Do your container images actually drop root? A quick way to check (and what 25 popular projects do)If a container's final image never drops to a non-root user, a process that breaks out of your app runs as root inside the container — a bigger blast radius if it then finds a runtime or kernel escapeSep 1 · 5 min readzennoxa.hashnode.dev
There are 755 static-analysis tools. Only 42 are open-source security scanners.If you run a linter on your code today, you have a lot of choices. If you want one that actually looks for security bugs — and is open source — you have far fewer than the ecosystem's size suggests. WAug 21 · 4 min readzennoxa.hashnode.dev
