MicroVMs
The Service Is Running, Listening, and Completely Unreachable
curl works on the box and hangs from outside. Four places the packet can die, and how to tell which one killed it without guessing.
Networking
TLS Handshake Failures: the Error the Server Actually Sent
handshake failure, protocol version, unknown ca and bad certificate all mean different things. Here is how to get the real reason out of a connection that…
MicroVMs
I Rebooted the VM and the Kernel Did Not Change
A patched kernel that kept reporting the old version after every reboot. The reboot was working perfectly. My assumption about where the kernel comes from…
Deep Dive
How a MicroVM Boots in Under a Second
Traditional VMs take thirty seconds. Firecracker takes 125 milliseconds. The difference is everything it refuses to do.
AI
Prompt Injection Is Not a Bug You Can Patch
Every mitigation at the model layer can be worked around. The fix is architectural: assume the model will be compromised and limit what it can do.
DevOps
Your CI Pipeline Has More Access Than Your Engineers Do
A build system with production credentials and the ability to run arbitrary code from a pull request is the most under-secured part of most stacks.
AI
The Package Your AI Assistant Recommended Does Not Exist
Models invent plausible package names. Attackers register them. Here is why this attack works and the two checks that stop it.
AI
Running AI Agent Generated Code Safely: What Actually Contains It
If an agent can run shell commands, you have an arbitrary code execution problem. Here is what each isolation option genuinely protects against.
Docker
Containers Share a Kernel and That Is the Whole Story
The difference between a container and a microVM is one sentence long, and almost every isolation decision follows from it.