Kbomb

Kustomize is a Kubernetes configuration customization tool sponsored by the Kubernetes SIG CLI. It processes raw, template-free YAML without modifying the original files, using declarative kustomization files to combine resources, apply patches and labels, generate resources such as ConfigMaps, and create overlays for development, staging, and production variants. It can wrap separately managed Kubernetes and CRD files and reference external files without copying their full contents into a repository. The resulting YAML can be emitted with `kustomize build` and applied directly with `kubectl`; Kustomize is also integrated into kubectl.

Kubernetes (K8s) is an open-source container orchestration system hosted by the Cloud Native Computing Foundation. It manages containerized applications across multiple hosts, providing mechanisms for deploying, maintaining, scaling, and scheduling workloads. Applications can be configured with YAML and deployed across hybrid-cloud environments; the platform is also used for production operations involving storage, databases, networking, and security hardening.

Kitter is a local-first skill manager for agent skills across project folders. It keeps one canonical copy of each skill in a shared library, links skills into individual projects according to their needs, reports which skills are loaded, and estimates their context cost.

Bashka is a command-line safety guard for the `curl ... | bash` installation pattern. It parses incoming shell scripts, scores them against checks for credential theft, data exfiltration, reverse shells, destructive commands, insecure downloads, persistence, obfuscation, and other hazards, and can follow forwarded or nested scripts so each layer is reviewed before execution. It can also provide the script for manual or AI-assisted analysis. Bashka records software installed through it in an installation registry, including detected binaries and created directories. Its commands can list and inspect recorded packages, rerun their installers, and remove tracked files. It supports configuration for review behavior, remote-script following, recursion depth, command limits, trusted domains, and interface style. The project is open source under the MIT license and is distributed as a shell-installed or prebuilt binary, including through Homebrew, Cargo, mise, and GitHub releases. Its documentation notes that static analysis cannot reliably detect every behavior in a Turing-complete shell script, that direct paths such as `/bin/bash` bypass its PATH shim, and that the registry cannot manage files whose installation locations it cannot detect.

kern is a fast, rootless OCI container runtime, sandbox, and virtual resource runtime distributed as a small static binary without a daemon. It creates kernel-enforced containers from OCI images, using user, PID, mount, network, UTS, and IPC namespaces, overlay or read-only roots, a deny-by-default seccomp allowlist, and cgroup v2 limits; the `--security-profile untrusted` option applies the documented hardened bundle. It can also attach named CPU, memory, disk, and device profiles from `kern.toml` to containers, or apply resource caps directly to host processes with optional Landlock write confinement. The project supports container operations, Dockerfile builds, image pull/push and save/load, stack execution through its own or Docker Compose format, and includes Python and Node SDKs plus an MCP server for agents. Its Rust dependency tree uses libc, while image pulling delegates to system `curl` and `tar`; it runs natively on Linux, requires WSL2 on Windows, and needs a Linux virtual machine on macOS.