Linux
Xtables-addons: GeoIP, TARPIT and the psd Module I Ported
Extra iptables matches and targets the kernel never shipped: country blocking with geoip, a TARPIT decoy port, port knocking, and the psd scan detector I ported.
Topic
security
Web
How nginx Chooses a location Block: Prefixes, Regexes and ^~
Not first match, not longest match, but a mix of both. A test config where every location names itself shows exactly how nginx picks one, and where it surprises.
Programming
Python subprocess.run() Instead of os.system()
Why I convert os.system() calls to subprocess.run(): no shell injection, real exit codes, captured output, timeouts and input, with notes for Python 3.6.
Web
nginx try_files Explained: Static Sites and PHP Front Controllers
try_files checks files in order and only the last argument redirects. Static clean URLs, a PHP front controller with php-fpm, and the upload exploit it prevents.
Linux
Docker Volumes vs Bind Mounts, and the File Ownership Trap
Why a volume shows the image's files and a bind mount hides them, and how a root container leaves files your own user cannot edit or delete. Four tested fixes.
Linux
Docker Multi-Stage Builds: Smaller Images, Same Result
The same 147 kB binary in a 257 MB image or an 8.44 MB one. Multi-stage builds, named stages, a --target debug image, and why build secrets still leak.