Top all-time · #5424
Raesene’s Ramblings
Personal blog · raesene.github.io/blog · on HN as raesene9securitysystems
Raesene’s Ramblings is a personal blog at raesene.github.io about security and systems. Since 2014, 15 different Hacker News readers have linked it 43 times, most often “Fun with container images – Bypassing vulnerability scanners”. It is still writing: the last post was on 2026-10-08, and you can follow it by feed.
Too few sampled comments (5) to say how often HN recommends it.?
Why HN links it
HN readers link Raesene's blog posts on Kubernetes security and hardening, and on Docker socket risks, cited as sources or background for points in threads.
Summarised by Claude from a sample of 5 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Things that occur to me
Most-linked posts?
- Fun with container images – Bypassing vulnerability scanners2 people · 2 mentions · first linked 2023-12-30
- /blog/2016/10/08/Kubernetes-From-Container-To-Cluster/2 people · 2 mentions · first linked 2016-10-24
- Let's talk about Kubernetes on the Internet2 people · 2 mentions · first linked 2022-07-10
- Restricting Docker Access with a Reverse Proxy2 people · 2 mentions · first linked 2021-09-05
- Bitnami Deprecation2 people · 2 mentions · first linked 2025-08-21
- The Dangers of Docker.sock2 people · 2 mentions · first linked 2016-03-14
- Finding Security2 people · 2 mentions · first linked 2014-06-08
What Hacker News says?
You can connect to a remote Docker engine instance over SSH, which is easier to setup than exposing the Docker socket over a TCP port. So install the client inside WSL and the engine on a Linux VM. EDIT: https://raesene.github.io/blog/2018/11/11/Docker-18-09-SSH/ was a blog I wrote when that feature landed, AFAIK it works the same way now :)
Comment linking /blog/2018/11/11/Docker-18-09-SSH/
on “Docker Desktop no longer free for large companies”Submitted Bitnami Deprecation as a story · 4 points
HN discussionHi, I'd be very interested to hear if you've come across any good documentation on hardening Kubernetes? From what I've seen so far there's very limited documentation on that when compared to other components like Docker, and the defaults can sometimes not be suitable for a high security environment (e.g. https://raesene.github.io/blog/2016/10/08/Kubernetes-From-Co... )
Comment linking /blog/2016/10/08/Kubernetes-From-Container-To-Cluster/
on “Building a Bank with Kubernetes [slides]”Submitted Fun with container images – Bypassing vulnerability scanners as a story · 3 points
HN discussionGood to see they decided to delay a bit and do some brownouts first. I took a quick look at the Docker hub stats ( https://raesene.github.io/blog/2025/08/21/bitnami-deprecatio... ) and it looks like some of those images are still getting hundreds of thousands or even millions of pulls a week.
Comment linking /blog/2025/08/21/bitnami-deprecation/
on “The Deletion of Docker.io/Bitnami”Submitted Fun with Capabilities as a story · 3 points
HN discussionno worries, I've got some more info. on that on my blog https://raesene.github.io/blog/2017/05/01/Kubernetes-Securit... which may be of use.
Comment linking /blog/2017/05/01/Kubernetes-Security-etcd/
on “Kubernetes clusters for the hobbyist”Submitted Let's talk about Kubernetes on the Internet as a story · 3 points
HN discussionAccording to this: https://raesene.github.io/blog/2016/03/06/The-Dangers-Of-Doc... mounting the socket readonly doesn't help.
Comment linking /blog/2016/03/06/The-Dangers-Of-Docker.sock/
on “Backdoored images downloaded 5M times removed from Docker Hub”Submitted Beyond the surface – Exploring attacker persistence strategies in Kubernetes as a story · 2 points
HN discussionThis is one of the standards and compliance guides you can use for k8s. The other ones I'm aware of are - CIS Benchmarks, there's coverage for Kubeadm, AKS, EKS, GKE, OpenShift and some others. This is a compliance guide focused on just k8s - DISA STIG for Kubernetes, another compliance guide, they don't mention which distribution but it's kubeadm from looking at the paths mentioned. - PCI Guidance for containers an…
Comment linking /blog/2022/09/20/Assessing-Kubernetes-Clusters-for-PCI-Compliance/
on “Kubernetes Hardening Guidance [pdf]”Submitted Let's talk about Kubernetes on the Internet (2022) as a story · 2 points
HN discussionLink in parenthesis got broken: https://raesene.github.io/blog/2016/10/08/Kubernetes-From-Co...
