time-based scaling inKubernetes. It dodges HPA’s hiccups for pre-planned workloads. Imagine cron jobs but for replicas. Straightforward, effective, and perfect for trimming costs on snoozing dev environments... read more  

Cutting Kubernetes Costs with kube-downscaler
Sigstore is an open source initiative designed to make software artifact signing and verification simple, automatic, and widely accessible. Its primary goal is to improve software supply chain security by enabling developers and organizations to cryptographically prove the origin and integrity of the software they build and distribute.

At its core, sigstore removes many of the traditional barriers associated with code signing. Instead of managing long-lived private keys manually, sigstore supports keyless signing, where identities are issued dynamically using OpenID Connect (OIDC) providers such as GitHub Actions, Google, or Microsoft. This dramatically lowers operational complexity and reduces the risk of key compromise.

The sigstore ecosystem is composed of several key components:

- Cosign: A tool for signing, verifying, and storing signatures for container images and other artifacts. Signatures are stored alongside artifacts in OCI registries, rather than embedded in them.

- Fulcio: A certificate authority that issues short-lived X.509 certificates based on OIDC identities, enabling keyless signing.

- Rekor: A transparency log that records signing events in an append-only, tamper-evident ledger. This provides public auditability and detection of suspicious or malicious signing activity.

Together, these components allow anyone to verify who built an artifact, when it was built, and whether it has been tampered with, using publicly verifiable cryptographic proofs. This aligns closely with modern supply chain security practices such as SLSA (Supply-chain Levels for Software Artifacts).

sigstore is widely adopted in the cloud-native ecosystem and integrates with tools like Kubernetes, container registries, CI/CD pipelines, and package managers. It is commonly used to sign container images, Helm charts, binaries, and SBOMs, and is increasingly becoming a baseline security requirement for production software delivery.

The project is governed by the OpenSSF (Open Source Security Foundation) and supported by major industry players.