book

DevSecOps and DevOps for Linux: The Foundations

Name: DevSecOps and DevOps for Linux: The Foundations
Author: Marco Antonio Carcano
ISBN: 9798868820779

by Marco Antonio Carcano

August 2026

Intermediate

834 pages

15h 49m

English

Apress

Read now

Unlock full access

DevSecOps and DevOps for Linux
Trademark and Open-Source Software Notice
Introduction
Acknowledgments
Table of Contents
About the Author
About the Technical Reviewer
Part I: Holistic Skill Set
Holistic Skill Set
1. Team Working
Summary
2. Solution Lifecycle
Basic ConceptsSolution LifecycleThe Service Design ProcessThe Service Transition ProcessThe Operating ProcessThe Continuous Improvement ProcessSummary

3. An Overview of Agile and Lean
AgileLeanMy Personal Feedback on AgileDefine a ScopeAn Agile Project Without a Macro ScopeAn Agile Project with a Macro ScopeProject Managers Are Not Solution ArchitectsSummary
4. An Overview of Scrum and Kanban
ScrumScrum RolesScrum ProjectScrum SprintsScrum CeremoniesKanbanKanban RolesKanban MeetingsSummary
Part II: Operating with the System
Operating with the System
5. The BASH and Command-Line Utilities
What Is a ShellCommonly Used Command-Line UtilitiesShell ConceptsCommands and PipelinesSubshellsThe pipefail OptionInput and Output RedirectionStreams and File DescriptorsHere-StringHeredocXargsScripting ConceptsExecution PermissionThe ShebangThe Special LC_ALL=C LocaleWriting CommentsStatic Analysis ToolsProfiling Using the Time UtilityBASH Cheat SheetScript Positional ArgumentsVariablesArraysSpecial VariablesTest If a Variable Is SetEmpty, Not Empty, and LengthNumbersIncrement and DecrementMath OperationsRoundingStringsCounting the Number of WordsManipulating String ContentsExtracting a SubstringChecking Matching ContentsReplacing ContentsGlobbingList and SequencesUser InputThe Read CommandThe Select CommandTesting Files and DirectoriesFile ExistenceDirectory ExistenceFlow ControlIf-Elif-ElseCaseControl StructuresFor LoopWhile LoopUntilFunctionsTrapping SignalsSummary
Part III: Basic Data Formats
Basic Data Formats
6. Key-Value Pairs
IniComma-Separated Values (CSV)Summary
Part IV: Data Processing
Data Processing
7. Regular Expressions (RegEx)
The Purpose of Regular ExpressionsMeta-CharactersClass of CharactersShorthandQuantificationNegating a Class of CharactersLogical ORCapturing Group and BackreferencesSummary
8. Working with Grep
What Is GrepScanning FilesScanning All Files in a Directory TreeCase-Insensitive SearchInverting the Matching CriteriaPiping to GrepValidating Standard InputUsing Grep in Shell ScriptsSummary
9. Working with Sed
An Initial WalkthroughInvocationIn-place File ModificationRecord Matching ClausesShowing Only ChangesThe Pattern SpaceHold SpaceSed Expression SyntaxNesting CommandsNesting ExpressionsUsing Multiple ExpressionsLine-Matching ClausesLine Matching by Line NumberLine Matching by Regular Expression PatternLine Interval Matching ClausesLine Matching by an Interval of Line NumbersLine Matching by Start and End MarkersLine Matching from a Marker to the End of the FileMatch an Interval of Lines Mixing Line Number and MarkerFrom the Beginning of the File to a MarkerNegating the Line-Matching ClauseSed Commands – The Most Used OnesAppend (a)Insert (i)Change (c)Delete (d)Substitute (s)BackreferencesSummary
10. Working with AWK
