Posts tagged #security
-
Why tempus.build builds its own runner image instead of using ubuntu-latest
GitHub's hosted-runner image is a VM image, not a container image, and it's built from floating versions. Here's why tempus.build builds its own: reproducibility and a verifiable supply chain, ubuntu-latest parity where it affects speed, deliberate deviations, and what the choice costs us.
-
The CI dependency layer: caching for speed, isolation for security
Installing dependencies is CI's speed lever and an attack surface. How a pull-through cache and a Kata VM handle both at tempus.build.
-
Managed GitHub Actions runners: an honest market map
GitHub-hosted is pricey and rounds minutes up. We compare Depot, Blacksmith, Namespace, Ubicloud and others on price, isolation, geography and supply chain.
-
Runner-image supply chain: how to verify the image your CI runs on
A runner image executes your code, so trust in it must be verifiable, not taken on faith. We break down the chain — digest pins, a trivy CVE gate, cosign keyless signing (Sigstore), an SBOM (CycloneDX) and SLSA provenance — and how to verify all of it yourself for tempus.build images.
-
Self-hosted runners or managed: the real cost
The total cost of CI ownership isn't the instance price. We break down the hidden costs of self-hosted GitHub Actions runners (idle, autoscaling, image patching, isolation) and compare them with tempus.build's per-second managed model — including where self-hosted wins.
-
Kata Containers 4.0: the runtime rewritten in Rust — what changes inside
In 4.0 the default Kata runtime becomes runtime-rs, in Rust instead of Go. What changes inside: how runtime-rs is built, what memory safety buys a host-side runtime, the new block storage model, and a verified rootfs via dm-verity/EROFS.
-
Kata Containers: how every CI job gets its own kernel
Ordinary containers share the host kernel. Kata Containers runs each pod in a lightweight VM with its own guest kernel — OCI-compatible, under containerd. A look at the Kata Containers architecture and why it's the right boundary for untrusted CI code.