Containers on Tom Meurs

Supply Chain Security in GitLab CI: SBOM, cosign, and the Policy That Blocks

Tue, 29 Sep 2026 09:00:00 +0200

TL;DR A pipeline that scans images and writes an SBOM, with nothing checking either at admission, had been green for a year and had stopped nothing. Four steps below: an SBOM Trivy can read back, a cosign signature on the digest with the key in Vault, the SBOM attached as an attestation, and a Kyverno policy that refuses the rest. Then a table of which SLSA Build L3 requirements a self-hosted GitLab runner meets, and the two it doesn’t.

Simulation, Emulation, Virtualization, and Containers: The Restaurant Metaphor

Mon, 23 Feb 2026 20:18:00 +0100

TL;DR Simulation models a thing without running it. Emulation runs it by rebuilding the hardware in software. Virtualization runs several complete operating systems on one machine. Containers run several apps on one kernel. Below, one restaurant per term, a table, and the four mix-ups I hear most.

“So what’s the difference between a container and a virtual machine?”

I get this question a lot, usually from someone smart who’s been nodding along in meetings and doesn’t quite want to admit they’re fuzzy on it. The honest answer is that most explanations make it worse. They open with “hypervisor”, “kernel sharing” and “hardware abstraction”, and now the person has four new terms to be confused about instead of one.

When not to use Kubernetes

Sat, 17 Jan 2026 10:00:00 +0100

I write a lot about Kubernetes, and I run it at home every day. I like it.

So it might surprise you that I spend a fair amount of my time talking people out of it.

The situation I keep walking into goes like this. A small team, one product, a roadmap full of features customers are waiting for, and someone has decided the first milestone is a Kubernetes cluster. Three nodes minimum, etcd, a CNI , an ingress controller, cert-manager, a monitoring stack. Weeks of work before a single customer sees anything. Everyone nods along, because that’s what a serious setup is supposed to look like.

Container Image Scanning with Trivy in Your CI Pipeline

Sun, 08 Jun 2025 10:00:00 +0200

Pull a base image, copy in your code, push it to production. That’s the loop most of us run on autopilot. The part nobody looks at is the base image itself, which quietly drags in a few hundred packages you never chose. Any one of them could carry a known CVE , and you’d have no idea.

GitLab CI for Kubernetes: From Commit to Deployment

Thu, 15 May 2025 20:33:00 +0200

For a long time my CI lived on someone else’s servers. Push code, wait for a hosted runner, watch the minutes tick down against a monthly quota, hope the provider doesn’t change the rules next quarter. It worked, right up until I started asking where my source code actually sat while it was being built, and who else could see it.

So I moved GitLab in-house. I run it self-hosted now, on my own hardware, next to the clusters it deploys to. That’s sovereignty applied to CI/CD: my code, my builds, my artifacts, no vendor that can change pricing, deprecate a feature I depend on, or read my repositories without me knowing.