# Jenkins Jenkins is an open-source automation server used for continuous integration, continuous delivery, building, testing, and deploying software. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Best Jenkins Alternatives in 2026 DevFeed: [Best Jenkins Alternatives in 2026]() Original publisher: [Read original article]() Author: Pete Miloravac Published: 2026-07-24T09:56:00Z Content type: article Language: en Sources: [Semaphore Engineering]() Topics: [CI/CD](), [Jenkins](), [Groovy](), [GitHub Actions](), [GitLab](), [Vulnerabilities](), [DevOps](), [Open Source]() Tags: [ci-cd](), [circleci](), [compare](), [devsecops](), [github-actions](), [gitlab](), [groovy](), [jenkins](), [open-source](), [security](), [security-vulnerabilities](), [self-hosted]() ### AI overview A 2026 guide compares Jenkins alternatives and explains why teams migrate away from Jenkins, citing maintenance overhead, plugin conflicts, Groovy pipeline complexity, and security-patch concerns. It highlights Semaphore, GitHub Actions, GitLab CI/CD, and CircleCI for different use cases. ### Source excerpt Jenkins earned its place as the default CI server of the 2010s: it was free, endlessly extensible, and available before any serious managed CI/CD competitor existed. More than a decade later, that same flexibility has become the thing teams complain about most -- plugin sprawl, Groovy pipeline scripts nobody wants to maintain, and infrastructure that [...] The post Best Jenkins Alternatives in 2026 appeared first on Semaphore. ## Nix flake check + JUnit = Junix DevFeed: [Nix flake check + JUnit = Junix]() Original publisher: [Read original article]() Author: Yajo Published: 2026-07-23T12:35:46Z Content type: release Language: en Sources: [Announcements - NixOS Discourse]() Topics: [Nix](), [ci](), [GitHub](), [GitHub Actions](), [GitLab](), [Jenkins]() Tags: [announcements](), [build](), [ci](), [github](), [github-actions](), [gitlab-ci](), [jenkins]() ### AI overview Junix converts Nix JSON output into standard JUnit XML reports, allowing Nix builds and checks to integrate with JUnit-compatible CI systems such as GitLab CI, Jenkins, and GitHub Actions. It can evaluate system checks, repeat failed evaluations for full tracebacks, build local checks, include logs, and print a human-readable summary. ### Source excerpt Hi all! I'd like to share Junix, a small tool that converts Nix @nix JSON output into standard JUnit XML so you can integrate Nix builds with any JUnit-compatible CI (GitLab CI, Jenkins, GitHub Actions, etc.). Try it: cd your/flake nix run gitlab:moduon/junix check -o result.xml This will: Eval all systems checks in one shot If any eval fails, repeat that check's eval to get full traceback Build local system checks Write the JUnit XML report in result.xml with check build logs and eval failure logs, if any Print a colorful human-readable summary 9 posts - 6 participants Read full topic ## Osmocom.org Servers - server outage of host3.osmocom.org DevFeed: [Osmocom.org Servers - server outage of host3.osmocom.org]() Original publisher: [Read original article]() Author: laforge Published: 2026-07-06T18:58:49Z Content type: news Language: en Sources: [Open Source Mobile Communications: News]() Topics: [servers](), [Debian](), [maintenance](), [upgrade](), [Jenkins]() Tags: [bug](), [debian](), [hosting](), [issue](), [jenkins](), [maintenance](), [outage](), [server](), [servers](), [tracker](), [update](), [upgrade]() ### AI overview Osmocom.org reports an outage affecting host3.osmocom.org during routine maintenance for a Debian upgrade. The host, which primarily serves Jenkins, downloads, and people subdomains, has fully recovered. ### Source excerpt We're currently experiencing some troubles during routine maintenance (Debian upgrade) of host3.osmocom.org, which is primarily hosting jenkins.osmocom.org, downloads.osmocom.org and people.osmocom.org. We ask for your patience while we try to resolve the situation. Update: host3 has fully recovered. ## hh.ru's Test Framework Experiments for Handling Flaky Tests DevFeed: [hh.ru's Test Framework Experiments for Handling Flaky Tests]() Original publisher: [Read original article]() Author: yzhanov (hh.ru) Published: 2026-05-07T07:10:11Z Content type: article Language: ru Sources: [HeadHunter RU]() Topics: [Jenkins](), [Job](), [ui]() Tags: [flaky](), [hh](), [hh-ru](), [jenkins](), [job](), [qa](), [qa-automation](), [qa-automation-engineer](), [qa-engineer](), [qa-management](), [qa-mobile](), [qa-testing](), [retry](), [tag-4adf7d504f34](), [tag-95a52fc82d81](), [tag-b7f0358ac141](), [tag-e34f6dec12c4](), [tag-e932065bc8da](), [ui]() ### AI overview An hh.ru engineer describes experiments in the test framework to reduce the impact of flaky tests on release automation. One experiment allowed repeated retries until the queue emptied; it added about three minutes to build time and was not