Acquainting to AWKFields VariablesShell InvocationAWK Basic SyntaxPattern-Action StatementPatternsLine-Matching PatternField-Matching PatternRow NumberSpecial PatternsBeginEndNegating the PatternLogical OperatorsLogical ANDLogical ORThe match( ) Built-In FunctionActionsControl StatementsConditional BlocksLoopsExitReturnVariablesDeclare Variables from the Command LineDeclare Variables Within StatementsIncrementing and Decrementing ValuesModulusArraysBuilt-In VariablesARGV[N]ARGCENVIRONNRFSRSNFAWK FunctionsGenerate a Random NumberConvert to Lowercase or UppercaseCase-Insensitive ComparisonSubstringLength of StringsSplitting (Tokenizing) into an ArraySorting an ArrayStrings SubstitutionTime FunctionsRunning a Shell CommandCustom FunctionsReal-Life ExamplesGet the Amount of Space Consumed by Old FilesProcesses’ Memory UsageSummary
Part V: Structured Data Processing
Structured Data Processing
11. XML with XPath, XMLStarlet, and Python
What Is XMLA Simple XML FileEnforcing the XML Syntax with a SchemaDTD SchemasXML SchemasSchematronsExample DTD fileExample XSD fileThe XPath Query LanguageWorking with the XPath Command-Line UtilityWorking with xmlstarlet Command-Line UtilityTransforming Using XSLTFancymonitor with XML supportSummary
12. JSON with JQ and Python
What Is JSONEditing JSON with VIMJQ – An OverviewJSON SerializationCommentsNull ValueScalarsBooleansNumbersStringsMultiline StringsComplex Data TypesObjects (Dictionaries)ArraysWorking with ArraysNumber of Elements Using the Length FilterGetting One Element of the ListGetting a Slice of the ListSorting a ListGetting Min and MaxUnpacking a ListGetting the Index of an Item of the List with a Certain ValueChecking the Existence of a Specific ValueMore Complex Use CasesKey as Matching CriteriaList Item as Matching CriteriaBoolean Operators Inside the Select FunctionSelect Items Containing a Specific KeyProcessing JSON with PythonSummary
13. YAML with Yq and Python
What Is YAMLEditing YAML with VIMYq – An OverviewYAML SerializationIndentation-Based and Flow-Style NotationsNode TypesDocument SeparatorCommentsnull ValueScalarsBooleansNumbersStringsMultiline StringsDictionaryListList of DictionariesTagsDefaultCustomGlobalVersions and SchemasAnchors and AliasesMerge KeyValidating Using YamllintProcessing YAML with PythonA Poorly Written ExampleFancymonitor YAML supportSummary
Part VI: Developing a Python Project
Developing a Python Project
14. Unit Tests
What Are Unit TestsWhy Use Unit TestsWhen to Use Unit TestsWho Writes the Unit TestsThe PyTest FrameworkInstall PyTestA Real-Life ExampleSummary
15. Packaging As a Wheel
The Importance of PackagingPython PackagingSetuptoolsThe Python Build ModuleConfigure the Build Module in an Existing Python ProjectIncluding Tests in the DistributionBuild a Source DistributionBuild a Wheel DistributionSummary
16. Managing the Build with GNU Make
The Importance of a Build Automation ToolWhat Is GNU MakeInstalling GNU MakeMakefilesA Real-Life ExampleSummary
17. Packaging As RPM
Platform-Specific Packaging FormatsRed Hat Package ManagerThe RPM Packaging FormatBuilding RPM PackagesThe Spec FileBuilding the RPMOperating with RPMSummary
18. Setup Git and the Pre-commit Framework
Configure GitGit CommitsCommits’ ComplianceThe Pre-commit Hook Python PackageInstalling the Pre-commit Python PackageConfiguring the Pre-commit Python PackageUpgrading the ScannersReset the BranchSummary
19. Auditing Source Code Compliance
Static Code Analysis ToolsFlake8PylintSummary
20. Scanning Vulnerabilities
Vulnerability Scanning ToolsBanditSafetySummary
Part VII: Security
Security
21. System Security
Files And DirectoriesDate and Time AttributesPOSIX Standard PermissionsPOSIX Special PermissionsExtended AttributesPOSIX ACLsMount OptionsSudoThe Configuration FilesThe Wheel GroupCreating a Simple Sudo RuleSudo Rule SyntaxLinux CapabilitiesMost Commonly Used CapabilitiesGetting CapabilitiesSetting CapabilitiesSELinuxSELinux Policy SetsSELinux Operational StatusesListing SELinux AVC ViolationsSELinux TagsType Enforcement (TE) RulesSELinux ModulesModule’s BooleansFile Context ManagementAcquainting to CryptographySymmetric CryptographySymmetric KeyEncrypting ContentsAsymmetric CryptographySummary
