Spinning up Kubernetes via Nix to NixOS I

Introduction

This will be the first post in a series on how to deploy resources via Kubernetes on NixOS. First of all here are their definitions:

Kubernetes, also known as K8s, is an open source system for automating deployment, scaling, and management of containerized applications. ¹

and

Nix is a tool that takes a unique approach to package management and system configuration. […] reproducible, declarative and reliable systems. ²

These definitions are a bit unspecific. In this series I will highlight some of the benefits of using Kubernetes along side NixOS. This can be achieved by using easykubenix a software library written and authored by lillecarl.

But before I go into the details of how I set it up, I will make a small digression into the motivation of why I decided to invest time with it.

Attack of the Cryptojack

In late August of 2026 I received an alert via e-mail about CPU-Usage from Linode, a provider for virtual machines and cloud infrastructure, stating it was suspiciously high.

I logged into my server and checked the running processes and found following picture:

Something odd was going on inside within my server and taking up a lot of resources:

Was the attacker really having root rights on my server, I was bewildered by that thought. I always felt privileged by running NixOS and it turns out, he was only root in docker.

cat /proc/2103098/cgroup
0::/system.slice/docker-7eeda5717985234ad49bd00a448b605d0747b4004dc823490c4a533b840b9c53.scope

The container isolation has contained the movement space of the attack. I later found out the docker image in question was a known vector of attacks:

The Budibase server’s authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any request. The isWebhookEndpoint() function uses an unanchored regex that tests against ctx.request.url, which in Koa includes the full URL with query parameters. When the regex matches, the authorized() middleware immediately calls return next(), skipping all authentication, authorization, role checks, and CSRF protection.

This means a completely unauthenticated, remote attacker can access any server-side API endpoint by simply appending ?/webhooks/trigger (or any webhook pattern variant) to the URL. ³

I actually had a cryptomining prick on my system and was quite excited to engage in this opportunity.

Attack pattern of an adversary

Reading up further into the topic I stumbled over the website of James Brine, an Australian Cyber Threat Intelligence (CTI) expert who linked me to MITRE Engage and MITRE ATT&CK. They provide A Practical Guide To Adversary Engagement:

MITRE Engage is a framework for planning and discussing adversary engagement operations that empowers you to engage your adversaries and achieve your cybersecurity goals.⁴

MITRE ATT&CK® is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.⁵

MITRE ATT&CK postulates a scheme, which breaks an attack like cryptojacking and its applied techniques in a matrix. For containers in particular they’ve split the stages in the following table:

Arriving at Zero Trust

The attack used several commands and fallback commands to discover more system resources it could use. Most of these fallback commands would have not have worked if the attack had breached the docker isolation somehow, because in an NixOS environment you declare what will be installed and what not, so typical programs like cron might not be available or you’d find that /bin/ and /usr/bin are actually the places where executables normally live but more on this in the next post.

Looking up for applied security solutions and having the attack matrix in mind (there is also an engage matrix) I stumbled over Kubernetes and on how Kubernetes could divide each element of an Attack (or Engage) in manageable layers by applying principles from Zero Trust (NIST SP 800-207).

Zero Trust (ZT) is the term for an evolving set of Cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources. A Zero Trust Architecture (ZTA) uses zero trust principles to plan industrial and enterprise infrastructure and workflows.⁶

You should assume that as soon as you deploy an application into the world wide web, you should treat it as hostile and thus take measures guaranteeing the intended operation of your application. It also means the firewall perimeter is not the last line of defense, every path that goes into your application and outside of it needs to be managed within your sphere of influence. In short you should cater the following principles:

1. Understand the business outcomes of your application
2. Design with the mindset of ‘from inside out’
3. Determine who or what needs access
4. Continuous monitor and log what is going on ⁷

With all this reading up I came to the conclusion that I need to inherently change on how I deploy and manage my resources into the world wide web. I set the goal to rewrite my personal homepage (this blog) and to launch BudiBase once more, this time putting the screws on it. In another blog entry I will highlight on how I developed my infrastructure ‘from inside out’.

Stay tuned!