adopted in production. ### Source excerpt Привет, Хабр! Меня зовут Юра Жанов, я занимаюсь автоматизацией тестирования в hh.ru. Про flaky-тесты написано много, борьбу с ними не прекращаем и мы. Но сегодня немного о другом -- хочу поделиться нашим опытом минимизации неприятностей, которые наносят такие тесты. Для этого мы провели ряд экспериментов со стороны тестового фреймворка. Читать далее ## Jenkins Series DevFeed: [Jenkins Series]() Original publisher: [Read original article]() Author: baeldung Published: 2026-04-03T12:36:55Z Content type: tutorial Language: en Sources: [Baeldung - Ops]() Topics: [Jenkins](), [Automation](), [CI/CD](), [Groovy](), [Scripting](), [Server](), [Open Source]() Tags: [administration](), [automation](), [ci-cd](), [docker](), [jenkins](), [jenkins-series](), [open-source](), [scripting](), [series](), [server]() ### AI overview A tutorial series covering Jenkins pipelines, job management, administration, Groovy scripting, parameterized and parallel builds, and server maintenance across the CI/CD lifecycle. ### Source excerpt This tutorial provides an overview of Jenkins pipelines, job management, and administration. Related Stories Git Series Troubleshoot Docker Daemon Connection Issues in Jenkins Troubleshooting Jenkins 403 No Valid Crumb in Request Error ## Odin: Dream11's Open-Source Deployment Platform Built After Jenkins Deployment Challenges DevFeed: [Odin: Dream11's Open-Source Deployment Platform Built After Jenkins Deployment Challenges]() Original publisher: [Read original article]() Author: Dream Blog Published: 2025-12-11T07:55:37Z Content type: article Language: en Sources: [Dream11 Engineering]() Topics: [Deployment](), [Jenkins](), [DevOps](), [Open Source](), [Testing](), [Microservice]() Tags: [deployment](), [developer](), [devops](), [dream-horizon](), [jenkins](), [microservices](), [open-source](), [tech](), [testing]() ### AI overview This article introduces Odin, Dream Horizon's open-source deployment platform from Dream11. It describes how Dream11 evolved from numerous Jenkins jobs to a deployment system intended to support building, testing, and deploying services through on-demand environments. The article identifies job complexity, limited support for virtual machines and Kubernetes, and the lack of a unified deployment-lifecycle vision as challenges in the earlier setup. ### Source excerpt By Suraj Gour and Ankit Pare Dream Horizon, our open-source effort to make Dream11's battle-tested tech available to every developer, brings you Odin -- a high-performance deployment platform that lets developers build, break, test, and ship smarter and more efficiently. Explore Odin here. Deployments at Dream11 have come a long way. From Jenkins jobs to on-demand environments, we have reimagined how services are built, tested and deployed. With Odin -- our new deployment system -- developers define what they need and deploy with confidence in seconds. This evolution started with key lessons from our earlier setup. Navigating Jenkins Mayhem: When Jobs Ran Wild It was a regular day at Dream11. A new joiner was browsing onboarding documents, trying to understand how to test their code alongside other dependent microservices, and then eventually deploy it live in production. They simply asked their teammate how to proceed. Here's how their conversation went: The newly joined developer (looking perplexed) asked: "My code is master-merged. How can I test the complete user authentication flow? And what are the steps I need to follow to get my feature live in production? I can't seem to find any documentation around this."The teammate (with a sympathetic sigh) replied: "Come with me. Let's talk to the DevOps team. They'll guide you and take you through the process."Upon reaching the DevOps team, our developer presented their request.The DevOps team (calmly, with the weariness of having answered this question several times) responded: "You want to push this code to production? Alright. We have a set of Jenkins jobs for this."The newly joined developer asked again: "And what about testing in a dev environment and performing a load test?"The DevOps team replied: "For load tests, we have... guess what... separate jobs!" Jenkins jobs introduced more complexity than clarity. More jobs meant greater uncertainty and longer turnaround times. Given our use case, we were running into recurr ## Expanding Chainguard VMs: Zero-CVE Application & Base Virtual Machine Images for Cloud and On-Prem DevFeed: [Expanding Chainguard VMs: Zero-CVE Application & Base Virtual Machine Images for Cloud and On-Prem]() Original publisher: [Read original article]() Published: 2025-09-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard vms](), [Cloud](), [on-prem](), [chainguard os](), [Java](), [Jenkins](), [nginx](), [Python]() Tags: [chainguard-vms](), [cloud](), [cloud-virtual-machines](), [cve](), [java](), [jenkins](), [nginx](), [on-prem](), [os](), [provenance](), [python](), [rebuilds](), [sbom](), [secure-by-default](), [security-vm-images](), [virtual-machine-images](), [zero-cves]() ### AI overview Chainguard VMs is expanding with zero-CVE application images for Jenkins, Nginx, and Squid Proxy, plus base images for Chainguard OS, Java, and Python. The virtual machine images support cloud and on-premises deployments and are continuously rebuilt from source with automated updates, CVE remediation, and SBOM-driven provenance attestations. ### Source excerpt Chainguard VMs is expanding with new Application and Base VM Images -- giving teams a secure, zero-CVE foundation to build and innovate faster. ## Watch the on-demand webinar: Shift left without the strain DevFeed: [Watch the on-demand webinar: Shift left without the strain]() Original publisher: [Read original article]() Author: Rob Samuels Published: 2025-07-14T13:00:00Z Content type: article Language: en Sources: [PortSwigger Blog]() Topics: [Application Security](), [CI/CD](), [Testing](), [Docker](), [GitHub Actions](), [GitLab](), [Jenkins](), [YAML](), [configuration]() Tags: [ci-cd](), [ci-cd-workflows](), [configuration](), [containers](), [docker](), [false-positives](), [github-actions](), [gitlab](), [jenkins](), [security](), [shift-left](), [software-delivery](), [yaml]() ### AI overview This article promotes an on-demand webinar about shifting application security left without slowing software delivery. It discusses the challenges of integrating DAST into CI/CD workflows, including slow scans, false positives, and workflow friction, and presents Burp Suite DAST as a fast, configurable, Docker-based solution that integrates with common pipeline tools. ### Source excerpt Shifting security left promises faster, safer software delivery - but for many teams, that promise is undercut by painful scan performance, false positives, and pipeline friction. In our recent webina ## Node.js Test CI Security Incident DevFeed: [Node.js Test CI Security Incident]() Original publisher: [Read original article]() Published: 2025-04-23T16:30:00Z Content type: article Language: en Sources: [Node.js Blog]() Topics: [incident](), [Node.js](), [ci](), [Jenkins](), [Security](), [Git](), [GitHub]() Tags: [ci](), [git](), [github](), [incident](), [jenkins](), [node-js](), [security](), [vulnerabilities](), [vulnerability]() ### AI overview Node.js reported a successful compromise of several test CI hosts after an attacker used a pull request and an outdated Git commit timestamp to cause Jenkins pipelines to execute altered fork code. The incident exposed a Time-of-Check-Time-of-Use vulnerability involving mutable Git references. The team restricted CI runs, rebuilt 24 compromised hosts, enforced commit SHA validation, audited 140 Jenkins jobs, and patched vulnerable GitHub workflows. ### Source excerpt Node.js® is a free, open-source, cross-platform JavaScript runtime environment that lets developers create servers, web apps, command line tools and scripts. ## The Three Stages of Software Maturity: From Hype to Abandonment DevFeed: [The Three Stages of Software Maturity: From Hype to Abandonment]() Original publisher: [Read original article]() Author: Dariusz Sadowski Published: 2025-03-15T12:32:17Z Content type: opinion Language: en Sources: [Thinking in Tech]() Topics: [Software](), [Open Source](), [Tooling](), [Jenkins](), [ci](), [Docker](), [Kubernetes](), [Security]() Tags: [ci](), [docker](), [java](), [jenkins](), [kubernetes](), [let-s-encrypt](), [open-source](), [software]() ### AI overview This opinion article proposes evaluating software maturity through maintenance activity, commercial support, ecosystem integrations, community knowledge, code quality, and culture. It contrasts Docker Swarm with Kubernetes after finding a Swarm Jenkins extension had not changed in four years and had an unresolved vulnerability. ### Source excerpt From Hype to Abandonment ## How Indeed Replaced Its CI Platform with Gitlab CI DevFeed: [How Indeed Replaced Its CI Platform with Gitlab CI]() Original publisher: [Read original article]() Author: Carl Myers Published: 2024-08-06T15:03:51Z Content type: article Language: en Sources: [Indeed]() Topics: [GitLab](), [CI/CD](), [Jenkins](), [Kubernetes](), [Amazon EC2](), [Amazon Web Services]() Tags: [aws](), [ci](), [ec2](), [gitlab](), [gitlab-ci](), [jenkins](), [kubernetes](), [unsorted]() ### AI overview Indeed's engineering platform evolved from Hudson to Jenkins and later encountered architectural and scaling limitations as the company grew and adopted AWS EC2 and Kubernetes. The article discusses replacing that CI platform with GitLab CI. ### Source excerpt Here at Indeed, our mission is to help people get jobs. Indeed is the #1 job site in the world with over 580M+ Job Seeker Profiles. For Indeed's Engineering Platform