docker

A self-hosted file drop with OIDC, invitations and reverse shares. Sits behind my reverse proxy without leaking metadata.

Green on my machine, red in CI, same image. The bug was a single permission bit on /tmp, and the real fault was a test running the container in a shape it never ships in.

A pipeline that lints, tests, scans and ships the image on every push, plus the monthly rebuild that stops a pinned base from rotting in silence.

Freeze the filesystem, drop every Linux privilege, keep the secret out of docker inspect, and publish no ports at all. The other half of running a container safely.

Build in stages so no compiler ships to production, run as a user with no powers, and strip out everything an attacker could use. The Dockerfile I reach for on web projects.