Mohammad-Ali A'râbi

Docker Captains starter pack: 🐳 go.bsky.app/TGLWrCC

The #PHP2Shell patch versions are already out: 8.2.35 ➡️ php:8.2.35-fpm 8.3.36 ➡️ php:8.3.36-fpm 8.4.27 ➡️ php:8.4.27-fpm 8.5.12 ➡️ php:8.5.12-fpm Update the bsse image: FROM php:8.4.27-fpm Then verify: docker scout sbom my-php-app:latest --format list | grep -i php CC @docker.com

PHP2Shell is patched! 🐘🐳 PHP 8.2.35, 8.3.36, 8.4.27 & 8.5.12 are out. Docker images, too! 🐳 Update your base image. 🔨 Rebuild and redeploy. 🔍 Verify your PHP version. Don't give #PHP2Shell a shell. 😅 containersecurity.dev/blog/how-to-...

So, @aichalaafia.bsky.social has a typo in her title. 🦆 Takeaway: - Ask for help at work. - No question is stupid, except for "why my code doesn't compile". And other stupid questions. - Turn off your phone. Hit the sauna. 🧖‍♂️ #BaselOne

Dockerize securely: 1️⃣ Use Docker Hardened Images: dhi.io 2️⃣ Generate SBOM attestations: docker buildx build --sbom=true . 3️⃣ Check your CVEs: docker scout cves <image> 4️⃣ Sandbox your AI agents: sbx run claude Many thanks to @xinity.bsky.social for the awesome photo. 🤩 #BaselOne

Hi from #BaselOne 👋 Join me at 15:45 in Zooloose (the room sitting outside) for "What the Duck? The Hidden Crisis in Tech" 🦆✨ Ducks optional, curiosity required 😄

Container Security talk in 10 minutes at #BaselOne: Mono.

So, @docker.com is going dark mode and is giving away $250 of Cloud Sandbox credits. Put your agents in the cloud so that they don't steal your GitHub tokens: $ sbx run claude ⛅️ Claim it here: www.docker.com/c/sbx-promo/

I ordered my friend @aerabi.com new comic, Black Forest Shadow, about Docker/K8s security. It just arrived. He drew every panel with AI.

People often ask me about security: "What should we do if we only want to do a few things?" So, here are 5 things to do: 1⃣ Use sbx for agents 2⃣ Have 5 days of cooldown for packages 3⃣ Use Docker Hardened Images 4⃣ Generate SBOMs 5⃣ Scan them with Trivy

Talk 1 of 3 at JRush Ep.7. @aerabi.bsky.social, Docker Captain, author of "Docker and Kubernetes Security", on how to build a pipeline the breach can't get through. Free. June 23. jrush.bell-sw.com/episode7 #Java #DevSecOps

This is how supply chain attacks get through. @aerabi.bsky.social covering this live at JRush Ep.7. Free. June 23. jrush.bell-sw.com/episode7 #Java #DevSecOps

My article on Mini Shai Hulud 🪱 is out! www.dockersecurity.io/blog/mini-sh...

Someone sent me a DM today and said my CV-builder GitHub CI pipeline was a game-changer for him. My CV is on a GitHub repo, and it's built and published as an artifact every time you push to the repo. I gave a talk at @Docker All Hands about it once. youtu.be/DMwbXN3QKbs?...

How to secure your supply chain ⛓️ with @jbaru.ch! 🤠 www.youtube.com/live/pFfJZRA...

4 years ago on this day, I started a Twitter series called "Git Pro Tips". They are now available on git-weekly's website: git-weekly.com/tips

A document without a signature is just a rumor. Use Cosign to cryptographically sign your container images and attestations, ensuring complete supply chain trust. 🖋️🔐 Commando 9️⃣ Evie signs every artifact so that no CVE can tamper with it. 🤠 Meet the team: dockersecurity.io/co...

Complex builds shouldn't rely on massive CLI commands. Use Docker Bake (docker-bake.hcl) to define tags, multi-platform builds, and attestations as version-controlled code. 🏗️ Commando 8️⃣ Captain Ahab brings order to the chaos of the container whale. 🐋 Meet the team: dockersecurity.io/co...

I just completed the Docker Commandos v1.5 Asgard Mission! 🐳🛡️ Check out my certificate of completion: www.dockersecurity.io/commandos/in...

Prove your vulnerability exemptions are legitimate. VEX Attestations act as tamper-proof OCI referrers that travel with your container, automating compliance. ✅ Commando 7️⃣ RuinTan, the Immortal, grants invincible, verifiable protection cards to the innocent. 💀 More: dockersecurity.io/co...

Stop scanner fatigue! Use VEX (Vulnerability Exploitability eXchange) to formally exempt CVEs that aren't exploitable in your specific context. 🔇 Commando 6️⃣ Mina, the Undead Assassin, knows exactly which monsters are a threat and which are harmless. 🧛‍♀️ Learn more: dockersecurity.io/co...

Want to slash your attack surface to zero? Use Docker Hardened Images: FROM dhi.io/node:25 Instead of: FROM node:25 Hardened Images are not hard. Commando 5️⃣ Artemisia, the Amazonian Commander, guards the heavily fortified, zero-CVE district. ⚓ www.dockersecurity.i...