Comment linking /blog/2016/10/08/Kubernetes-From-Container-To-Cluster/
on “Teaching Kubernetes”Submitted Taking a Look at Kubernetes Profiling as a story · 2 points
HN discussionOne thing that I think is very much still missing from the Kubernetes Documentation space is hardening guidelines. There's a lot of moving parts in there and some of the defaults for common install methods like kubeadm might be a bit of a surprise to people (e.g. the kubelet port being default open and allowing someone to take complete control of the cluster without authentication ( https://raesene.github.io/blog/20…
Comment linking /blog/2016/10/08/Kubernetes-From-Container-To-Cluster/)
on “Teaching Kubernetes”Submitted Fun with GitRepo Volumes as a story · 2 points
HN discussionFrom what I can see on an upgrade anyway, they don't seem to be enabled by default, but not hard to setup (I did a quick note for ubuntu https://raesene.github.io/blog/2016/02/04/Docker-User-Namesp... )
Comment linking /blog/2016/02/04/Docker-User-Namespaces/
on “Docker 1.10.0 is out”Submitted A Final Kubernetes Census as a story · 2 points
HN discussionso with two patreon style sites both of which say "we take security seriously" , until they have a breach, how would you judge which one would take better care of your data? The information (AFAIK) about their security mechanisms only got released as a result of the breach, so even assuming you knew what the terms were and how to judge good security from bad, you wouldn't have the information until the site got comp…
Comment linking /blog/2014/06/08/finding-security/
on “Gigabytes of user data from hack of Patreon donations site dumped online”Submitted PCI Guidance for Containers and Container Orchestration Tools as a story · 2 points
HN discussionThis article shows an interesting contrast between how different types of scanning tools address the issue of valid CVEs for which there are no updates. The question is "do you want to know about a valid CVE if there's no patch available"? For high security environments, the answer might be yes (you want to evaluate individual patches to see if they impact your application) For many environments the answer is likely…
Comment linking /blog/2020/06/21/Container_Vulnerability_Scanning_Fun/
on “The security scanner that cried wolf”Submitted Getting into a Bind with Kubernetes as a story · 2 points
HN discussionIt's worth noting that whilst vulnerability scanners are very useful, they pretty easy to bypass, if someone creates an image and doesn't want them to flag things up. One very basic example is https://raesene.github.io/blog/2023/04/22/Fun-with-container...
Comment linking /blog/2023/04/22/Fun-with-container-images-Bypassing-vulnerability-scanners/
on “Show HN: I built ContainerCVE – a web tool to scan public Docker images”Submitted Escalating Away – Kubernetes Roles Based Access System as a story · 2 points
HN discussionSo really big companies will/do have teams of VA people, also where they're a regulated industry so subject to things like PCI, I'd expect to see that as well. However as you say in the small company space, it's very hit or miss as to what effort can be put into this kind of work. The thing I'd say about services that do package vuln. scanning is that they can be useful but it's easy to get seduced by absolute sound…
Comment linking /blog/2014/11/17/want-to-improve-your-security-just-turn-off-ssl/
on “Docker Image Vulnerability Research”Submitted Changing Times – End of SMS Authentication? as a story · 2 points
HN discussionOne thing to watch out for, when using container scanning tools, is how they handle "unfixed" vulnerabilities in images based on Debian/Ubuntu. Both those distros maintain a list of CVEs that they know of but don't have a patch for. Traditional VA tools (e.g. Nessus) default to not flagging those, but a lot of container scanning tools will default to showing them, so you end up seeing wildly different results. (some…
Comment linking /blog/2020/11/22/When_Is_A_Vulnerability_Not_A_Vulnerability/
on “The Need for Slimmer Containers”Submitted Personal Software and BaremetalVMM as a story · 1 points
HN discussionDepending on what you need, it already does. Docker for Windows provides Linux (and Windows) Containers on a windows host, albeit the Linux containers run in a VM. you can access docker for windows from WSL by setting up TLS on the Docker engine interface ( https://raesene.github.io/blog/2018/03/29/WSL-And-Docker/ ) There's also some suggestions that some versions of the docker daemon can run on WSL with ubuntu http…
Comment linking /blog/2018/03/29/WSL-And-Docker/
on “Command Line and Windows Subsystem for Linux – The Windows 10 April Update”Submitted Do Containers Still Contain? as a story · 1 points
HN discussion
