Meta tags:
keywords=Matteo Bisi,DevSecOps,cloud native,cloud native security,open-source software,Kubernetes,infrastructure,security best practices,team leadership,site reliability,CI/CD,cloud computing,CNCF;
description=A journal by Matteo Bisi, DevSecOps team leader, sharing insights on cloud native security, open-source software, and modern infrastructure;
author=Matteo Bisi;

Headings (most frequently used words):

for, the, and, kubernetes, security, in, native, team, your, vs, ai, logs, cloud, open, source, lead, working, journal, you, built, signed, sbom, now, what, store, verify, manage, apple, container, sighup, distribution, when, evaluating, of, project, start, with, placeholder, microvms, containers, agents, ecb, cybersecurity, guide, shift, left, starts, ide, code, 2026, who, owns, nis2, dora, platform, 37, stable, advances, future, signals, grok, bot, an, superpower, senior, engineers, audit, haproxy, soc, evidence, eu, cyber, resilience, act, practical, roadmap,

Text of the page (most frequently used words):
the (52), and (32), 2026 (16), security (11), min (10), words (10), matteo (10), bisi (10), team (9), from (9), for (9), kubernetes (9), not (8), september (8), that (8), are (7), #source (6), native (5), open (5), lead (5), working (5), you (5), into (5), with (5), have (5), distribution (5), container (5), cloud (4), software (4), its (4), evidence (4), most (4), platform (4), your (4), journal (3), august (3), cyber (3), cra (3), useful (3), what (3), this (3), started (3), our (3), moving (3), before (3), engineer (3), agents (3), build (3), story (3), policy (3), keep (3), same (3), still (3), october (3), shift (3), left (3), starts (3), code (3), agent (3), apple (3), sighup (3), sbom (3), integrate (2), should (2), whether (2), resilience (2), act (2), regulation (2), 2024 (2), december (2), does (2), while (2), start (2), readiness (2), published (2), surveyed (2), organizations (2), more (2), one (2), important (2), has (2), been (2), soc (2), rules (2), through (2), known (2), also (2), runtime (2), capabilities (2), behaviour (2), logs (2), engineering (2), leadership (2), about (2), senior (2), engineers (2), grok (2), bot (2), was (2), stable (2), point (2), recovery (2), customer (2), decision (2), question (2), someone (2), nis2 (2), dora (2), article (2), can (2), looks (2), because (2), cluster (2), who (2), means (2), sast (2), signed (2), images (2), first (2), trying (2), capable (2), failed (2), search (2), path (2), environment (2), why (2), but (2), yet (2), vulnerabilities (2), own (2), run (2), scan (2), sboms (2), create (2), sometimes (2), placeholder (2), when (2), lab (2), bootstrap (2), kernel (2), failure (2), martinez (2), attestations (2), built (2), powered, papermod, hugo, next, 2483, make, distribute, buy, connected, products, european, union, assess, 2847, applies, entered, force, need, national, transposition, main, product, obligations, apply, 2027, manufacturer, reporting, duties, openssf, awareness, report, linux, foundation, 843, analyzed, than, 000, projects, points, material, gap, experiencing, measure, whole, industry, practical, roadmap, 1546, topics, following, year, designing, implementing, service, workloads, reevo, preventative, layer, designed, tuned, solid, set, posture, cnapp, solution, covering, misconfigurations, risky, privileges, bad, patterns, across, clusters, gives, identify, suspicious, occurs, part, well, audit, haproxy, 1153, four, years, ago, role, management, written, journey, system, leader, importance, delegation, ownership, another, transition, happening, parallel, coding, changing, how, experienced, recent, post, lingxi, spacexai, gave, clearest, examples, seen, far, superpower, 1286, named, garhwal, released, contains, enhancements, reaching, status, clear, strengthens, workload, identity, trust, selinux, enforcement, today, introduces, early, better, protection, safer, writable, storage, resilient, tomorrow, makers, long, feature, list, release, helps, organisations, protect, data, critical, services, trustworthy, these, six, features, answer, advances, future, signals, 2151, seeing, meeting, legal, risk, drops, control, request, room, ticket, lands, board, feels, like, responsible, place, three, sprints, later, changed, exist, everyone, slightly, angry, owns, 1838, preparing, talks, devsecops, day, bologna, landing, sentence, pipeline, already, late, orgs, sca, earlier, none, them, help, credential, theft, happened, editor, laptop, good, ide, 1728, turned, sandboxing, detail, install, tools, read, experiments, retry, approaches, out, hours, old, sandbox, longer, enough, trail, bits, showed, escape, experiment, repeatedly, escaped, qemu, kvm, combining, unpatched, host, weaknesses, fixes, included, eventually, new, lesson, virtual, machines, useless, technical, boundary, provides, complete, containment, microvms, containers, ecb, cybersecurity, guide, 1557, spend, enormous, amount, time, secure, dependencies, iac, scanners, check, configurations, monitor, everything, dashboards, full, cves, findings, interesting, problem, vulnerability, all, evaluating, project, 1095, needed, deliberately, narrow, k8s, node, during, preparation, helper, applied, two, tcp, mss, legacy, iptables, completed, kubeadm, itself, closes, fixed, retained, created, natively, installs, top, without, any, workaround, backstory, matters, upgrade, behavior, caused, unchanged, remediation, explicit, command, 2326, javier, sharp, piece, failing, stop, supply, chain, attacks, agree, his, analysis, recommend, reading, continuing, here, tldr, sysdig, simple, idea, plus, signatures, give, attribution, provenance, where, comes, content, inside, flow, verifying, deploy, then, generating, signing, ship, now, store, verify, manage, perspective, building, managing, modern, technology, privacy, tags, home,

