Yann M. Vidamment · blog

Topic

security

4 articles in this topic.

01
Deploying without an SSH key in CI

Jun 12, 2026 Topics the-way ci security Series The way I see it

A pull-based deploy: CI signs a webhook, an agent on the server pulls the new image and redeploys. Plus the 401 that was never about the signature.
02
CI that builds, gates, and publishes your image

Jun 6, 2026 Topics the-way ci docker security Series The way I see it

A pipeline that lints, tests, scans and ships the image on every push, plus the monthly rebuild that stops a pinned base from rotting in silence.
03
A hardened compose file for a web app

Jun 4, 2026 Topics the-way docker security Series The way I see it

Freeze the filesystem, drop every Linux privilege, keep the secret out of docker inspect, and publish no ports at all. The other half of running a container safely.
04
A hardened Dockerfile for a web app

Jun 2, 2026 Topics the-way docker security Series The way I see it

Build in stages so no compiler ships to production, run as a user with no powers, and strip out everything an attacker could use. The Dockerfile I reach for on web projects.