Don't just generate an SBOM—attach it to your image! Using --sbom=true during build ensures the artifact travels everywhere your container goes. 🪪 Commando 4️⃣ The Valkyrie issues permanent, tamper-proof ID cards at the gates of Asgard. 🛡️ Meet the team: dockersecurity.io/co...

Find the vulnerabilities before you deploy. Cross-reference your SBOM against real-time CVE databases: $ docker scout cves <image> Commando 3️⃣ Jack, the Cyborg Soldier, acts as the ultimate scanner, hunting monsters on the perimeter. 🤖 Meet the team: dockersecurity.io/co...

You can't patch what you don't know you have. Generating an SBOM gives you full visibility into every component of your software supply chain. 📋 $ docker sbom <image> Commando 2️⃣ Rothütle demands a list of all Asgard residents to hunt down hidden CVEs. Meet the team: dockersecurity.io/co...

Stop writing insecure Dockerfiles from scratch. 🛑 Use docker init to automatically generate production-ready, secure foundations based on best practices. That's how Commando 1️⃣ Gord, the Swordmaster, builds her impenetrable command center in Asgard. ⚔️ Meet the team: dockersecurity.io/co...

My JavaPro article on "10 essential Docker commands to hunt the predator" is live! We cover: 📜 SBOMs & Attestations 🛡️ Hardened Images (DHI) 🚫 VEX Exemptions 🕵️‍♂️ Zero-Day Defenses Read the full Asgard mission here 👇 javapro.io/2026/03/1... #Docker #DevSecOps #Java #ContainerSecurity

My JavaPro article on "10 essential Docker commands to hunt the predator" is live! We cover: 📜 SBOMs & Attestations 🛡️ Hardened Images (DHI) 🚫 VEX Exemptions 🕵️‍♂️ Zero-Day Defenses Read the full Asgard mission here 👇 javapro.io/2026/03/1... #Docker #DevSecOps #Java #ContainerSecurity

Docker Commandos coming to Cologne. 💪 On April 20–23 I'll be at @JCON.one with my workshop: ☕ »Java Supply Chain Security with Docker« SBOMs. Attestations. Docker Hardened images. Cologne is in Carnival mode—so we're bringing the energy. 🎟️ 10% off with ARABI-VIP-15 CC @docker.com

Guess who's a verified book author on Medium! aerabi.medium.com

Docker Hardened Images are now free! FROM dhi‌.io‌/node:24 From this moment on, you can use the near-zero-CVE Docker images as your base images, for free! Learn more here:

Container Security Advent, day 7 is rather ceremonial. Like Sunday. 🎄⚔️🤠 Tip. Rebuild your Docker images regularly and keep your dependencies in check. dev.to/aerabi/-day-...

Container Security Advent, day 5 is here! 🌫️🌲👣 The fog thickens as Gord and Rothütle enter the valley toward Oberried… Today's security tip: Environment Drift—when small inconsistencies warp your whole system. dev.to/aerabi/day-5...

Container Security Advent, day 4 is here! 🍽️🌒👣 Tonight in Kirchzarten, Gord keeps vigil while the village sleeps… And our security tip dives into continuous monitoring.

Do I make a good Norse God? Jfokus people have created this avatar for me as I’m going to join them to talk about Docker Security. What do you think my Norse God name would be? A’rabír?

Container Security Advent, day 3 is here! 🪔📩🌃🌲

Day 2 of the DevSecOps Advent blog is here! 🕯️🚪📩📜 They get a typed letter!

So… I started an Advent series that mixes Gothic Black Forest storytelling with container security tips, because clearly I've gone crazy. 🎩🌲💀🐋 Day 1 is live:

Thank you, @aerabi.com, for gifting a copy of your newly published book, Docker and Kubernetes Security, and for bringing it all the way from Germany to Istanbul. I will go through it soon. If you want to learn @docker.com and Kubernetes security, I highly recommend this book.

🤯 Issue #24 of Git Weekly is LIVE! I was up until midnight finishing it, but it was worth it. 🏆 My book is an official DEVOPS DOZEN 2025 FINALIST! 🎉 Plus, a deep dive into 6 powerful git diff commands and news on the new India Edition print release. www.linkedin.com/pulse/24-git...

I just compiled a list of Docker security books for 2026. Did I miss anything?

Our next Docker meetup in Freiburg is announced! 📅 December 11th 🕕 18:00 CET 📍 Freiburg, JobRad's campus www.meetup.com/docke...

I'm really proud to announce that "Docker and Kubernetes Security" has been selected as a finalist in the Best DevOps Book of the Year category for the 2025 #DevOpsDozensAwards! 🏆 Please VOTE now for the ultimate honorees in 23 categories. www.surveymonkey.com...

I often share my wins—so here are some rejections too: 🧊 My #CNCF Ambassador application was rejected (because too many Ambassadors in Germany). ☕️ My @javaland.bsky.social talk was soft-rejected and put on the waiting list. Now I get to pay for both JavaLand and KubeCon! 😅

I finished #Hacktoberfest 2025 by creating an open-source book and got a Supercontributor badge for it. Stay tuned on the book! 📻 www.holopin.io/hacktoberfes...