logo-dark

Conf42 DevSecOps 2021: Building our own custom Code Insight tool at Form3

We are on a journey in scaling up - we are expanding our codebase and our engineering teams as fast as we can! In this talk, we present Code Insight, our tool for scanning our code for vulnerabilities. Watch our talk to find out how we built and rolled out Code Insight to our teams, enabling them to deliver faster than ever before!

Whistle stop tour

This talk shares some key points in our journey to introduce a new static code analysis tools in our teams.
Here are some key highlights of the talk:

  • We are a rapidly growing engineering organisation. This means that we have engineers which are quite new to the codebase contributing to live services. We own 500 repositories in different languages such as Terraform, Go, Java, YAML which our developers contribute to at different frequencies.
  • Form3’s platform is compliant with the highest standards of security and should be actively maintained to remain free from vulnerabilities.
  • Our teams needed a centralised source code scanning solution that could integrate well with our development workflows. A central configuration makes it easy to maintain and change system wide configs.
  • We implemented a GithubApp for code insight that we can integrate into our Travis workflows. Under the hood the app uses Github Webhooks, Amazon API Gateway and AWS Lambda and Fargate spot instances to run our scans. New scans are configured using Docker images.
  • Nightly builds, alongside PR builds, ensure that we have an up-to-date view of our vulnerabilities.
  • Code Insight allowed Form3 to streamline development work. No extra config and easy maintenance were big improvements to our previous code scanning solution.

Written by

github-icongithub-icongithub-icon
Adelina Simion Technology Evangelist

Adelina is a polyglot engineer and developer relations professional, with a decade of technical experience at multiple startups in London. She started her career as a Java backend engineer, converted later to Go, and then transitioned to a full-time developer relations role. She has published multiple online courses about Go on the LinkedIn Learning platform, helping thousands of developers up-skill with Go. She has a passion for public speaking, having presented on cloud architectures at major European conferences. Adelina holds an MSc. Mathematical Modelling and Computing degree.

Read more

Blogs · 10 min

Keeping Customers Informed During Incidents with Prometheus

Maintaining customer satisfaction during incidents is crucial for any business. In this blogpost, Piotr shares how we leverage Prometheus to expose business metrics in a secure and cost-effective way to keep customers informed and happy during those stressful situations.

May 24, 2023

Blogs · 4 min

.tech Podcast - The core components of container systems

Michael Kerrisk is a Linux expert and trainer. He joins us to explain what containers are and deep dive into the four core components of containers: namespaces, capabilities, cgroups and seccomp. He also draws parallels on how they are used by Docker to power container systems as we know them today.

May 17, 2023

Blogs · 5 min

How to inspect & manipulate network packets in AWS with Gateway Load Balancer

In this post, Michał walks you through a sample setup of the AWS Gateway Load Balancer. We will provision the infrastructure using Terraform, write a simple virtual appliance application and show it all in action. He demonstrates how this service can be used to route network traffic through a virtual appliance where each network packet can be inspected, modified, or dropped.

May 11, 2023