ZZennoxainzennoxa.hashnode.dev·Sep 1 · 5 min readDo your container images actually drop root? A quick way to check (and what 25 popular projects do)If a container's final image never drops to a non-root user, a process that breaks out of your app runs as root inside the container — a bigger blast radius if it then finds a runtime or kernel escape00
ZZennoxainzennoxa.hashnode.dev·Aug 21 · 4 min readThere are 755 static-analysis tools. Only 42 are open-source security scanners.If you run a linter on your code today, you have a lot of choices. If you want one that actually looks for security bugs — and is open source — you have far fewer than the ecosystem's size suggests. W00