teams, we have a slightly different motto: "We help people to help people get jobs". As part of a data-driven engineering culture that has spent [...] ## Using a Portable Monitor for Home-Lab Debugging and Streaming DevFeed: [Using a Portable Monitor for Home-Lab Debugging and Streaming]() Original publisher: [Read original article]() Author: Alex Ellis Published: 2024-06-12T13:47:26Z Content type: opinion Language: en Sources: [Alex Ellis' Blog]() Topics: [Homelab](), [monitor](), [Raspberry Pi](), [Jenkins](), [Tooling](), [ci]() Tags: [ci](), [debugging](), [headless](), [home-lab](), [jenkins](), [portable](), [raspberry-pi](), [video]() ### AI overview The article explains why the author prefers a portable monitor for debugging headless home-lab computers, setting up Raspberry Pis, monitoring Jenkins CI pipelines, and managing streaming or product-demo software. ### Source excerpt I cover why as a one monitor kind of guy, I found a portable monitor essential - both for streaming and for debugging the home lab. ## Bazaarvoice Notification System for Transactional Email Delivery DevFeed: [Bazaarvoice Notification System for Transactional Email Delivery]() Original publisher: [Read original article]() Author: Someswar Bhowmick Published: 2024-04-24T10:24:56Z Content type: article Language: en Sources: [Bazaarvoice]() Topics: [notifications](), [Amazon Web Services](), [Amazon EC2](), [Amazon S3](), [AWS CloudFormation](), [Jenkins]() Tags: [aws](), [cloud](), [cloudformation](), [ec2](), [email](), [engineering](), [jenkins](), [notifications](), [s3](), [scalability](), [serverless](), [software-architecture]() ### AI overview Bazaarvoice describes its notification system for sending transactional email on behalf of clients. The article outlines data ingestion and a decision engine for scheduled delivery, then discusses operational challenges in its earlier AWS-based architecture, including EC2 scaling, updates, logging, and prolonged file-processing batch jobs. ### Source excerpt Bazaarvoice notification system stands as a testament to cutting-edge technology, designed to seamlessly dispatch transactional email messages (post-interaction email or PIE) on behalf of our clients. The heartbeat of our system lies in the constant influx of new content, driven by active content solicitations. Equipped with an array of tools, including email message styling, default [...] ## 8 tips for securing your CI/CD pipeline with Snyk DevFeed: [8 tips for securing your CI/CD pipeline with Snyk]() Original publisher: [Read original article]() Author: Eric Smalling Published: 2023-07-20T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [CI/CD](), [snyk](), [snyk-open-source](), [Application Security](), [GitHub Actions](), [Jenkins]() Tags: [application-security](), [blog](), [cheat-sheet](), [ci-cd](), [ci-cd-pipeline](), [devops](), [devrel](), [devsecops](), [enablement](), [github-actions](), [jenkins](), [security](), [snyk](), [snyk-open-source](), [snyk-platform](), [software-composition-analysis]() ### AI overview This cheat sheet presents eight tips for securing CI/CD pipelines with Snyk. It covers dependency and open-source component scanning, vulnerability detection, remediation guidance, and implementation examples for Jenkins and GitHub Actions. ### Source excerpt In this post, we'll cover using Snyk in your CI/CD pipelines to catch security issues quickly and empower your developers to fix them before they ever get to production. ## Using Teleport to Create and Maintain Shared Demo Environments DevFeed: [Using Teleport to Create and Maintain Shared Demo Environments]() Original publisher: [Read original article]() Author: info@goteleport.com (Steven Martin) Published: 2022-02-09T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Demo](), [DevOps](), [Cloud](), [Provisioning](), [Amazon EC2](), [Kubernetes clusters](), [Security](), [audit](), [Authentication](), [Authorization](), [Jenkins](), [AWS IAM]() Tags: [audit](), [authentication](), [authorization](), [aws](), [blog](), [cloud](), [demo](), [devops](), [ec2](), [iam](), [jenkins](), [kubernetes](), [kubernetes-clusters](), [maintenance](), [provisioning](), [solutions]() ### AI overview The Teleport Solutions Engineering team describes building a shared demo environment on Teleport Enterprise. The approach provides each engineer access to demo resources while controlling provisioning costs, supporting distributed Teleport clusters, and using just-in-time requests and auditing for administrative changes. ### Source excerpt This blog shows how the Teleport Solutions Engineering team uses Teleport to create and maintain shared demo environments. ## 10 Reasons You Need Teleport to Secure Your Apps on AWS DevFeed: [10 Reasons You Need Teleport to Secure Your Apps on AWS]() Original publisher: [Read original article]() Author: info@goteleport.com (Steven Martin) Published: 