22. Securing Data and Validating Identity Through GPG
What Is GNU PG (GPG)The Web of TrustGPG Basic ConceptsPrimary KeysSubordinate KeysOperating with GPGListing KeysExporting and Importing KeysPublic KeysPrivate KeyEncrypting And Decrypting ContentsSigning ContentsGPG-Signed DocumentClear-Text SignatureDetached SignaturesSigning ApplicationsGPG Detached Application’s SignaturesPackage-Specific Embedded GPG SignatureGPG Signing RPMThe RPM Signing ProcessUsing GPG Agent to Automatically Unlock Private KeysWork with GPG-Signed RPMCheck if an RPM Package Is GPG SignedUntrusted SignaturesImport a GPG Key in the RPM GPG KeyringValid SignaturesOperating the RPM’s GPG KeyringGPG Check with YUM/DNFBest Practices for GPG Key ManagementSummary
23. X.509 Certificates and PKI
X.509 CertificatesSelf-Signed CertificatesGenerate the Private KeyGenerate the Certificate Signing Request (CSR)Generate the Self-Signed CertificateCertificate ValidationChecking If the Certificate Is TrustedCertificate Lifetime ValidationCA-Signed CertificatesCertificate Authority (CA)CA CertificatesPublic Key Infrastructure (PKI)Certificate Chain ValidationThe TruststoreGenerate the Private KeyCertificate Signing Request (CSR)Submit the CSR to a Certificate AuthoritySubmit to Let’s Encrypt Using the ACME ProtocolValidating the CertificateAssembling the Certificate ChainCertificate StatusOnline Certificate Status Protocol (OCSP)Certificate Revocation List (CRL)KeystoresPEM ContainersJKS ContainersPKCS#12 ContainersPrivate CAApplication-Specific TruststoresPEM ContainersJKS ContainersPKCS12 ContainersSummary
Part VIII: Common Protocols
Common Protocols
24. HTTP
The Hypertext Transfer ProtocolRequest MessagesResponse MessagesHTTP Virtual HostHTTP ProxiesReverse ProxiesOutgoing ProxiesSummary
25. TLS
Transport Layer Security (TLS) ProtocolTLS HandshakeServer Name Indication (SNI)TLS Server Certificate ValidationTLS Server Certificate BundleMutual TLS AuthenticationSummary
26. LDAP
The Lightweight Directory Access ProtocolOpenLDAP CaveatsLDAP Schema and ObjectclassesHierarchical StructureBase DNInstantiating ObjectsLDAP Search FiltersReferralsBind DNThe ldapsearch Command-Line ClientOther LDAP Command-Line ToolsSummary
Part IX: Working with Containers
Working with Containers
27. The Containers Ecosystem
ContainersContainer ImagesContainer Image RegistriesPublic Online Container RegistriesPrivate Online Container RegistriesOn-Premises Container RegistriesSummary
28. Docker and Podman
Container Management SuitesDockerPodmanOperating Container and ImagesOperating with Container Image RegistriesLocal Container Image RegistriesSpin Up a Local Container RegistryAuthenticating to RegistriesTrusting Registries and CA CertificatesUntrusted RegistriesUnqualified Search RegistriesSearching Container Images in RegistriesRunning ContainersOperating ContainersOperating Container ImagesCheckpoint and RestoreDockerPodmanCreating Container ImagesDockerPodman (buildah)Networking and VolumesCleanupSummary
29. Deploying Pulp3 Using Docker Compose
Docker and Podman ComposeExample Deployment: Pulp3What Is PulpDeploy Pulp3Log In to the Pulp3 Web UIInstall the Pulp CLICreate a Repository in Pulp3Summary
Part X: Service Protocols
Service Protocols
30. SOAP and REST
Simple Object Access Protocol (SOAP)Web Services Description Language (WSDL)Mocking a SOAP EndpointRepresentational State Transfer (REST)OpenAPIMocking a REST EndpointSummary
Part XI: Orchestrating Containers
Orchestrating Containers
31. Kubernetes, Helm, and Rancher
