Many security problems in everyday code are not exotic: a container running as root, a base image without a tag, a dependency nobody checked. These guides cover two areas where developers can fix a lot before a security team ever looks: containers and the software supply chain.
Where to start
- You write Dockerfiles: start with the seven Docker security tips, then keep the 29 Dockerfile rules open while you review.
- You run workloads on Kubernetes: read the 12 Kubernetes security practices, then check every pod against the securityContext table.
- You publish or consume packages from npm or PyPI: read the typosquatting guide and the dependency confusion guide.
- You want the checks to run without anyone remembering them: install the Cloud (IaC) Security plugin in IntelliJ IDEA and add the same checks to CI with Qodana.
Every rule page of the plugin explains one problem with a bad and a fixed example, so a warning in the IDE always links to the reason behind it.
Docker and Kubernetes
- Dockerfile Best Practices: 29 Rules for Better Images: 29 rules for smaller, safer images.
- Docker Security: Best Practices You Need to Know: the short version, seven tips to start with.
- Kubernetes Security: Best Practices to Protect Your Cluster: 12 practices that protect a cluster.
- Kubernetes securityContext Explained: every field, its safe value and the rule page behind it.
- Analyze Docker & Kubernetes files with Qodana: run the same checks in CI.
- Hadolint vs Cloud (IaC) Security: Dockerfile linting in IntelliJ IDEA: which Dockerfile linter to use, in the IDE and in CI.
- Cloud (IaC) Security plugin: my open source IntelliJ IDEA plugin that flags these problems while you type, with a page for every rule.
Software supply chain
- Malware Packages in NPM and PyPI: Typosquatting Guide: how attackers publish look-alike packages.
- Dependency confusion: find it with an SBOM, stop it in Maven, Gradle, npm and pip: how attackers claim your internal package names, how an SBOM finds them, and the fix for each build tool.
- Revival Hijacking: How Deleted PyPI Packages Become Threats: how deleted PyPI packages come back as threats.
Tools in practice
- Dependency Track: fixing the re-login on new tab problem
- How to run DefectDojo without root privileges in Kubernetes
- Google Agent Development Kit Guide: AI CVEs prioritization
- JetBrains Junie for AI assisted hacking: review
Found this useful? Follow me on social media to stay updated.