2021-11-29T00:00:00Z Content type: opinion Language: en Sources: [Teleport]() Topics: [Amazon Web Services](), [Security](), [AWS Management Console](), [Command-line interface](), [Provisioning](), [Amazon EC2](), [Amazon Elastic Kubernetes Service](), [Kubernetes](), [DevOps](), [GitLab](), [Jenkins](), [HashiCorp Vault]() Tags: [aws](), [aws-management-console](), [cli](), [devops](), [ec2](), [gitlab](), [hashicorp-vault](), [jenkins](), [kubernetes](), [provisioning](), [security](), [zero-trust-networking]() ### AI overview A promotional article presents ten reasons to use Teleport for securing applications and infrastructure access on AWS. The supplied sections describe identity-aware, role-based access controls for the AWS Management Console and CLI, temporary elevated access, access controls for EC2, databases, EKS clusters, and DevOps tools, plus zero-trust networking. ### Source excerpt Just in time for re:Invent 2021, here is the list of top 10 things you should know about AWS and Teleport. ## Setting Up CI / CD with Jenkins, Blue Ocean, Github for a Rust Program DevFeed: [Setting Up CI / CD with Jenkins, Blue Ocean, Github for a Rust Program]() Original publisher: [Read original article]() Author: Fuzzygroup Published: 2020-06-05T00:00:00Z Content type: tutorial Language: en Sources: [Scott Johnson]() Topics: [CI/CD](), [Jenkins](), [Rust](), [Git](), [GitHub](), [pull-requests](), [branch protection rules](), [Deployment](), [Ansible]() Tags: [ansible](), [blue-ocean](), [branch-protection-rules](), [cd](), [ci](), [ci-cd](), [cicd](), [deployment](), [git](), [github](), [jenkins](), [pull-requests](), [rust]() ### AI overview A tutorial for setting up CI/CD for a Rust codebase with Jenkins and the Blue Ocean plugin. It covers a Git workflow using feature, develop, and master branches, GitHub branch protection and pull requests, Jenkins deployment behind Nginx, and adding a Jenkinsfile. ### Source excerpt CI / CD or "Continuous Integration / Continuous Deployment" is the process of: taking a source code base running tests against it compiling it (if applicable) deploying it CI / CD is an ongoing process that runs continuously and responds to pull requests on your source code repo. In this blog post we are going to: Take a git repo with a Rust code base Run it thru CI / CD using Jenkins with the Blue Ocean plugin Compile it Deploy it I'm not using Circle CI or another hosted CI / CD system as our overall deploy strategy is complex and Ansible based. Step 1: Correct Git Work Flow The git workflow we are using is: master branch develop branch feature branch All work happens in feature branches. Feature branches are then merged into develop and develop is merged into master. The goal here is that the master branch is always kept pristine. This means that you need to make some change to your github settings: Github Settings / Branches / Default branch - needs to be set to develop Github Settings / Branches / Branch protection rules - develop needs to be protected Here's what you need to do: Create a git repo. Push the code base to it. Create a develop branch in the code base. Change into that branch. Push that branch also. Go to settings for the repo. Click on branches. Set develop as the default branch. Click on branch protection rules. Add develop as a protected branch. This will turn on require pull requests before merging and you can set the number of people who have to approve pull requests before the merge. Add master as a protected branch. For this one you don't want pull requests on; you just want master protected. Step 2: Test the Git Work Flow Now you want to go into your repo and: Create a feature branch, call it "readme", and create / update the readme for the repo. Then you want to push the branch Then you want to follow the pull request url on the branch and submit it by clicking Create Pull Request Step 3: Get Jenkins Setup Traditionally with Blue Ocean Set ## Installing Jenkins on Ubuntu 18 on AWS DevFeed: [Installing Jenkins on Ubuntu 18 on AWS]() Original publisher: [Read original article]() Author: Fuzzygroup Published: 2020-05-12T00:00:00Z Content type: tutorial Language: en Sources: [Scott Johnson]() Topics: [Jenkins](), [Ubuntu](), [Amazon Web Services](), [CI/CD]() Tags: [apt](), [aws](), [ci-cd](), [jenkins](), [linux](), [ubuntu]() ### AI overview A tutorial explains how to install Jenkins, an open-source CI/CD program, on Ubuntu 18 running on an AWS instance. It provides installation commands and outlines configuration steps including opening port 8080, accessing the Jenkins interface, confirming the password, selecting plugins, and creating an account. ### Source excerpt Jenkins is an Open Source CI / CD software program that you can easily install on an AWS instance. Here is how to install Jenkins: sudo apt install default-jre wget -q -O - http://pkg.jenkins-ci.org/debian/jenkins-ci.org.key | sudo apt-key add - sudo sh -c 'echo deb http://pkg.jenkins-ci.org/debian-stable binary/ > /etc/apt/sources.list.d/jenkins.list' sudo apt update sudo apt install jenkins sudo systemctl start jenkins Here are some additional useful commands: sudo systemctl status jenkins Here are the next steps you need to follow: Open a port in the AWS Security Group for your instance for port 8080 on 0.0.0.0/0 to allow http access to the Jenkins user interface. Go to the instance's IP address at port 8080 to run through the Jenkins installation. Confirm the Jenkins password per the instructions on screen. Select the plugins that you need for your Jenkins installation. Create your account and password. Sources Installing Jenkins Installing Java ## Rails Asset Pipeline Failures and Capistrano DevFeed: [Rails Asset Pipeline Failures and Capistrano]() Original publisher: [Read original article]() Author: Fuzzygroup Published: 2020-04-14T00:00:00Z Content type: opinion Language: en Sources: [Scott Johnson]() Topics: [Rails](), [Deployment](), [Amazon Web Services](), [Ansible](), [Jenkins](), [CI/CD]() Tags: [ansible](), [asset-pipeline](), [aws](), [capistrano](), [ci-cd](), [deploy](), [deployment](), [jenkins](), [rails]() ### AI overview The author describes troubleshooting a Rails application deployment on AWS after HatchBox failed and a Capistrano deployment appeared successful but produced a CSS-related 500 error. The article discusses a planned deployment approach involving Jenkins, Ansible, Capistrano, and other tools, but the supplied text does not include the final diagnosis or resolution. ### Source excerpt One of the single worst parts of being a one man show on an engineering effort is that when you hit a serious snag, well, you're fscked. I'm at the death march phase of a project, that wonderful stage, where you're so far into it that you can see the end but it seemingly never arrives - like the speed of light, it feels like you can never quite get there. Pro Tip: At this stage being asked by your manager, on a continuous basis, "anything that you can show me" is not helpful. It is actually an antipattern which simply slows the project by making the engineer feel even worse (yes I'm late and I can argue for scope creep, etc but I'll own it and I'm still late). Anyway I recently went through this with respect to getting a complex Rails code base deployed onto AWS. I started with my usual deploy tool of HatchBox but nothing worked and it was in the wee hours, and over a weekend, when I had no right to expect timely technical support so I figured "Ok I'll do a raw deploy with Capistrano" - and then the cluster fsck began in earnest. One of the general rules of technology is that everything is a two edged sword and where you get something, you give something. For example C gives outstanding performance and flexibility but it also can be a source of security issues, pointer bugs, buffer overflows, etc. Similarly Rails, even today, gives you: an unprecedentedly easy way to build web apps (provided you do it the Rails way) but deployment of modern Rails apps can be one of the most cursing laden experiences I've ever had The only easy way I've ever found to deploy Rails apps is HatchBox and HatchBox wasn't actually a good fit for this application due to particularly complex, multi language CI / CD requirements (4 different git repos spanning, today, two languages). The real deployment approach is going to be a combination of Jenkins + Ansible that drive Capistrano plus some other deployment tools. But I digress and have now devolved into a large number of words, more words ## How I gained commit access to Homebrew in 30 minutes DevFeed: [How I gained commit access to Homebrew in 30 minutes]() Original publisher: [Read original article]() Author: Remind Published: 2018-08-07T00:00:00Z Content type: article Language: en Sources: [Remind]() Topics: [Homebrew](), [Security](), [supply chain attacks](), [Jenkins](), [GitHub](), [Environment Variables](), [OAuth](), [GitHub API](), [incident]() Tags: [backdoor](), [credential-theft](), [curl](), [environment-variables](), [github](), [homebrew](), [incident](), [jenkins](), [npm](), [permissions](), [rubygems](), [security](), [supply-chain-attacks]() ### AI overview A security researcher describes gaining commit access to Homebrew repositories through a GitHub API token exposed in a publicly accessible Jenkins environment. The access was tested and then reported to Homebrew maintainers, highlighting risks to package-manager infrastructure and software supply chains. ### Source excerpt This issue was publicly disclosed on the Homebrew blog at https://brew.sh/2018/08/05/security-incident-disclosure/ Since the recent NPM, RubyGems, and Gentoo incidents, I've become increasingly interested, and concerned, with the potential for package managers to be used in supply chain