KubernetesKubeadmMinkube and K3sOpenshift and RancherA Quick Walkthrough with KubernetesNamespacesThe Kubectl Command-Line ToolResource DefinitionsPodDeploymentReplicaSetStatefulSetPersistent Volume ClaimPersistent VolumeServiceIngress RuleConfig MapSecretCustom Resource Definitions and OperatorsHelmInstall HelmAdd RepositoriesSearch Helm ChartsPull Helm Chart’s ContentsDeploy Using Helm ChartsCreate Deployment-Specific Values FilesPerform a Dry-RunDeploy the InstanceRancherDeploy the Rancher Single Node Docker ContainerPrerequisitesDeploy RancherOperating K3sConnection to RancherTrust Rancher’s CA CertificateMap Rancher’s FQDN to the Host’s FileComplete the Welcome ProcedureRancher BackupsPrepare the Backing SpaceProvision the Persistent VolumeProvision the Backups AppSchedule BackupsActive Directory AuthenticationSummary
Part XII: CI/CD Toolchain
CI/CD Toolchain
32. Deploying Gitea Using the Helm Chart
What Is GiteaDeploy Gitea Using the Official HELM ChartRequisitesPostgreSQL DatabaseFilesystem StorageCreate a NamespaceCreate the Administrative Credentials’ SecretGitea Helm ChartsGitea from the Rancher Partners’ Chart RepositoryGitea from the Official Chart RepositoryDeploy GiteaConfigure Helm Chart’s ValuesDisable Valkey ClusterDisable Dedicated PostgreSQL InstanceConfigure External PostgreSQLConfigure Administrative CredentialsServer Specific SettingsConfigure Incoming Connections to GiteaEnable Gitea Actions WorkflowDeploy GiteaLog In to the Gitea Web UIDeploy Gitea Actions RunnersGenerate an Actions Runner Registration TokenStore the Token into a Kubernetes SecretDeploy the Gitea RunnerVerify the Gitea Runner RegistrationA Quick Walkthrough with GiteaCreate an OrganizationCreate a RepositoryCreate an Actions WorkflowGitea Helm Chart Caveats and PitfallsConfigure the DomainConfigure WebhooksConfigure Migration SourcesGitea VersionLoad BalancersSSH EndpointHTTPS EndpointTLS CertificateActions Runners with TLS-Enabled Gitea EndpointActions Runner TweaksConfiguring LoggingGiteaActions RunnersLDAP AuthenticationEnable MonitoringConfigure Resource Requests and LimitsScalingNumber of ReplicasShared StorageCaches, Queues, and SessionsSummary
33. CI/CD and Continuous Delivery
CI/CDThe CI/CD ToolchainSource Code Management (SCM)Repository ManagersRepositoriesYUM and DNF RepositoriesAPT RepositoriesContainer Image RepositoriesPyPI RepositoriesBuild Automation FacilitiesAutomated Testing FacilitiesContinuous Integration (CI)DevelopmentDevelopersQuality AssuranceDevOpsContinuous BuildingContinuous TestingContinuous Deployment (CD)Deploying to the Staging EnvironmentDeploying to Customer-Facing RepositoriesContinuous DeliverySummary
34. Working with Gitea Actions Workflows
What Are Gitea Actions WorkflowsPushing Fancymonitor to GiteaCreate the Fancymonitor Repository in GiteaAdd the Remote Origin to FancymonitorPushing the Main Branch to the Remote OriginThe Unit Test WorkflowsMocking ServicesCreate the Mock ContainerConfigure the Actions WorkflowConfigure the Container Registry CredentialsAdd Organization-Level Actions VariablesAdd Organization-Level Actions SecretsConfigure the Actions WorkflowPull RequestsPull Request’s Merging StrategiesPushing a BranchRaising a Pull RequestCompleting a Pull RequestCreating a ReleaseConfiguring the Push TargetConfiguring the Release WorkflowTriggering the Create Release WorkflowSummary
Part XIII: Version Control
Version Control
35. Version Management with Git
