the-way

Why git add . is a trap, what a commit stores, and why a deleted secret is still in your history. The local half of Git, before any remote.

Why a long job ignores your Ctrl-C, and the handler that fixes it. Signals, the child processes a script leaves running, and the init that inherits them.

The same backup script, grown from four lines that look fine to one you can trust to fail without eating your last good backup. Quoting, exit codes, set -euo pipefail and traps, with the reason behind each line.

From the universal chmod -R 777 to a directory only the service can touch. Ownership as a number, the rwx bits, and the setgid, sticky and setuid bits the hardened container leans on.

A pull-based deploy: CI signs a webhook, an agent on the server pulls the new image and redeploys. Plus the 401 that was never about the signature.

A pre-commit hook that formats your code before it reaches the pipeline. No husky, no lint-staged, fifteen lines of shell.

A pipeline that lints, tests, scans and ships the image on every push, plus the monthly rebuild that stops a pinned base from rotting in silence.

Freeze the filesystem, drop every Linux privilege, keep the secret out of docker inspect, and publish no ports at all. The other half of running a container safely.

Build in stages so no compiler ships to production, run as a user with no powers, and strip out everything an attacker could use. The Dockerfile I reach for on web projects.