attacks to distribute malicious software. Specifically with how the maintainers and infrastructure of these projects can be targeted as an attack vector. On Jun 31st, I went in with the intention of seeing if I could gain access to Homebrew's GitHub repositories. About 30 minutes later, I made my first commit to Homebrew/homebrew-core. Let's get leaky My initial strategy going in was based on credential theft; find if there were any credentials leaked by members of the Homebrew GitHub org. An OSSINT tool from Michael Henriksen called gitrob makes automating this search really easy. I ran it across the Homebrew organization, but ultimately didn't come up with anything interesting. Next, I took a look at previously disclosed issues on https://hackerone.com/Homebrew. From there, I found that Homebrew runs a Jenkins instance that's (intentionally) publicly exposed at https://jenkins.brew.sh. After some digging, I noticed something interesting; builds in the "Homebrew Bottles" project were making authenticated pushes to the BrewTestBot/homebrew-core repo: This got me thinking, "where are the credentials stored?". I noticed the "Environment Variables" link on the left, which led to an exposed GitHub API token: I tested it locally to see what scopes the token had: $ curl https://api.github.com/user/repos -u $GITHUB_API_TOKEN:x-oauth-basic | jq '.[] | {repo: .full_name, permissions: .permissions}' { "repo": "BrewTestBot/homebrew-core", "permissions": { "admin": true, "push": true, "pull": true } } { "repo": "Homebrew/brew", "permissions": { "admin": false, "push": true, "pull": true } } { "repo": "Homebrew/formulae.brew.sh", "permissions": { "admin": false, "push": true, "pull": true } } { " ## Personal Infrastructure DevFeed: [Personal Infrastructure]() Original publisher: [Read original article]() Published: 2017-12-16T15:25:24Z Content type: article Language: en Sources: [Jessie Frazelle]() Topics: [Homelab](), [CI/CD](), [Docker](), [Jenkins](), [docker registry](), [Docker Hub](), [Dockerfile](), [GitHub](), [Bash](), [make](), [Authentication](), [Git]() Tags: [authentication](), [automation](), [bash](), [ci](), [continuous-integration](), [docker](), [docker-hub](), [docker-registry](), [dockerfiles](), [git](), [github](), [home-lab](), [infrastructure](), [jenkins](), [make](), [personal](), [private-registry]() ### AI overview A personal infrastructure overview describing self-hosted continuous integration with Jenkins, automated Jenkins DSL generation, a Postfix server, and a private Docker registry with image signing, authentication, and vulnerability scanning. ### Source excerpt This post is kind of like "part two" on my series on all the weird things I do for my personal infrastructure. If you missed "part one", you should check out Home Lab is the Dopest Lab. I run a lot of little things to make my life easier, like a CI, some bots, and a bunch of services just for the lolz. This post will go over all of those. These run scattered across my NUCs and the cloud. Let's start with the most useful. Continuous Integration I host my own continuous integration server. Yes, you guessed it... it's Jenkins. I use the Jenkins DSL plugin to keep everything in sync. You can find all my DSLs in my repo github.com/jessfraz/jenkins-dsl. This has all the configurations for views, keeps forks up to date, mirrors all my repositories to private git (more on this in git), builds all Dockerfiles to push to Docker Hub and my private registry (more on this in private docker registry) and a bunch of maintenance scripts. The Makefile in this repo calls out to bash scripts which generate new DSLs for any new GitHub repos I create. Yep I even generate the automation... There's a bunch of other fun things in there as well that you can discover by poking around yourself. I host my own postfix server alongside Jenkins. You can find the postfix docker image at r.j3ss.co/postfix or the Dockerfile. It's super minimal and less gross than literally every other postfix image in existence. You can run it with: $ docker run --restart always -d \ --name postfix \ --net container:jenkins \ -e "ROOT_ALIAS=root@blah.com" \ -e "RELAY=[smtp-relay.gmail.com]:587" \ -e "TLS=1" \ -e "MY_DESTINATION=...., localhost" \ -e "MAILNAME=blah.com" \ r.j3ss.co/postfix Private Docker Registry I host my own private docker registry with my own notary server and authentication server. Why? Well because about 4 years ago when I started using docker, Docker Hub was super slow and I came to love having my own super fast one. I still push all the images to both Docker Hub and my registry and both are signed ## Automating trivago's Tech Blog Deployment Process DevFeed: [Automating trivago's Tech Blog Deployment Process]() Original publisher: [Read original article]() Author: Busra Koken Software; Backend Engineer; Learning Every Day; Writing Stories Published: 2017-12-07T00:00:00Z