Publish: Finding the Cryptominer Hiding in a Docker overlay2 Layer

[rivassec]

First of three queued posts (cryptominer -> every-alert -> laptop).

What

• New post live at /cryptominer-in-the-docker-layer.html (Date: 2026-09-11). IR walkthrough: GuardDuty correlation finding -> overlay2 layer forensics -> competing poisoning hypotheses -> operational definition of clean.
• Hub link added under Operating Under Pressure in the DevSecOps Guide (satisfies the link-graph reachability guard).
• OG/cover cards regenerated for the final title.
• The two references to the not-yet-published companion post (Every Alert Is Your Alert) are deliberately unlinked placeholders; the links land with that post's publish PR so no live page ever points at a /drafts/ URL.

Review trail

• Pre-publish gate: first run FAILED (2 blocking); all 18 findings fixed; re-run PASSED (0 blocking); 12 non-blocking residuals from the passing run also fixed.
• Anonymization pass applied (engagement framing, generalized stack details, no org attribution).
• Local guards all green: link graph (21 posts), llms guard, canonical/noindex, descriptions, em-dash, image alt + budget.

Merging publishes the post, adds it to llms.txt / llms-full.txt / sitemap / feeds automatically, and writes its markdown mirror.