Operations | Monitoring | ITSM | DevOps | Cloud

The latest News and Information on Continuous Integration and Development, and related technologies.

Container hardening isn't a substitute for artifact management

Hardened base images are a great secure foundation. They're minimal, security-vetted, and have few dependencies to worry about. But almost nobody ships a bare base image. Teams build on top of it. This video cover whys that "on top of it" layer is where the risk actually lives: Skip the base image hardening and you're building on a shaky foundation. Skip artifact management and you're leaving everything built on top of that foundation ungoverned. A strong posture uses both.

Headless vs. Traditional Web Architecture: What DevOps Teams Need to Consider

DevOps teams face a critical architectural decision when building modern web applications: should they stick with traditional, monolithic systems or embrace headless architecture? This choice affects everything from deployment workflows to team collaboration, performance optimization, and long-term maintenance costs. Understanding the technical and operational implications of each approach helps teams make informed decisions that align with their specific requirements.

What's actually inside your SBOM (and why it matters)

An SBOM is more than a compliance checkbox. It's literally a bill of materials for your product: every software component that makes it into what you ship, plus the metadata that tells you whether it's safe to use. This video covers what that metadata actually does for you: An SBOM earns its keep when it shows you what's actually there, version to version, on a continual basis.

Policy-as-code vs. policy-as-documentation: The difference that matters

A documented policy only works if every engineer remembers it, every time, under deadline pressure. That's the gap policy-as-code closes. This video covers what that actually looks like in practice: The instructions don't change. What changes is whether something actually enforces them, or just hopes someone reads them.

The Evolution of JFrog AI Catalog: Your AI Control Plane for Agentic Development

In a single morning, a coding agent can pull an open-source model, connect to an unvetted MCP server, and execute a code-optimizing skill from the web. In the rush toward agentic automation, these AI assets quietly bypass traditional security reviews, creating new attack vectors across the software supply chain. Closing this blind spot has been the driving force behind the JFrog AI Catalog since its launch at swampUP 2025.

How to set up CircleCI with Cursor Origin

CircleCI now integrates with Cursor Origin, bringing scalable CI/CD to Origin-hosted repositories. In this demo, see how to connect an Origin repository to CircleCI, configure your pipeline triggers, run a build, and report CI status back to your Origin pull request. Already using CircleCI? Your existing.circleci/config.yml works as-is, with no Origin-specific CI syntax or separate config to maintain.

How to Use Claude Code with CircleCI to Fix Failed Builds

Give Claude Code direct access to CircleCI and let it diagnose failed builds, fix issues, and keep iterating until your pipeline is green. In this tutorial, we walk through how to connect Claude Code to CircleCI using the CircleCI CLI. You’ll see how Claude can read pipeline results, identify test failures, make fixes, trigger new builds, and monitor CircleCI without leaving the terminal.

How we made vulnerability fixes review-ready with Agentic Pipelines

Routine vulnerability fixes are rarely difficult in isolation. The interruption that they cause is the problem: pick up the ticket, trace the dependency, update the package or image, regenerate files, run the checks, open the pull request, then return after deployment to close the loop. That repeated handoff was a good candidate for automation with agentic pipelines. The goal was simple: start the day with a tested pull request instead of another ticket to pick up.

Introducing JFrog Preview: Getting New Capabilities Into Your Hands, Faster

TLDR: “Preview” isn’t a lightweight version of GA, and it isn’t a beta with a new name on it. It just changes the timing and access. You’ll see new JFrog capabilities the day they’re ready for real use, not the day they’re ready for a press release. We’re starting at swampUP 2026. As we know, AI has changed the speed of software development and delivery. Work that used to take three months now takes weeks.