Devsecops on t0ul

Ship, Securely, Ch. 1: Getting Started

Tue, 02 Sep 2025 00:00:00 +0000

Part of Ship, Securely, a hands-on DevSecOps book.

This chapter does two things. First it explains the idea the rest of the book runs on: security built into the pipeline, not bolted on at the end. Then it gets your machine ready to practice it, with Go, Make, an editor, Docker, and a local Kubernetes cluster to deploy into.

Security in the pipeline, not after it

DevOps is a simple idea with a lot of machinery behind it. Development and operations work as one team, and software ships in small, frequent changes that flow through an automated pipeline: build, test, release, repeat. The pipeline is the product. Code only counts once it is running somewhere, so everything that gets it there is scripted, versioned, and repeatable.

Ship, Securely, Ch. 2: DevSecOps in Action

Tue, 09 Sep 2025 00:00:00 +0000

Part of Ship, Securely, a hands-on DevSecOps book.

Getting tools to run is the easy part. This chapter is about making sense of their output, and turning it into a decision instead of a backlog.

Getting Started

Now, let’s clone the repo and make sure that everything works.

Clone the repository

Ship Securely DevSecOps Starter

Why this book is local-first

Zero cloud accounts, zero ongoing cost, predictable setup.
Everyone’s laptop is the same “platform”: Docker + Minikube + Make.
Artifacts saved locally → easy “audit packet” and reproducible labs.

What you’ll install (once)

Git, Docker Desktop (or Docker Engine), Make, Go, Minikube.
Optional: VS Code (recommended).

Repo layout (quick tour)

ship-securely-starter/
├─ app/
│ ├─ main.go
│ ├─ go.mod
│ └─ Dockerfile
├─ infra/
│ ├─ docker/
│ │ └─ compose.yaml
│ └─ k8s/
│ ├─ deployment.yaml
│ ├─ service.yaml
│ └─ kustomization.yaml
├─ tools/
│ └─ zap/
│ └─ README.md # place ZAP context/auth if needed
├─ artifacts/ # CI reports written here (generated)
├─ .pre-commit-config.yaml
├─ .gitignore
├─ Makefile # `make ci`, `make cd`, mk-* targets
└─ README.md

Chapter 2: Make CI

First run (CI on your laptop)

# macOS/Linux
make ci

Windows (PowerShell)

make ci

what you should see

docker build -t ship-securely/app:dev app
[+] Building 1.2s (14/14) FINISHED docker:desktop-linux
 => [internal] load build definition from Dockerfile 0.0s
 => => transferring dockerfile: 645B 0.0s
 => [internal] load metadata for docker.io/library/golang:1.22-alpine 0.4s
 => [internal] load metadata for docker.io/library/alpine:3.20 0.4s
 => [internal] load .dockerignore 0.0s
 => => transferring context: 2B 0.0s 
 => [build 1/4] FROM docker.io/library/golang:1.22-alpine@sha256:1699c10032ca2582ec89a24a1312d986a3f094aed3d5c1147b19880afe40e052 0.0s 
 => [stage-1 1/4] FROM docker.io/library/alpine:3.20@sha256:765942a4039992336de8dd5db680586e1a206607dd06170ff0a37267a9e01958 0.0s 
 => [internal] load build context 0.0s 
 => => transferring context: 2.02kB 0.0s 
 => CACHED [build 2/4] WORKDIR /src 0.0s 
 => [build 3/4] COPY . . 0.0s 
 => [build 4/4] RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build - 0.7s 
 => CACHED [stage-1 2/4] RUN adduser -D -u 10001 appuser 0.0s
 => CACHED [stage-1 3/4] WORKDIR /home/appuser 0.0s 
 => [stage-1 4/4] COPY --from=build /out/server /usr/local/bin/server 0.0s 
 => exporting to image 0.0s 
 => => exporting layers 0.0s 
 => => writing image sha256:f72451a65103493a2c99c0b63a3768c21af2fdd1c5679e69b96d8878fc18d3fb 0.0s 
 => => naming to docker.io/ship-securely/app:dev 0.0s 
 
View build details: docker-desktop://dashboard/build/desktop-linux/desktop-linux/t419rs4ety3zd51i77w098cc0

What's next:
 View a summary of image vulnerabilities and recommendations → docker scout quickview 
== Hadolint (Dockerfile) ==
docker run --rm -i hadolint/hadolint < app/Dockerfile > artifacts/hadolint.txt || true
== Semgrep (SAST) ==
docker run --rm -v /Users/t/go/src/ship-securely-starter:/src returntocorp/semgrep semgrep --config p/owasp-top-ten --sarif --output /src/artifacts/semgrep.sarif /src/app || true
 
