Linux & Cloud Security Architecture Blueprints

eBPF • Network Security

Cilium eBPF Host Routing & Tetragon Tracing

Bypass iptables overhead with eBPF O(1) packet routing and enforce in-kernel process termination.

# Install Cilium with eBPF Host Routing enabled
helm install cilium cilium/cilium \
  --namespace kube-system \
  --set kubeProxyReplacement=strict \
  --set bpf.masquerade=true

Read Full Blueprint →

Linux Security • Access Control

Linux Landlock LSM Unprivileged Sandbox

Restrict process filesystem access without requiring root (CAP_SYS_ADMIN) permissions.

/* Enforce NO_NEW_PRIVS and lock down Landlock Sandbox */
prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
syscall(__NR_landlock_restrict_self, ruleset_fd, 0);

Read Full Blueprint →

Zero-Trust • SSH Authentication

Vault SSH CA Short-Lived Certificates

Eliminate static authorized_keys by trusting HashiCorp Vault CA 8-hour SSH user certificates.

# Configure /etc/ssh/sshd_config to trust Vault CA
TrustedUserCAKeys /etc/ssh/trusted-user-ca.pub
AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u

Read Full Blueprint →

WebAssembly • Cloud-Native

WebAssembly (Wasm) WASI Runtime Isolation

Execute microservices inside linear memory sandboxes with nanosecond cold-start times.

# Execute Wasm module with explicit WASI capability grant
wasmtime run --dir /opt/app/data::/data \
  target/wasm32-wasip1/release/microservice.wasm

Read Full Blueprint →

Web Security • HTTP/3

HTTP/3 QUIC 0-RTT Replay Defense

Disable 0-RTT early data on state-modifying requests to prevent replay attack vectors.

# Reject 0-RTT Early Data on State-Modifying Routes
location /api/v1/payment {
    ssl_early_data off;
    proxy_pass http://127.0.0.1:8080;
}

Read Full Blueprint →

Supply Chain • Container Security

Sigstore Cosign Keyless Image Signing

Sign OCI container images keylessly in CI/CD using OIDC identity tokens and Rekor ledger.

# Verify Container Image Signature Keylessly
cosign verify \
  --certificate-identity "https://github.com/zyekhabdul/zyekh.com/.github/workflows/deploy.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/zyekh/secure-api:v2.0.0

Read Full Blueprint →