Building a Docker image often involves installing packages or downloading code, and if you’re installing private code you often need to gain access with a secret: a password, a private key, a token. You don’t want those secrets to end up in the final image, though; if it’s in the image, anyone with access to the image can extract it. Unlike docker run, which supports environment variables (-e) and volumes, docker build has traditionally never had a good solution for securely using secrets. So how do you use build secrets in Docker without leaking them? In this article you’ll learn: Some seemingly reasonable but actually insecure or problematic solutions. The easy solution, if you can use modern Docker features. The sneaky, backwards-compatible solution: getting secrets in through the network. Other potential approaches. (Preventing leaking other kinds secrets, like runtime secrets, is covered in a different article.)

Thoughts on the Elixir language and its Phoenix framework after two years of professional work.

The Need for Continuous Communication in Software Development

👆 A good quality code can be characterized as clean, efficient, and reliable. Learn more about code quality metrics ⤴️

TL;DR I set out to build the smallest container image that I could that was still able to do something useful. By taking advantage of multistage builds, the scratch base image, and a tiny assembly based http server, I was able to get it down to 6.32kB!

Tutorial on building slim docker images using multstage docker builds.

Everything from your fridge to your tractor can change without your permission.

The law enforcement arm of the U.S. Postal Service has been quietly running a program that tracks and collects Americans’ social media posts, including those about planned protests, according to a document obtained by Yahoo News.

The kernel's BPF virtual machine is versatile; it is possible to load BPF programs into the kernel to carry out a large (and growing) set of tasks. The growing body of BPF code can reasonably be thought of as kernel code in its own right. But, while the kernel can check signatures on loadable modules and prevent the loading of modules that are not properly signed, there is no such mechanism for BPF programs; any sufficiently privileged process can load any program that will pass the verifier. One might think that adding this checking for BPF would be straightforward, but that subsystem has some unique characteristics that make things more challenging than one might expect. There may be a solution in the works, though; fittingly, it works by loading yet another BPF program.

Should you switch to Alpine Linux? If so, why? Let us take an in-depth look and do a Alpine Linux vs Ubuntu comparison.

Americans don’t reckon with history well, especially when it comes to the indigenous people our forefathers displaced (and worse) in order to live on this land. Growing up in New Haven County…

We asked our 2020 intake of Technology Pioneers for their views on how technology will change the world in the next five years. Here are their predictions.

Global web services are largely served from public clouds today. As they reach the cloud edge, they are handed over to telco wireline and mobile wireless access networks for delivery to end users. While this delivery approach has been adequate as a best-effort service delivery, mission-critical services — with stringent latency requirements in the range…

We all know about the SolarWinds supply chain hack. But, while smaller in scope, Codecov's Bash Uploader Security supply chain failure is also a record-setter. And, this is not a record anyone wants to break. Months after their code was busted  Codecov only discovered the foul-up, thanks to a security-conscious user. He checked the Secure…

Breaking into the datacenter compute or networking ASIC business is about as easy as trying to start up a new global car company. It can be done, as Elon

Just about every business, every initiative and every intervention fails sooner or later. Since that’s demonstrably true, it’s worth considering how you intend to fail when the time com…

Counterintuitively, directly combating misinformation online can spread it further. A different approach is needed.

While the interface has changed little over time, Amazon’s Simple Storage Service (S3) is anything but basic on the backend. With over fifteen years of

Understanding the neural system of modern digitally-driven organizations In part 1 of this article, we introduced the four architecture domains as well as the evolution of a sample enterprise architecture. In part 2, we will look at an enterprise integration platform as a service (EiPaaS) reference architecture and highlight its key components. We will also…

The Stories Editor for WordPress makes it easy for you to easily create beautiful stories and embed everywhere into your existing site.

The reality is that breakthrough cases are normal and expected after vaccination.

Data and analytics leaders may be overestimating their companies' ability to benefit from the next round of investments in data infrastructure technology. A survey conducted on behalf of data catalog vendor Alation asked leaders at companies with more than 2,500 employees for grades about their corporate data culture. Two-thirds believe their company's data culture ranks…

Components make compute and storage servers, and servers with application plane, control plane, and data plane software running atop them or alongside

Apple is positioning its M1 quite differently from any CPU Intel or AMD has released. The long-term impact on the PC market could be significant.