 
┌─────────────┐
│ Scan Status │
└─────────────┘
 Scanning 3 files tracked by git with 542 Code rules:
 
 Language Rules Files Origin Rules 
 ───────────────────────────── ─────────────────── 
 <multilang> 5 3 Community 542 
 go 38 1 
 dockerfile 4 1 
 
 
 
┌──────────────┐
│ Scan Summary │
└──────────────┘
✅ Scan completed successfully.
 • Findings: 1 (1 blocking)
 • Rules run: 47
 • Targets scanned: 3
 • Parsed lines: ~100.0%
 • No ignore information available
Ran 47 rules on 3 files: 1 finding.
== Gitleaks (secrets) ==
docker run --rm -v /Users/t/go/src/ship-securely-starter:/work zricethezav/gitleaks:latest detect -s /work -r artifacts/gitleaks.json --no-banner || true
4:09PM FTL Report path is not writable: artifacts/gitleaks.json error="open artifacts/gitleaks.json: no such file or directory"
== Checkov (IaC) ==
docker run --rm -v /Users/t/go/src/ship-securely-starter:/work bridgecrew/checkov -d /work/infra --output-file-path artifacts/checkov.json || true


 _ _
 ___| |__ ___ ___| | _______ __
 / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | | __/ (__| < (_) \ V /
 \___|_| |_|\___|\___|_|\_\___/ \_/

By Prisma Cloud | version: 3.2.476 
Update available 3.2.476 -> 3.2.477
Run pip3 install -U checkov to update 


kubernetes scan results:

Passed checks: 83, Failed checks: 7, Skipped checks: 0

Check: CKV_K8S_75: "Ensure that the --authorization-mode argument includes Node"
 PASSED for resource: Deployment.default.app
 File: /k8s/deployment.yaml:1-48
 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/ensure-that-the-authorization-mode-argument-includes-node
Check: CKV_K8S_70: "Ensure that the --token-auth-file argument is not set"
 PASSED for resource: Deployment.default.app
 File: /k8s/deployment.yaml:1-48
 Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/kubernetes-policies/kubernetes-policy-index/ensure-that-the-token-auth-file-parameter-is-not-set

Chapter 2: Make CD

Deploy Locally (CD to Minikube)

make cd

What you should see

t@Mac ship-securely-devsecops % make cd
⛵ Minikube (ship) is running
docker build -t ship-securely/app:dev app
[+] Building 0.3s (15/15) FINISHED docker:desktop-linux
 => [internal] load build definition from Dockerfile 0.0s
 => => transferring dockerfile: 876B 0.0s 
 => [internal] load metadata for docker.io/library/alpine:3.20 0.3s 
 => [internal] load metadata for docker.io/library/golang:1.22-alpine 0.3s
 => [internal] load .dockerignore 0.0s
 => => transferring context: 2B 0.0s 
 => [build 1/4] FROM docker.io/library/golang:1.22-alpine@sha256:1699c10032c 0.0s 
 => [stage-1 1/5] FROM docker.io/library/alpine:3.20@sha256:765942a403999233 0.0s 
 => [internal] load build context 0.0s 
 => => transferring context: 447B 0.0s 
 => CACHED [stage-1 2/5] RUN addgroup -g 10001 app && adduser -D -H -u 10001 0.0s 
 => CACHED [stage-1 3/5] WORKDIR /home/appuser 0.0s 
 => CACHED [build 2/4] WORKDIR /src 0.0s 
 => CACHED [build 3/4] COPY . . 0.0s 
 => CACHED [build 4/4] RUN --mount=type=cache,target=/go/pkg/mod --mount 0.0s 
 => CACHED [stage-1 4/5] COPY --from=build /out/server /usr/local/bin/server 0.0s 
 => CACHED [stage-1 5/5] RUN chown -R 10001:10001 /home/appuser 0.0s 
 => exporting to image 0.0s 
 => => exporting layers 0.0s 
 => => writing image sha256:7e699d375101f7b1246378e22a53a70e9d89f63138a7f666 0.0s 
 => => naming to docker.io/ship-securely/app:dev 0.0s 
 
View build details: docker-desktop://dashboard/build/desktop-linux/desktop-linux/ipq16egtws0nkd6twx07u5xs7

