Tracing Taskcluster's GraphQL Filter to new Function()
Taskcluster's historical web server passed a GraphQL JSON filter to sift@17.1.3, where a $where string reached new Function() and ran as JavaScript.
Essays, notes & field reports
What os.cpu_count() Gets Wrong in a CPU-Limited Kubernetes Pod
A hands-on Minikube lab showing why os.cpu_count() returns the node's full CPU count inside a CPU-limited pod, and what happens when Gunicorn sizes workers from that number instead of the cgroup quota.
How Kubernetes Assigns GPUs: Tracing the Device Plugin Path from Pod Spec to CUDA
What actually happens when you request nvidia.com/gpu: 1? A step-by-step trace through the scheduler, kubelet device manager, gRPC allocation on nvidia-gpu.sock, and container injection, on a real minikube cluster with an RTX 3050.
Cross-Node Pod Communication in Kubernetes: Plain IP Routing with Kindnet
Learn how pods communicate across nodes in Kubernetes with Kindnet using plain L3 routing, without overlays or tunnels.
SQL Injection Detection with Sigma on Kubernetes
Scale your detection logic with Sigma rules that work across multiple SIEM platforms. Convert lab-tested SQL injection detection into portable, version-controlled rules.
Building a Detection-Ready SOC Lab on Kubernetes
Deploy OWASP Juice Shop on Kubernetes and build a complete detection pipeline with Falco for syscall monitoring, Zeek for network analysis, and Loki/Grafana for centralized observability.
Time, Errors, and Unions: Practical SQL Injection Exploitation and Detection
Learn SQL injection from the ground up with a hands-on Docker lab. Build a vulnerable PHP-MySQL application and execute real attacks including authentication bypass, UNION-based data extraction, error-based leaks, and time-based blind enumeration.
Pod Birth: veth Pairs, IPAM, and Container Networking
Understand the complete lifecycle of pod creation in Kubernetes, from veth pair creation to IP address allocation and network setup.
Inside Pod-to-Pod Networking: Intra-Node Traffic in Kindnet
Deep dive into how pods on the same node communicate in Kubernetes using Kindnet. Understand veth pairs, bridge networking, and packet flow.
Kubernetes: The Art of Zero-Downtime Deployments
Downtime is a nightmare for businesses. This guide explores advanced deployment strategies like Blue/Green and Canary deployments to achieve seamless Kubernetes deployments.
Transforming MLOps with Kubeflow & KServe: Churn Prediction
This guide shows you how to effectively use Kubeflow, KServe, and Flask to predict customer churn and revolutionize your MLOps pipeline.
Atomic ConfigMap Updates in Kubernetes: How Symlinks and Kubelet Make It Happen
Understand how Kubernetes uses symlinks and kubelet to atomically update ConfigMaps mounted as volumes without pod restarts.
Canary Deployments Made Easy: A CI/CD Journey with GitHub Actions and Argo CD Rollouts
Traditional software deployment methods are full of problems. This article explores how a well-structured CI/CD pipeline powered by Argo Rollouts, GitHub Actions, and Kubernetes can revolutionize your DevOps practices.
A High-Level Overview of Kubernetes The Hard Way on WSL
For those who crave a deep understanding of how Kubernetes really works, Kubernetes The Hard Way offers a hands-on approach to setting up a Kubernetes cluster from scratch.