Userspace CNI - Developing in the Open with Remaining Secure
summary
A neglected userspace CNI repo is restored to build and to CI by updating out‑of‑date dependencies, fixing broken API calls, deleting an accidental binary, and adding workflows; security is raised using the openssf scorecard and Step Security recommendations, with dependabot enabled and fuzzing in place. CI runs on self-hosted hugepage runners because GitHub runners lack hugepage support. The repo moves Ubuntu from 22.04 to 24.04 and reaches a score 9.4 up from roughly 3–4.
AI-written summary · about
chapters (9)
- 0:00Introduction to Userspace CNI
- 1:51Project background and challenges
- 3:21Security scorecard requirements
- 6:11Low-priority security improvements
- 7:57Quick wins for security score
- 9:46Reusable workflow templates
- 10:51Security overview and CI setup
- 12:58Self-hosted CI for Userspace CNI
- 14:10Current state and future
related talks
17mBuilding Secure Open Source Communities From the Ground Up
48mImproving the Security of a Large Open Source Project One Step...
29mSecuring C code that seems to work just fine
43mCIP (Civil Infrastructure Platform): Reusing and Strengthening OSS Component Securi...
24mIntro: CNCF CI
08mClosing Remarks
43mAdventures in Securing an Open Source Project: From Repo Security Zero...
40mCloud Native Security: A New Paradigm for a New World