Keylime Remote Attestation on Linux: TPM 2.0 Trust for Server Fleets in 2026
Deploy Keylime continuous remote attestation on Linux with TPM 2.0: registrar, verifier, Rust agent, IMA runtime policies, and revocation webhooks in 2026.
All Articles
Tang and Clevis on Linux: Network-Bound Disk Encryption (NBDE) for Headless Servers in 2026
Auto-unlock LUKS2 volumes at boot using Tang and Clevis NBDE. Covers install, sss threshold pins with TPM2, safe key rotation, and boot troubleshooting for headless Linux servers.
OpenVEX and CSAF VEX on Linux: Cutting Trivy & Grype False Positives in 2026
VEX is the layer between your SBOM and your scanner that says this CVE doesn't apply to us, and here's why. Walks through OpenVEX, CSAF VEX, vexctl, Trivy --vex, Grype match exclusions, and the CI pipeline pattern I run on every Linux build.
Kata Containers vs gVisor in 2026: Sandboxed Container Runtimes on Linux
Kata Containers and gVisor both sandbox Linux containers but use very different mechanisms. This 2026 guide compares their isolation models, performance overhead, Kubernetes RuntimeClass setup, and when to pick each runtime for production workloads.
Linux Memory Forensics with Volatility 3: Hunting Rootkits and Implants in 2026
A practical walkthrough of Linux memory forensics with Volatility 3 in 2026: capturing RAM with AVML or LiME, building ISF symbol tables, running the plugin chain that catches LKM, LD_PRELOAD, and eBPF rootkits, and mapping each detection back to a hardening control.
BPF LSM (KRSI) in 2026: Writing Custom Kernel Security Policies with eBPF
Use BPF LSM (KRSI) to write dynamic kernel security policies in eBPF. Enable it on Linux 6.x, ship your first enforcement program, and stage audit-to-enforce rollouts safely.
Linux Unified Kernel Images (UKI) and systemd-boot: A 2026 Secure Boot Guide
Build, sign, and enroll Unified Kernel Images on Linux: ukify, sbctl, systemd-boot, and TPM2 PCR policies for a measured, tamper-evident Secure Boot chain in 2026.
Structured Outputs vs Function Calling: A 2026 LLM Guide
Compare structured outputs and function calling across OpenAI, Anthropic, and Gemini in 2026. Includes Python code, vendor matrix, and eval metrics that catch the failures schema validation misses.
SPIFFE and SPIRE on Linux: Workload Identity and mTLS Without Long-Lived Secrets (2026)
SPIFFE and SPIRE give Linux workloads short-lived, verifiable identities (SVIDs) for mTLS and JWT auth, replacing long-lived API keys and secrets.
PostgreSQL Hardening on Linux: pg_hba, TLS, RLS, and pgaudit in 2026
Production-grade PostgreSQL 17 hardening on Linux: SCRAM-SHA-256 pg_hba, TLS 1.3 with client certs, least-privilege roles, RLS, and pgaudit shipped to a SIEM.
Fail2ban vs CrowdSec 2026: What I Learned After Migrating 14 Edge Nodes
A hands-on 2026 comparison of fail2ban and CrowdSec on production Debian and Ubuntu edge nodes, covering detection accuracy, resource use, blocklist quality, and when each tool is still the right pick.
Linux Server Hacked? What To Do In the First 60 Minutes
A field-tested 60-minute playbook for the moment you find evidence of compromise on a Linux box: how I isolate the host, capture volatile state, hunt persistence, and rebuild without losing the trail.