Security is a
practice.
Hands-on guides, honest lab notes, and defensive systems built to fail safely. Written for engineers, learners, and the relentlessly curious.
Explore the field notes Pick a failure. See what the control does.
CURRENT SCOPE / 04
- 01Container & Kubernetes security
- 02Detection engineering
- 03Secure self-hosting
- 04Cloud & identity
Control under test
What happens when it breaks.
Pick a failure. See what the control does. Results come from recorded tests and documented designs — none of it is a live simulation.
- Choose a failure condition.
- Compare the expected safe state with what the control does.
- Check the evidence behind the result:
- Design
- Design intent only
- Documented
- Written up; no recorded observed result
- Validated
- An observed result is recorded — whatever it showed
Guides from the lab
Building a fail-closed malware gate for automated downloads
How to keep untrusted files away from media services until scanning, verification, and release all succeed.
Proving a container can only reach the internet through a VPN
A practical verification method for network namespaces, kill switches, DNS behavior, and restart persistence.
A safer reverse proxy pattern for a private home lab
Split DNS, isolated listeners, internal TLS, and rollback planning without publishing services to the internet.
Selected builds
Systems under test.
Each system and the evidence behind it: what is only designed, what is documented, and what has a recorded observation.
- P-01
Fail-Closed File Intake
A staged malware-scanning pipeline that prevents downstream import until completion, scan, and move verification all pass.
Evidence- 1 Validated
- 4 Documented
5 failure paths- Documented: An incomplete transfer is never treated as completeReported as exercised — no recorded result
- Validated: A scanner outage blocks release instead of being skippedRecorded observed result
- Documented: A known-bad test file never reaches the release pathReported as exercised — no recorded result
- Documented: Two workers racing the same item cannot both release itReported as exercised — no recorded result
- Documented: A move that reports success without relocating the file is caught by verificationReported as exercised — no recorded result
- P-02
VPN-Isolated Workloads
A shared-network-namespace design with controlled LAN access, a documented tunnel-egress check, and a validated kill-switch test.
Evidence- 1 Validated
- 2 Documented
3 evidence records- Documented: The workload shares the VPN container's network namespace and has no independent route to the host gatewayReported as exercised — no recorded result
- Documented: Application egress matches the VPN service's public addressReported as exercised — no recorded result
- Validated: Stopping the tunnel blocks outbound access with no fallback to the host routeRecorded observed result
- P-03
Private Service Gateway
An internal reverse proxy with split DNS, isolated management access, internal TLS, backup, and a documented rollback plan.
Evidence- 1 Documented
1 evidence record- Documented: A commit-confirm or timed rollback restores the previous configuration if a host-interface change failsNo execution result claimed
- P-04
Kubernetes Parity Migration
A zero-change migration plan that preserves ports, paths, credentials, networking behavior, data, and recovery semantics.
Evidence- 1 Design
1 evidence record- Design: The migration preserves ports, paths, credentials, networking behavior, data, and recovery semanticsNo execution result claimed
Publication activity
Build log.
What changed, and when — publications and plans, not a live system feed.
- PublicationPublished “Building a fail-closed malware gate for automated downloads”
- PublicationPublished “Proving a container can only reach the internet through a VPN”
- PublicationPublished “A safer reverse proxy pattern for a private home lab”
- PlanKubernetes parity migration plan — in design, no production cutover yet