BellSoft

JEP 531 in #Java27 adds Set.ofLazy(...): define every candidate up front, then resolve membership only when contains(...) first asks for it. Each candidate is evaluated at most once and the result is reused, even with concurrent access. Preview API, run with --enable-preview.

BellSoft container images are now available on Google Cloud Marketplace. Minimized, signed, SBOM-backed images for Java and other production workloads, ready to use as a secure base on Google Cloud. Find them here: console.cloud.google.com/marketplace/br…

We are live now! 🔥 @cat_edelveis and Mohammad-Ali A'râbi are getting into how supply chain worms spread through the systems teams normally trust. Join the conversation: youtube.com/watch?v=SPlyR_…

The Worms in Your Pipeline: Inside the New Supply Chain Attacks x.com/i/broadcasts/1…

Dockerfiles are fine while someone remembers keeping them up-to-date. Then the base image gets old, the runtime needs a bump, and every repo has its own tiny build ritual. @cat_edelveis gets into the useful part of buildpacks: shared builders, lifecycle phases, rebasing, SBOMs, and the cases where a Dockerfile is still the right tool. bell-sw.com/blog/what-are-…

Tomorrow at 6 PM CEST, Mohammad-Ali A'râbi joins @cat_edelveis for The Worms Are in Your Pipeline. Shai-Hulud, Miasma, Phantom Gyp, how they spread through developer machines, CI caches, credentials, and release pipelines, and how teams can contain them. Set a reminder: youtube.com/watch?v=SPlyR_…

Last week, @cat_edelveis and Johannes Bossle looked at AI-assisted development at team scale: shared specs, visual models, Git-based versioning, and keeping design and implementation aligned. If you missed it, now’s a great time to catch up: youtube.com/watch?v=6UqEHy…

You can write perfectly valid Java code and still choose the wrong data structure. @asm0di0 goes through Big O, sorting, ArrayList growth, LinkedList trade-offs, ArrayDeque, and what happens inside HashMap. Watch here: youtu.be/hY5A7kKQTKw

A smaller image is not automatically a hardened image. @cat_edelveis breaks down slim, distroless, scratch, and hardened images, then shows the Java adoption path: multi-stage builds, SBOMs, signatures, CI/CD checks, and a practical checklist. bell-sw.com/blog/what-are-…

Early start, practical topic. ☕️️️️️️ This Thursday at 8:45, @dchuyko takes the stage at Java Forum Stuttgart with From Kitchen to Table: A Safe Software Journey with SBOMs. SBOMs, CI/CD policies, hardened container images, SPDX vs CycloneDX, registry quirks, OPA and Ratify. java-forum-stuttgart.de/vortraege/from…

Finding CVEs is usually not the hard part. The hard part is patch ownership, rebuilds, rollout timing, and the base image mess that keeps repeating. BellSoft Hardened Images are built to deal with exactly that: bell-sw.com/bellsoft-harde…

We have started ⚡ @cat_edelveis and Johannes Bossle are live now with Spec driven design on team level. This stream is about what happens when AI coding moves beyond solo experimentation and a whole team has to build and maintain the same system. Specifications, visual models, collaboration, Git based versioning, and better context for AI assistants. Join here: youtube.com/watch?v=6UqEHy…

Spec Driven Design on Team Level x.com/i/broadcasts/1…

On July 7, @asm0di0 is hosting the next Spring User Group Berlin meetup at JetBrains. @dchuyko will speak on From Kitchen to Table: A Safe Software Journey with SBOMs. The session gets into SBOMs, CI/CD policy checks, hardened containers, Kubernetes admission, SPDX vs CycloneDX, and how to make supply chain security usable. Details: meetup.com/spring-user-gr…

Teams often start testing the next JDK too late. The JDK 27 Quality Outreach heads-up is a good reminder that early testing is not bureaucracy. It is how you catch awkward changes while they are still cheap to deal with. That matters even more for non-LTS releases like Oracle JDK 26. Its support window is limited, so waiting too long to test your next move is a bad idea. That does not automatically mean every team should go straight to JDK 27, but it does mean planning early matters. inside.java/headsup/ inside.java/2026/05/13/qua… inside.java/2026/05/22/qua…

On July 1 at 5 PM CEST, @cat_edelveis is hosting Johannes Bossle for Spec driven design on team level. Prompts work well right up to the point where a whole team has to build and maintain the same system. This session is about what comes next. Set a reminder: youtube.com/watch?v=6UqEHy…

Still in the container security headspace after JRush? Three follow-ups worth opening: Docker Container Image Security: 13 Best Practices youtube.com/watch?v=TyNGjP… Hardened Container Images 101 youtube.com/watch?v=Co164a… Your Scanner Found 200 CVEs. Now What? youtube.com/shorts/ESAlgvl…

AI-generated code is most dangerous when it is almost right. Clean, compiling code can still hide insecure patterns, fake dependencies, useless tests, leaked secrets, prompt injection risk, and architecture drift. @cat_edelveis breaks down 8 issues teams should know before trusting generated code: youtu.be/fkLxxz1_N2s

Missed JRush yesterday? Two links worth opening: Recording: youtube.com/live/AsGmInC_6… Container security checklist: jrush.bell-sw.com/container-secu…

We are live now 😎 JRush Episode 7 is on. Signed pipelines, buildpacks, hardened images, SBOMs, provenance, and a CVE workflow your team can actually use. Join here: youtube.com/live/AsGmInC_6…