3125K - Kode Together

Ep 36 — Scope: The LEGB Rule ⭐ "Why didn't my variable change?!" 😤 90% of those bugs are SCOPE. Python looks up names in an exact order — L→E→G→B — and once you know it, UnboundLocalError never surprises you again. Save this card 📌 you WILL need it.

not 0 = ...? Truthiness separates juniors from seniors 🥋 Drop your answer + your years of Python experience below!

📘 EP 43 — Read-Only Containers

🔒 The simplest container hardening trick almost nobody uses: make the filesystem read-only.

If an attacker can't write files, they can't drop a payload, a webshell, or a crypto-miner. Game over for them. 🛡️

docker run --read-only myapp

App needs to write to /tmp? Give it a writable in-memory tmpfs and nothing else:
--tmpfs /tmp --tmpfs /run ✍️

🔥 Stack it: read-only + non-root + cap-drop = a container so locked down that even a code-execution bug finds almost nothing to grab. Defense in depth, three flags.

💬 Which of these 3 are you already doing? 👇
🔖 Save the fortress recipe.

Day 33 — Redshift

📊 Day 33/100: Querying billions of rows for analytics? RDS will cry. Redshift won't.
Columnar storage + massively parallel processing = complex reports in seconds. 💰 But for occasional S3 queries, Athena is cheaper — know the difference.
🔖 Save the "warehouse vs app DB" rule.

Ep 35 — Unpacking Magic Swap two variables with ZERO temp variables 🪄 Plus: split lists with *rest and merge dicts in one line. The syntax tricks that make seniors' code look like magic. Which one did you not know? Comment the number!

🚨 SNEAKY ONE 🚨 Is (1) a tuple or not? 90% answer too fast and regret it. Take your time... then comment!

📘 EP 42 — Drop Capabilities ⭐

🔻 Your container ships with ~14 Linux "superpowers" (capabilities) by default. Your app probably uses zero of them. Every unused one is a free gift to an attacker. 🎁

The senior move: drop everything, add back only what's essential.

--cap-drop ALL --cap-add NET_BIND_SERVICE

Layer on:
🚫 --security-opt no-new-privileges (block privilege escalation)
🧱 --security-opt seccomp=profile.json (restrict syscalls)

This is least-privilege for containers — and it blocks whole classes of exploits for free. 🔒

💬 Did you know containers had capabilities at all? 👇
🔖 Save this hardening combo.