Joshua Noble

If you are working with Docker... I highly recommend looking at the Slim toolkit. https://lnkd.in/gX_Gb9Kf Why? Slim allows developers to inspect, optimize, and debug their containers using its xray, lint, build, debug, run, images, merge, registry, vulnerability (and other) commands. It simplifies and improves your developer experience building, customizing and using containers. It makes your containers better, smaller and more secure while providing advanced visibility and improved usability working with the original and minified containers. Don't change anything in your container image; minify it by up to 30x to make it secure, too! Optimizing images isn't the only thing it can do, though. It can also help you understand and author better container images. Keep doing what you are doing. No need to change anything. Use the base image you want. Use the package manager you want. Don't worry about hand-optimizing your Dockerfile. You shouldn't have to throw away your tools and your workflow to have small container images. Node.js application images: from ubuntu:14.04 - 432MB => 14MB (minified by 30.85X) from debian:jessie - 406MB => 25.1MB (minified by 16.21X) from node:alpine - 66.7MB => 34.7MB (minified by 1.92X) from node:distroless - 72.7MB => 39.7MB (minified by 1.83X) Go application images: from golang:latest - 700MB => 1.56MB (minified by 448.76X) from ubuntu:14.04 - 531MB => 1.87MB (minified by 284.10X) from golang:alpine - 258MB => 1.56MB (minified by 165.61X) from centos:7 - 615MB => 1.87MB (minified by 329.14X) Rust application images: from rust:1.31 - 2GB => 14MB (minified by 147.16X) Java application images: from ubuntu:14.04 - 743.6 MB => 100.3 MB

4

Boston friends, join me at the InfoQ Dev Summit in Boston next week! Let's delve into the million-dollar lines of code problem and discuss strategies for building cost-effective cloud systems. Looking forward to engaging in insightful conversations with you all. See you there! #InfoQDevSummit #BostonTech #CloudComputing

46

Great SRE Interview Questions 

4

Big news today... FOSSA free plan just got a major upgrade! We want to make it ridiculously easy for development teams to start securing their software and drive comprehensive Open Source Compliance, Security and Quality -- for FREE. That's why we have now launched a new free forever plan -- built for complete workflows around the lifecycle of managing open source such as: - Open source security - SBOM management - License compliance - Quality / Obsolescence No vendor evals, no sales convos, no zoom meetings. Just sign up, start doing -- and come back if you need to scale. Let's get folks off the dev team's back and ship compliant, secure and high quality software with OSS. Check out the link to the full announcement in the comments.

92

9 Comments

My latest for TechCrunch: Another Black Exit! Open source compliance and security platform FOSSA has acquired developer community platform StackShare, the company confirmed to TechCrunch. Founded by Yonas Beshawred, StackShare is one of the more popular platforms for developers to discuss, track, and share the tools they use to build applications. This encompasses everything from which front-end JavaScript framework to use to which cloud provider to use for specific tasks. Read more to learn about the company and its acquisition!

61

2 Comments

Sometimes engineering teams are really, really busy. So much so, that sometimes important security remediations get pushed back. If this is happening, tools that provide contextual information can be helpful. These help you convey to your team the severity of an issue. For example, if the remediation is removing a public endpoint from a database and the database doesn’t host any sensitive data in it, then your engineering team might not feel the need to prioritize it. However, if you have a tool like Wiz for example you use that to show your engineering team how an attacker could gain access to the database and then use that to move laterally in your network over to another database that does have business critical or sensitive information in it. Effective storytelling makes influencing security decisions easier. Make sure your tools are helping you do this.

3

#Camunda's #OpenAI blueprint project is shockingly easy to use. I demo'd six technical features during this full presentation. This brief 3 minute example was an eye-opener!

14

2 Comments

Just a few weeks after the GA release of Arm64 runners, we’re already seeing our clients achieve noticeable reductions in build times and lower runtime costs. If you're looking to scale your CI/CD operations and accelerate feedback loops, now is the time to explore the benefits of Arm64! Key takeaways: - ⚡ Faster build times to streamline development. - 💰 Cost savings through optimized runtimes. Ready to take your CI/CD to the next level? #CI/CD #Arm64 #DevOps #BuildOptimization #CostEfficiency #ContinuousIntegration target: https://lnkd.in/gY-_n6JJ

76