Eight published images fanned out from a single registry. The published set reports zero findings at every severity: 8 images scanned, 0 findings, 14 application-layer fixes applied.
Curiosity is the most powerful thing you own
A beautiful narrative written over an elegant publishing platform. The story begins here...
Platform Engineering. Securing and running production systems across banking, gaming and e-commerce since 2011 — secure CI/CD, Kubernetes, MLOps, Observability. I write up the failures in detail: what broke, what the graphs showed, and what actually fixed it.
Home Labber — Notes from the Trenches
The Journey Begins here…
Selected work
Systems kept alive, and the ones that broke first. Every figure below is from the resume or from a post on this site.
- Reliability
99.9999% uptime across datacentre, AWS and Azure
Sysadmin team at India's largest fashion e-commerce platform — on-call rotation, revenue-impact metrics and PCI audit.
Six nines · hybrid infrastructure
- Incident
A Kubernetes node that served its own NFS mount
Memory pressure starved the NFS daemon the node itself depended on — a self-referencing deadlock that looked like a network fault.
1,172 zombie processes · load average 10× cores
- Cost
Cut cloud spend by finding what nobody was using
Billing analysis over AWS and Azure ETL, built in Python and Flask, surfacing overprovisioned and idle services.
25% reduction
- Compliance
Securing ISO 27001 certification
VAPT remediation and multi-AZ disaster recovery driven by Ansible. The certification unlocked further client contracts.
ISO 27001 · audited
- Platform
Secure CI/CD architecture for a national bank
OSA, SAST, DAST and a container trust registry, with policy as code catching issues before release rather than after.
Banking · current role
- Cost
Catching an AI agent ignoring its own rules
Instrumented the tool loop, found the gap where enforcement was never reached, and closed it with a pre-tool hook.
406M wasted tokens recovered
docker 69 to 67: The Honest Result of Remediating Distroless
Google Distroless has no shell, no apt and no dpkg. A full Debian 13 upgrade changes nothing and exactly one of its 64 OS findings has a fix published anywhere. This is the write-up of a remediation that cleared two findings for 0.1 MB, and of why that is the correct answer rather than a disappointi
docker Zero: The Image That Was Already Clean
Chainguard Hummingbird scans at zero findings in both layers. It was asked to be fixed anyway, so it was re-verified from its digest instead: 0 OS, 0 app, still booting in 8s, still non-root. The interesting part is why rebuilding a clean image would have been the wrong move.
java 1 Finding to Zero: The One-Line Dockerfile Fix for CVE-2026-46675
A published Java 21 Alpine base image looked permanently stuck at one UNKNOWN CVE. It was not unfixable — it was a stale package snapshot. One RUN apk upgrade cleared it for 3.1 MB.
java Java 21 Base Image Remediation Programme
Created: 2026-10-03 · Owner: hellodk · Status: image 1 of 3 complete
rhel 115 to 56: Remediating an Image That Cannot Patch Itself
UBI Micro scored 115 findings, 3 CRITICAL in Tomcat, and ships no rpm, dnf or microdnf — nothing inside it can upgrade anything. Building the fix outside and copying it in cleared 59 and introduced none, for +4.8% size. Three build bugs along the way, the last silently duplicating a 62 MB JAR.
rhel 895 to 575: Remediating Red Hat UBI 9 Full
The only image in the comparison with a package manager was also the worst offender at 895 findings. Its security channel turned out to be completely empty. A full dnf upgrade cleared 320 of them — and quietly introduced 20 new ones.
java 7 Java 21 Base Images Compared: 3 Are Genuinely Clean, the Smallest Cannot Be Fixed
One Spring Boot application built once and shipped across 7 Java 21 base images. Layer-split Trivy scans, boot-tested, digest-verified. 2 candidates return zero findings at every severity, and the smallest image in the set carries 8 HIGH findings with no published fix.
llm The 5.11 Tokens/Second Server
How an 18.5 GB MoE LLM was made usable on a 4 GB gaming laptop: measured 1.53 to 5.11 tokens/sec, then wrapped in rootless systemd supervision with restart backoff, log rotation and boot persistence. Real numbers, real config.
jenkins Jenkins on macOS: The GUI Session Agent — Complete Visual Guide
A complete, reproducible guide to running a Jenkins inbound agent inside the macOS GUI (Aqua) session: auto-login, keychain auto-unlock, launchd LaunchAgent plist, the codesign consent-prompt pitfalls — and a real macOS Tahoe case where codesign worked from Xcode but failed from Jenkins because the
opensre From Alert to Answer: An OpenSRE Usefulness Workshop — Plan & Live Demo Script
A 2-hour, hands-on workshop plan proving OpenSRE on a real org stack (Kubernetes, Nginx, NATS, YugabyteDB, Aerospike, Keycloak, Grafana, Tempo, Victoria Logs, Alertmanager, Jenkins, GitHub). impress.js slide deck that prints as a readable article.
ios Mobile Code Signing — The Complete Visual Guide (iOS + Android)
Every iOS executable must carry a cryptographic signature before the kernel will run it. The signature answers two questions on every launch: has this binary been modified since it was signed (integrity), and who signed it (authenticity).