What's next:
 View a summary of image vulnerabilities and recommendations → docker scout quickview 
minikube -p ship image load ship-securely/app:dev
kubectl get ns ship >/dev/null 2>&1 || kubectl create ns ship
service/app unchanged
deployment.apps/app unchanged
kubectl -n ship set image deploy/app app=ship-securely/app:dev
kubectl -n ship rollout status deploy/app
deployment "app" successfully rolled out
== OWASP ZAP (baseline via port-forward) ==
( kubectl -n ship port-forward deploy/app 8080:3000 >/dev/null 2>&1 & echo $! > .pf.pid )
Port-forward is live
ZAP target: http://host.docker.internal:8080
Using the Automation Framework
WARN-NEW: Missing Anti-clickjacking Header [10020] x 6 
WARN-NEW: X-Content-Type-Options Header Missing [10021] x 7 
WARN-NEW: Content Security Policy (CSP) Header Not Set [10038] x 7 
WARN-NEW: Storable and Cacheable Content [10049] x 8 
WARN-NEW: Permissions Policy Header Not Set [10063] x 7 
WARN-NEW: Modern Web Application [10109] x 1 
WARN-NEW: Insufficient Site Isolation Against Spectre Vulnerability [90004] x 19 
FAIL-NEW: 0 FAIL-INPROG: 0 WARN-NEW: 7 WARN-INPROG: 0 INFO: 0 IGNORE: 0 PASS: 60
✅ Deployed app to Minikube (ship) in namespace ship

Evidence Packet

Open ./artifacts/ and skim:

Ship, Securely, Ch. 3: Reviewing Results

Tue, 16 Sep 2025 00:00:00 +0000

Part of Ship, Securely, a hands-on DevSecOps book.

Chapter 3. Reviewing Results

SAST — Static Application Security Testing

What it is
SAST analyzes source code without executing it to find risky patterns (e.g., unsanitized inputs, unsafe APIs). In this project we use Semgrep (via the sast target) to scan the Go app and write results to artifacts/semgrep.json.

Why we need it
Catches code-level flaws early, while they’re cheap to fix, and shifts security left. Typical hits: injection, XSS, insecure crypto, unsafe deserialization, etc.

Ship, Securely, Ch. 4: Ratcheting and Supply-Chain Hardening

Tue, 23 Sep 2025 00:00:00 +0000

Part of Ship, Securely, a hands-on DevSecOps book.

Chapter 4. Trivy Image Workflow

1) Build → Scan → Decide (quarantine first)

Tag every fresh build as quarantine until it passes policy.

Makefile additions

QUAR := $(IMAGE_REPO):quarantine-$(SHA)
GOOD := $(IMAGE_REPO):good-$(TAG)

build:
	docker build -t $(IMAGE) app
	docker tag $(IMAGE) $(QUAR) # mark as quarantine by default

sca:
	@echo "== Trivy (image scan) =="
	docker run --rm -v $(PWD):/workspace \
	 -v $(PWD)/.trivy-db:/root/.cache/trivy \
	 aquasec/trivy:latest image --ignore-unfixed \
	 --format json -o /workspace/artifacts/trivy-image.json $(QUAR) || true

We scan $(QUAR) specifically so it never accidentally ships before review.

Ship, Securely, Ch. 5: Kubernetes Runtime Security

Tue, 30 Sep 2025 00:00:00 +0000

Part of Ship, Securely, a hands-on DevSecOps book.

Chapter 5. Kubernetes Configuration Testing

Why this step

Catching issues in infra/k8s/*.yaml before kubectl apply is cheap and fast. These tools complement each other:

kube-linter: opinionated rules → SARIF (great for PR review).
kube-score: human-readable “why” explanations.
Checkov: policy-as-code across K8s/Terraform/etc. (already in CI).

Run it

# from repo root
make k8s-audit

What you’ll see

Ship, Securely, Ch. 6: Conclusion

Tue, 07 Oct 2025 00:00:00 +0000

Part of Ship, Securely, a hands-on DevSecOps book.

Chapter 6. Conclusion and Next Steps

You just built a local-first DevSecOps stack that runs anywhere a laptop does. It ships a working app on day one, grows in small, testable waves, produces evidence for every step, and hardens both your supply chain and runtime without cloud spend.

This chapter helps you (1) summarize what you’ve built, (2) ratchet quality safely, (3) map your make targets to a hosted CI, and (4) roll it out with sane ownership, SLAs, and audit-ready artifacts. Finally, you’ll get a compact “what’s next” backlog.

Ship, Securely: Appendix

Tue, 14 Oct 2025 00:00:00 +0000

Part of Ship, Securely, a hands-on DevSecOps book.

Appendix: Image Signing — Offline Digest vs Registry Signatures

Two ways to prove “what we built is what we run”:

A) Offline (no registry): sign the image digest as a blob

What it proves: You signed the SHA256 digest of the promoted image (GOOD).
Where the signature lives: In your repo as artifacts/image-digest.bundle (not attached to the image).
When to use: Air-gapped demos, workshops without a registry, or when you only need an evidence pack (auditors/customers).
Limitations: Admission controllers (Kyverno) can’t verify this at deploy time because the signature isn’t stored alongside the image.

B) Registry signatures (recommended for class): sign the image reference in a registry