Content type: article Language: en Sources: [Trivago]() Topics: [Deployment](), [Automation](), [Hugo](), [Jenkins](), [GitHub Pages](), [Markdown](), [DevOps](), [Pull Request](), [Code review]() Tags: [automation](), [backend](), [code-review](), [deployment](), [devops](), [github-pages](), [hugo](), [markdown](), [release-engineering]() ### AI overview This article explains how trivago maintained its Hugo-generated tech blog, hosted it on GitHub Pages, and automated its deployment process. It describes the previous manual workflow, its bottlenecks, and improvements including storing a Jenkins pipeline in the blog repository. ### Source excerpt We do think that our tech blog is full of interesting things powered by our engineers' great stories. Let us take you on a journey of how we maintain trivago tech blog from the technical perspective and how we recently automated its deployment process. ## How (and Why) We Moved to Spinnaker DevFeed: [How (and Why) We Moved to Spinnaker]() Original publisher: [Read original article]() Author: Target Brands, Inc Published: 2017-04-07T05:00:00Z Content type: article Language: en Sources: [Target]() Topics: [CI/CD](), [Cloud](), [Jenkins](), [Provisioning](), [Terraform](), [Microservices](), [Apache Cassandra](), [Persistence](), [Cache](), [Git]() Tags: [automation](), [cassandra](), [ci-cd](), [cloud](), [deployment](), [engineering](), [git](), [jenkins](), [microservices](), [redis](), [spinnaker](), [terraform]() ### AI overview Target describes moving portions of target.com from a homegrown cloud deployment platform to Spinnaker after evaluating CI/CD platforms. The team selected Spinnaker for its Jenkins integration, multi-cloud deployment support, and use of immutable images, then adapted its architecture with Terraform, cloud storage, and managed caching to support resilient, highly available operation. ### Source excerpt Background Just after the middle of last year, Target expanded beyond its on-prem infrastructure and began deploying portions of target.com to the cloud. The deployment platform was homegrown (codename Houston), and was backed wholly by our public cloud provider. While in some aspects that platform was on par with other prominent continuous deployment offerings, the actual method of deploying code was cumbersome and not adherent to cloud best practices. These shortcomings led to a brief internal evaluation of various CI/CD platforms, which in turn led us to Spinnaker. We chose Spinnaker because it integrates with CI tools we already use at scale (Jenkins), supports deploying to all major public cloud providers, and compels software deployment best practices - all deployments are performed via immutable images, a snapshot of config + code. Supporting a Platform The primary goal of Target's cloud platform is to enable product teams to deploy and manage their applications across multiple cloud providers. We provide CI/CD, monitoring, and service discovery as services, and any application deployed via our platform gets those capabilities via a base image that is pre-configured for connectivity to each service's respective endpoint. Since these components are essentially products we provide to internal customers, we had to ensure the new CD platform was operationally supportable and highly-available. So, as soon as we decided on Spinnaker, a handful of engineers from the Cloud Platform group set about making this happen. Default Spinnaker scripts make it easy to standup a single self-contained server with the microservices and persistence layer all together, but that wasn't conducive to doing blue-green deployments - allowing updates of Spinnaker without downtime to our internal customers. We built jobs for building packages based off the master branch of each Spinnaker component's upstream git repository, and wrote Terraform plans to manage the deployment of each stack. ## Keep your stuff up to date DevFeed: [Keep your stuff up to date]() Original publisher: [Read original article]() Published: 2017-03-30T00:00:00Z Content type: tutorial Language: en Sources: [Paweł Chudzik]() Topics: [Gradle](), [Maven](), [ci](), [npm](), [Jenkins](), [Development](), [Security]() Tags: [automated](), [best-practices](), [ci](), [dependencies](), [external](), [gradle](), [jenkins](), [maven](), [npm](), [security]() ### AI overview A practical guide to keeping Maven, Gradle, and npm dependencies up to date using automated CI checks, configurable thresholds, commit hooks, and dependency-reporting tools. ### Source excerpt Every codebase depends on multiple external libraries. It is a good idea to stay up to date with external dependencies. It is important to update all security related stuff and it might be helpful or fun to use latest features. I'm going to share my way of staying up to date with external dependencies in maven, gradle and npm. Read more [Next page]()