Build a container image security gate with Trivy

A container image can pass a functional test while still carrying an unpatched package, a credential left in a layer, or a Dockerfile setting that is unsuitable for the environment where it will run. Those are different problems, so a useful build gate needs to report them separately and make its failure policy explicit.

This guide builds a small, repeatable gate around Trivy 0.73.0. The result is a CI job that scans a pinned container image for high and critical vulnerabilities, checks the source tree for infrastructure-as-code problems and secrets, saves machine-readable reports, and fails only when the policy says it should. It is appropriate for a repository that builds an OCI image and has a controlled CI environment. The commands are documentation-verified; adapt image names, registries, retention, and approval rules to the local delivery process.

Cisco disclosed CVE-2026-20316 on 29 July 2026: a static credential in the Cisco Secure Firewall Management Center (FMC) web interface can let an unauthenticated remote attacker sign in as a low-privileged user and access sensitive data. Cisco says it became aware of active exploitation in July, and CISA added the issue to its Known Exploited Vulnerabilities catalog on 29 July with a required-action date of 1 August for federal civilian agencies.

Kubernetes v1.37 is planned for 26 August 2026. The release preview is not a final change log, but it is early enough to turn into a controlled readiness check rather than a surprise during an upgrade window. The practical outcome is an evidence pack that identifies nodes still using cgroup v1, confirms the kube-proxy mode, finds static Pod manifests that refer to API objects, and records the workload and storage cases that need a staging test.

A workflow file is executable deployment and administration logic. A small change under .github/workflows/ can alter which code runs, which credentials are available, where artifacts go, or which cloud role a job can assume. That makes a workflow change different from an ordinary source change, even when it arrives in a normal pull request.

On 28 July 2026, GitHub began holding certain potentially malicious workflow runs for approval before they start in public repositories on GitHub.com. The protection is automatic: there is no repository setting to enable, and a collaborator with write access must approve a held run in an authenticated web session. It is a useful last check, but it is not a workflow security program. It applies only when GitHub identifies a run as suspicious, and approval still gives the workflow its normal capabilities.

As cloud environments grow, outbound internet traffic often grows with them. Each virtual network gets its own public-facing path, its own translation service, and a slightly different set of firewall rules. That works for a small estate. It becomes difficult to audit when several accounts, subscriptions, regions, and application teams are involved.

A centralized egress design moves outbound traffic through a small number of controlled inspection points. Workload networks remain private, security policy has a clear enforcement location, and the organization can record which networks are allowed to reach the internet. The design does not remove the need for workload-level controls. It gives those controls a network path they can actually rely on.

Ingress-NGINX reached retirement on 24 March 2026. The Kubernetes Steering and Security Response Committees say there will be no further releases, bug fixes, or security patches for the project. That does not mean every cluster must replace its ingress controller during an incident, but it does mean that keeping it as an Internet-facing dependency needs an explicit migration plan.

This guide converts a small, ordinary Ingress-NGINX route set into Gateway API resources without deleting the existing ingress. The finished result is a reviewed Gateway and HTTPRoute manifest, attached to a controller-supported GatewayClass, with a test request that proves the hostname, path, backend, and TLS behavior before traffic is moved. The commands are documentation-verified examples, not output from a particular cluster. Use a maintenance window and adapt the controller installation, load-balancer addresses, namespace names, and DNS records to the platform you operate.

GitHub’s AI security detections can place a new class of finding beside ordinary code-scanning results when a pull request is opened or updated. That can be useful for teams maintaining AI-assisted or conventional application code, but it is not a reason to let an automatically generated finding change a production branch by itself. GitHub describes these detections as informational: they do not block a merge, and they depend on GitHub Code Security plus CodeQL default setup.

npm v12 changes what an ordinary dependency install is allowed to do. Its new defaults leave dependency lifecycle scripts disabled unless they are explicitly approved, and they refuse Git and remote-URL dependencies unless those dependency sources are explicitly allowed. That is a useful supply-chain boundary, but it can also make a familiar npm ci fail to produce a usable application when a native module, generated client, or other dependency normally prepares itself during installation.

OpenSSH 10.4, released on 6 July 2026, includes security fixes and makes the SSH transport protocol stricter. That combination is a good reason to plan an update, but it is also a reason not to treat a remote-access service like an ordinary package refresh. A syntactically valid sshd_config can still lock out the only administrator who has the required key, source address, or jump host path.

This guide prepares a Linux host for a distribution-provided OpenSSH 10.4 update. The result is a recorded effective server configuration, a tested administrative connection, and a rollback-safe update sequence. The commands are documentation-verified examples, not observations from a particular host. Run them from a console, out-of-band management session, or a second SSH session that remains open until the new daemon has accepted a fresh connection.

The old IP Filter article in this archive reflects an earlier FreeBSD firewall workflow. For a new FreeBSD host, start with PF and make the first policy deliberately small: retain console access, permit only the services the host provides, and validate the rules before enabling them at boot.

This is a documentation-verified baseline, not a copy-and-paste production policy. Interface names, management networks, service ports, IPv6 needs, and routing requirements vary by host. Apply it first from a console or an out-of-band management path so a typo does not strand an SSH-only system.