Acquainting to GitGit ConceptsAreasBranchesTagsInstall GitConfigure GitWorking with Git RepositoriesCreating a New RepositoryLocal Git RepositoryShared Remote Git RepositoryLinking the Local Git Repository to a Shared RemoteSet the Upstream of the Current BranchCloning an Existing RepositoryVersion Control OperationsPopulating the Working AreaStaging Modified ContentsChecking DifferencesUnstaging ContentsCommitting ContentsAmending a CommitListing Changes in the Current BranchReverting a Specific CommitRewind to an Earlier Point in HistoryComparing CommitsRemote RepositoriesCloning a Remote RepositoryListing Remote Repositories (Remotes)Linking to a Remote RepositoryWorking with BranchesCheck Out a Branch and Managing BranchesCreating BranchesRenaming a BranchDeleting a BranchStashingStashing ContentsListing the Stashes in the StackApply Stashed ContentsRemove StashesRemote BranchesListing Remote BranchesCheck Out a Remote BranchPruning a BranchPulling Changes from the Upstream Remote BranchPushing to RemotesDeleting a Remote BranchMerging BranchesBranch Merging StrategiesFast-ForwardRebase and Fast-ForwardOstensibly Recursive Twin (ORT) MergeSquashed MergeRevert a MergeResolve ConflictsTaggingCreating a TagListing TagsDeleting a TagChecking Out a TagRemote TagsPushing Tags to a Remote RepositoryListing Remote TagsDeleting Tags from the Remote RepositoryHooksSummary
Part XIV: Remote Configuration Management
Remote Configuration Management
36. An Overview of SSH
SSH BasicsHost KeysHost Key FingerprintGetting the Host Key FingerprintAuthentication MechanismsPassword-Based AuthenticationPublic Key AuthenticationGenerating SSH Authentication Key PairsAuthorizing a Public KeyThe SSH AgentLaunching the AgentAdding a KeyRemoving a KeyClient Configuration FilesConnecting to a ServerExecuting Remote CommandsSecure Copy – SCPSFTPA Few SSH Server Security Best PracticesSummary
37. Ansible Playbooks, Roles, and Collections
Containerized AnsibleSet Up the Container EnvironmentPull the Ansible ContainerSet Up the Ansible Directory TreeConfigure AnsibleRun Ansible Within the ContainerLaunching the Containerized Ansible Directly from the ShellAnsible Ad Hoc StatementsAnsible PlaybooksWriting an Ansible PlaybookRunning a PlaybookAnsible NamespacesAnsible Roles and CollectionsAnsible RolesAnsible CollectionsAnsible GalaxyWorking with Ansible RolesInstall an Ansible RoleWrite a Playbook Invoking the RoleWrite a Var FileRun a PlayAnsible VaultCreate a Vault FileDisplay the Contents of a Vault FileEdit an Existing Vault FileUse a Vault FileWork with Ansible CollectionsInstall an Ansible CollectionInvoke Modules from a Collection into a PlaybookRun a PlayStructuring the Playbooks Directory TreeThe Infrastructural Playbooks Directory TreeThe Solutions Playbooks Directory TreeSummaryConclusion
Index

Content preview from DevSecOps and DevOps for Linux: The Foundations

M. A. CarcanoDevSecOps and DevOps for Linuxhttps://doi.org/10.1007/979-8-8688-2077-9_20

20. Scanning Vulnerabilities

Marco Antonio Carcano¹

This chapter focuses on another critical topic within the DevOps and DevSecOps scope: Source Code Vulnerability Scanning. This is the process of identifying and assessing security weaknesses in the code and its dependencies, allowing teams to address potential threats before they can be exploited.

Neglecting it can lead to significant security issues, particularly in large projects, and may result in the delivery of insecure software.

In the worst-case ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

systemd for Linux SysAdmins: All You Need to Know About the systemd Suite for Linux Users

Publisher Resources

ISBN: 9798868820779Purchase Link Publisher Website

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

DevSecOps and DevOps for Linux: The Foundations

by Marco Antonio Carcano

20. Scanning Vulnerabilities

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.