2026-10-25 12:31 UTC
New blog post by me:
https://nheinz.eu/blog/2026/10/container-vulnerability-management/?ref=mastodon
How I manage my Containers and their Vulnerability Management across infrastructure and how the patching of PHP2SHELL looked like
#selfhosting #selfhosted #container #kubernetes #vulnerability #vulnerabilitymanagement #homelab #renovate #trivy #forgejo #forgejoactions #harbor #security
Replies (1)
-
Good writeup, especially the digest chain. One thing that would close the manual exploitability step you mention: record those "critical but not exploitable here" calls as VEX statements (OpenVEX or CSAF) tied to the image digest, rather than leaving them in your head. Harbor and Trivy can consume them, so the regular rescan shows the risks you have actually accepted instead of the same critical every time, while a newly published CVE still stands out as untriaged.