-
Agent skills as SKILL.md playbooks, not plugins
My agent's plugin folder auto-loaded code as ungated tools. I moved procedures to SKILL.md playbooks in one git library: validated in CI, root-owned, read-only to the agent, and promoted only after review.
-
9,151 critical CVEs, mostly in images I wasn't running
My weekly Trivy report counted 9,151 criticals across 1,925 images; only 152 were running. How I scoped the scan, cleaned old tags safely, triaged by fixable, and patched a PHP RCE the same day.
-
A chat-ops bot is a doorway, not a convenience
My infrastructure chat bot went silent for six hours because the router had blocked the messaging API's one IP. That and a self-heal webhook wired to nothing taught me how to build and test a privileged chat-ops bot.
-
Secrets in GitOps history: scan by key name, then rotate
My Kubernetes manifests repo had credentials from its first commit. Why value-shaped scans drown in noise and still miss passwords, how key-name scanning with triage found the real ones, and why rotation, not deletion or history rewrites, is the fix.
-
Running Gitea and CI inside the cluster they deploy
Lessons from a self-hosted Gitea in k3s: why git push hits the SSO login page, getting passwords out of 7 remote URLs, a Git server OOM-killed at 512 MiB and 2 GiB, and what act_runner needs before 365 tests pass in 82 seconds.
-
One notification relay instead of 40 copies of a token
The same chat-bot token lived in about 40 places in my lab, some in git. A small relay now holds the credentials once; senders carry only a revocable per-sender token and address channels, not platforms.
-
The test that deleted my home folder
To prove a path-traversal bug existed, an AI coding assistant ran the test against the unfixed code on the host, and the bug deleted everything my user could delete in ten seconds. How I found the exact command on the raw disk, and the boring safeguards that now prevent it.
-
Passwords that only fail after a reboot
Long-lived connections and hard-coded default passwords hid a database password rotation until a routine reboot broke two services. Why it happens, how to find the services that are hiding it, and a fail-closed checklist.
-
The one-second race that hid my nginx config change
A Kubernetes rollout started a new pod one second before its ConfigMap was updated, and a subPath mount kept the old nginx config forever. How kubectl apply order and subPath combine, and the checklist that prevents it.