Loading page...
Q&A
Q&AWithout pipefail, a pipeline can appear successful even when one command in the middle failed.
When you pipe commands together, the shell normally reports the exit status of the last command. That hides failures earlier in the chain. Setting pipefail makes the pipeline fail if any stage fails, which is critical for build automation and production scripts where silent partial failures create huge operational risk.
unix
8 minUnderstand users, groups, permission bits, file descriptors, and redirection so shell and service behavior is easier to debug.
Q&A
Q&AEnvironment strings and open descriptors not marked close-on-exec.
Construct a deliberate environment and descriptor allowlist. Descriptors grant capabilities to files, sockets, or pipes; inherited writers can delay EOF and inherited secrets can leak to less-trusted children.
Q&A
Q&AA browser can send some authenticated cross-site requests even when the attacker cannot read the response.
CORS governs response readability for scripts; CSRF defenses prevent unwanted state changes using ambient credentials. Validate tokens and trusted origins independently for state-changing routes.
unix
8 minTrace what survives fork and exec, and close capabilities a child should not inherit.
typescript
5 minDistinguish compile-time guarantees from runtime data and use narrowing, discriminated unions, and explicit parsing at service boundaries.
typescript
6 minParse unknown data and use discriminated unions to preserve operational meaning through callers.
Q&A
Q&AReplacing the shell with the service improves signal delivery and exit-code propagation.
Without exec, the shell can remain as the parent process and may not forward termination signals as intended. `exec service ...` replaces the shell, making the service the main process so it receives the container stop signal directly and its exit status is reported. A wrapper supervising multiple children must explicitly forward signals and reap them.