Starting a new blog

Wed, 07 Oct 2026 00:00:00 GMT

Studying Media technology has introduced me to a wealth of ideas and topics. Most of them I learned can be realized by open source contributions. For me open source is the idea that people around the planet are able to participate together in an engaging and somewhat unrestricted way. Most of the time this addresses digital technology. I started this blog with the idea to refer to some of these ideas in the spirit of what I've learned regarding my engagement.

Spinning up Kubernetes via Nix to NixOS I

Wed, 07 Oct 2026 00:00:00 GMT

## Introduction This will be the first post in a series on how to deploy resources via `Kubernetes` on `NixOS`. First of all here are their definitions: > Kubernetes, also known as K8s, is an open source system for automating deployment, scaling, and management of containerized applications. [^fn:1] and > Nix is a tool that takes a unique approach to package management and system configuration. [...] reproducible, declarative and reliable systems. [^fn:2] These definitions are a bit unspecific. In this series I will highlight some of the benefits of using Kubernetes along side NixOS. This can be achieved by using [easykubenix](https://discourse.nixos.org/t/nixifying-kubernetes-with-nix-csi-easykubenix-and-dinix/70899) a software library written and authored by [lillecarl](https://lillecarl.com/). But before I go into the details of how I set it up, I will make a small digression into the motivation of why I decided to invest time with it. ## Attack of the Cryptojack In late August of 2026 I received an alert via e-mail about CPU-Usage from [Linode](https://www.linode.com/), a provider for virtual machines and cloud infrastructure, stating it was suspiciously high. I logged into my server and checked the running processes and found following picture: ![Suspicious Processes](/images/kubernetes-on-nixos/htop-cryptojack.png) Something odd was going on inside within my server and taking up a lot of resources: ![High consumption of resources](/images/kubernetes-on-nixos/lxrt-resources.png) Was the attacker really having root rights on my server, I was bewildered by that thought. I always felt privileged by running NixOS and it turns out, he was **only** root in `docker`. ```bash cat /proc/2103098/cgroup 0::/system.slice/docker-7eeda5717985234ad49bd00a448b605d0747b4004dc823490c4a533b840b9c53.scope ``` The container isolation has contained the movement space of the attack. I later found out the docker image in question was a known vector of attacks: > The Budibase server's authorized() middleware that protects every server-side API endpoint can be completely bypassed by appending a webhook path pattern to the query string of any request. The isWebhookEndpoint() function uses an unanchored regex that tests against ctx.request.url, which in Koa includes the full URL with query parameters. When the regex matches, the authorized() middleware immediately calls return next(), skipping all authentication, authorization, role checks, and CSRF protection. > > This means a completely unauthenticated, remote attacker can access any server-side API endpoint by simply appending `?/webhooks/trigger` (or any webhook pattern variant) to the URL. [^fn:3] I actually had a cryptomining prick on my system and was quite excited to engage in this opportunity. ### Attack pattern of an adversary Reading up further into the topic I stumbled over the website of [James Brine](https://jamesbrine.com.au/), an Australian Cyber Threat Intelligence (CTI) expert who linked me to _MITRE Engage_ and _MITRE ATT&CK_. They provide **A Practical Guide To Adversary Engagement**: > **MITRE Engage** is a framework > for planning and discussing adversary engagement operations > that empowers you to engage your adversaries > and achieve your cybersecurity goals.[^fn:4] > **MITRE ATT&CK®** is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The ATT&CK knowledge base is used as a foundation for the development of specific threat models and methodologies in the private sector, in government, and in the cybersecurity product and service community.[^fn:5] MITRE ATT&CK postulates a scheme, which breaks an attack like cryptojacking and its applied techniques in a matrix. For containers in particular they've split the stages in the following table: | Initial Access | Execution | Persistence | Privilege Escalation | |-------------------------------|----------------------------|----------------------------|---------------------------| | Budibase API auth bypass (\*) | Malicious plugin execution | Malware in container layer | Container UID 0 (\*\*) | | CVE-2026-31816 | Reverse shell | Restart mechanism unproven | No host escalation proven | | Stealth | Defense | Credential Access | Discovery | Lateral Movement | |------------------------------|-----------------------------|-------------------|---------------------------|------------------| | Masquerading as dns-filter | Docker isolation (defender) | Not confirmed | crontab, netstat commands | Not observed | | System-like directory naming | No host escape confirmed | | Container reconnaissance | | | Impact | | | | | |------------------------------|---|---|---|---| | Cryptomining (Kryptex/XMRig) | | | | | | CPU and memory consumption | | | | | ## Arriving at Zero Trust The attack used several commands and fallback commands to discover more system resources it could use. Most of these fallback commands would have not have worked if the attack had breached the docker isolation somehow, because in an NixOS environment you declare what will be installed and what not, so typical programs like `cron` might not be available or you'd find that `/bin/` and `/usr/bin` are actually the places where executables normally live but more on this in the next post. Looking up for applied security solutions and having the attack matrix in mind (there is also an [engage matrix](https://engage.mitre.org/Matrix/)) I stumbled over Kubernetes and on how Kubernetes could divide each element of an Attack (or Engage) in manageable layers by applying principles from _Zero Trust_ (NIST SP 800-207). > Zero Trust (ZT) is the term for an evolving set of Cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources. A Zero Trust Architecture (ZTA) uses zero trust principles to plan industrial and enterprise infrastructure and workflows.[^fn:6] You should assume that as soon as you deploy an application into the world wide web, you should treat it as hostile and thus take measures guaranteeing the intended operation of your application. It also means the firewall perimeter is not the last line of defense, every path that goes into your application and outside of it needs to be managed within your sphere of influence. In short you should cater the following principles: 1. Understand the business outcomes of your application 2. Design with the mindset of 'from inside out' 3. Determine who or what needs access 4. Continuous monitor and log what is going on [^fn:7] With all this reading up I came to the conclusion that I need to inherently change on how I deploy and manage my resources into the world wide web. I set the goal to rewrite my personal homepage (this blog) and to launch BudiBase once more, this time putting the screws on it. In another blog entry I will highlight on how I developed my infrastructure 'from inside out'. Stay tuned! [^fn:1]: <2026-10-07 Mi> [^fn:2]: <2026-10-07 Mi> [^fn:3]: <2026-10-08 Do> [^fn:4]: <2026-10-08 Do> [^fn:5]: <2026-10-08 Do> [^fn:6]: <2026-10-08 Do> [^fn:7]: <2026-10-08 Do>

Cherma's Blogcorner

Starting a new blog

Spinning up Kubernetes via Nix to NixOS I