x0rg/9x0rg.com
1
0
Fork 0
Code Releases Activity

explicit syntax

Browse Source
This commit is contained in:
Wonderfall 2022-07-24 01:45:38 +02:00
parent f2f2445707
commit e8c335adb9
2 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
content/posts/docker-hardening.md
View File

@ -61,7 +61,7 @@ For these reasons, good practices were established:
However, distroless images are not suited for every application. In my experience though, distroless is an excellent option with pure Go binaries. Going with minimal images drastically reduces the available attack surface in the container. For example, here's a [multi-stage Dockerfile](https://docs.docker.com/develop/develop-images/multistage-build/) resulting in a minimal non-root image for a simple Go project: However, distroless images are not suited for every application. In my experience though, distroless is an excellent option with pure Go binaries. Going with minimal images drastically reduces the available attack surface in the container. For example, here's a [multi-stage Dockerfile](https://docs.docker.com/develop/develop-images/multistage-build/) resulting in a minimal non-root image for a simple Go project:
``` ```Dockerfile
FROM golang:alpine as build FROM golang:alpine as build
WORKDIR /app WORKDIR /app
COPY . . COPY . .
@ -219,7 +219,7 @@ A platform like ptrace or KVM is used to intercept system calls and redirect the
The security model of gVisor is comparable to what you would expect from a virtual machine. It is also very easy to [install and use](https://gvisor.dev/docs/user_guide/install/). The path to runsc along with its different configuration flags (`runsc flags`) should be added to `/etc/docker/daemon.json`: The security model of gVisor is comparable to what you would expect from a virtual machine. It is also very easy to [install and use](https://gvisor.dev/docs/user_guide/install/). The path to runsc along with its different configuration flags (`runsc flags`) should be added to `/etc/docker/daemon.json`:
``` ```json
"runtimes": { "runtimes": {
"runsc-ptrace": { "runsc-ptrace": {
"path": "/usr/local/bin/runsc", "path": "/usr/local/bin/runsc",

2
content/posts/fdroid-issues.md
View File

@ -106,7 +106,7 @@ Their client also lacks **TLS certificate pinning**, unlike Play Store which imp
It is an important security feature that is also straightforward to implement using the [declarative network security configuration](https://developer.android.com/training/articles/security-config) available since Android 7.0 (API level 24). See how GrapheneOS pins both root and CA certificates in their [app repository client](https://github.com/GrapheneOS/Apps): It is an important security feature that is also straightforward to implement using the [declarative network security configuration](https://developer.android.com/training/articles/security-config) available since Android 7.0 (API level 24). See how GrapheneOS pins both root and CA certificates in their [app repository client](https://github.com/GrapheneOS/Apps):
``` ```xml
<!-- res/xml/network_security_config.xml --> <!-- res/xml/network_security_config.xml -->
<network-security-config> <network-security-config>
<base-config cleartextTrafficPermitted="false"/> <base-config cleartextTrafficPermitted="false"/>