Search for a command to run...
Series
Notes from building network security that lives where the traffic does — in the kernel. This series covers the engineering behind enforcing zero-trust policy and capturing every flow across both Linux (eBPF) and Windows Server (WFP) nodes in Kubernetes: the boundaries of the prevailing tooling, the certification and signing gauntlet Windows kernel drivers demand, and the design decisions behind treating a mixed-OS cluster as one security domain.
Day two of Nyx being public. Yesterday was the announcement; today is the technical story behind the one claim in it that raises eyebrows: kernel-level network security with behavioural parity across Linux and Windows Server nodes. This post explains why that's rare, why it's hard, and how we approached it.
Part of the Kernel-Native Kubernetes Security series. Friday's post explained why Nyx's Windows enforcement runs as a Windows Filtering Platform callout driver in the kernel. This one is about what it took to make that driver legitimate — the certification gauntlet Microsoft requires before a production Windows Server kernel will load your code. It's a story about walls, and about the tool we built and open-sourced when we hit the last one.
Part of the Kernel-Native Kubernetes Security series. This one is not specifically about Nyx. It is about a security assumption hiding inside many Kubernetes clusters, and a free hands-on lab you can run on your laptop in about an hour.