Text of the page (random words):
cloud native open source a team lead s working journal home search tags about me privacy policy cloud native open source a team lead s working journal a team lead s perspective on building and managing modern open technology you built and signed your sbom now what store verify manage javier martinez published a sharp piece on september 24 2026 why are sboms failing to stop supply chain attacks i agree with his analysis i recommend reading it before continuing here tldr of the sysdig article martinez starts from a simple idea an sbom plus signatures and attestations should give us attribution who built it provenance where it comes from and content what is inside in a kubernetes flow that means verifying attestations before deploy then generating and signing your own sbom when you ship october 6 2026 11 min 2326 words matteo bisi apple container 1 5 0 native kubernetes for sighup distribution my first apple container kubernetes and sighup distribution lab needed a deliberately narrow recovery path container k8s create started the node but failed during preparation so the lab helper applied two tcp mss rules through legacy iptables and completed the kubeadm bootstrap itself apple container 1 5 0 closes that story it fixed the retained kernel failure at the source so the cluster is created natively and the sighup distribution installs on top without any bootstrap workaround the kernel backstory still matters because the upgrade behavior that caused the failure is unchanged and the remediation is the same explicit command october 1 2026 6 min 1095 words matteo bisi when evaluating the security of your project start with the placeholder we spend an enormous amount of time trying to secure software we run sast we scan dependencies we scan container images we run iac scanners we check kubernetes configurations we monitor runtime behaviour we build sboms we integrate everything into ci cd and create dashboards full of vulnerabilities cves and security findings and yet sometimes the most interesting security problem is not a vulnerability in our software at all sometimes it is a placeholder september 29 2026 8 min 1557 words matteo bisi microvms vs containers for ai agents ecb cybersecurity guide ai agents have turned sandboxing from an engineering detail into a leadership decision a capable agent can install tools read source code build experiments retry failed approaches and search for a path out of its environment for hours the old question do we have a sandbox is no longer enough trail of bits showed why in its vm escape experiment with a cyber capable ai agent the agent repeatedly escaped a qemu kvm environment by combining known but unpatched host weaknesses fixes not yet included in the distribution and eventually new vulnerabilities the lesson is not that virtual machines are useless it is that no technical boundary provides complete containment on its own september 21 2026 9 min 1728 words matteo bisi shift left starts in the ide vs code security in 2026 i have been preparing talks for devsecops day in bologna this october and i keep landing on the same sentence if your shift left story starts at the pipeline you are already late in most orgs shift left still means moving sast and sca earlier in ci signed images and policy as code are useful none of them help if the first credential theft happened in the editor on a laptop while someone was trying to be a good engineer september 15 2026 9 min 1838 words matteo bisi who owns nis2 and dora in a platform team i keep seeing the same meeting someone from legal or risk drops a nis2 control a dora article or a can we evidence this request into the room the kubernetes platform team looks at security security looks at the platform team a ticket lands on the security board because that feels like the responsible place three sprints later the cluster has not changed the evidence still does not exist and everyone is slightly angry at the security lead september 10 2026 11 min 2151 words matteo bisi kubernetes 1 37 security 3 stable advances 3 future signals kubernetes 1 37 named garhwal was released on august 26 2026 it contains 67 enhancements with 16 reaching stable status the security story is clear kubernetes 1 37 strengthens workload identity trust distribution and selinux enforcement today it also introduces early capabilities that point to better policy protection safer writable storage and more resilient recovery tomorrow for customer decision makers the long feature list is not the point the important question is whether the release helps organisations protect customer data and keep critical services trustworthy these six features are the most useful answer september 4 2026 7 min 1286 words matteo bisi grok bot an ai superpower for senior engineers four years ago i started moving from an engineering role into management and leadership i have written before about my journey from senior system engineer to team leader and the importance of moving from delegation to ownership another transition is happening in parallel ai coding agents are changing how experienced engineers build software a recent x post from lingxi li a spacexai engineer working on grok bot gave me one of the clearest examples i have seen so far september 2 2026 6 min 1153 words matteo bisi kubernetes audit logs and haproxy logs for soc evidence one of the most important topics my team has been following this year is designing and implementing a soc service for cloud native workloads at reevo we started with the preventative layer we designed and tuned a solid set of posture rules through our cnapp solution covering misconfigurations risky privileges and known bad patterns across our clusters the platform also gives us runtime security capabilities to identify suspicious behaviour as it occurs that part is working well august 26 2026 8 min 1546 words matteo bisi the eu cyber resilience act a practical roadmap if you make distribute integrate or buy software and connected products in the european union you should assess whether the cyber resilience act cra regulation eu 2024 2847 applies the cra entered into force on 10 december 2024 and as a regulation does not need national transposition its main product obligations apply from 11 december 2027 while manufacturer reporting duties start on 11 september 2026 the openssf 2026 cra awareness and readiness report published by the linux foundation surveyed 843 organizations and analyzed more than 12 000 open source projects it points to a material readiness gap it is useful evidence of what surveyed organizations are experiencing not a measure of the whole industry august 20 2026 12 min 2483 words matteo bisi next 2026 cloud native open source a team lead s working journal powered by hugo papermod