linux

  • SSH certificates expire on their own

    Managing authorized_keys across thirty servers means a configuration run to add a colleague and another to remove one, and the removal is the one that gets forgotten. Access…

  • An ephemeral self-hosted runner, and why persistence leaks

    A hosted runner cannot reach the private network, so a deploy job needs a runner inside it — and a long-lived runner inside the network accumulates everything every…

  • journalctl -o json is a log pipeline with no agent

    The journal already stores structured records with a unit, a priority and a hostname; the text output is a rendering rather than the data. Following the journal in…

  • docker system df before docker system prune

    A development machine accumulates dangling layers, stopped containers and orphaned volumes, and none of it is visible until the disk fills. -a –volumes deletes the database volume of…

  • A self-hosted runner, and what it is allowed to reach

    The hosted runner cannot reach the private network, which is the whole problem — and a runner inside it is a machine running other people’s code.

  • Redis 6 and the shared password that was everywhere

    One password, six services, and FLUSHALL available to all of them. 6.0 landed in April with users — and the keyspace pattern is where the isolation actually is.

  • Log rotation on json-file, which has no default limit

    The default logging driver writes to a file that grows without bound, so a chatty container fills the host disk over a fortnight and nothing warns first. Setting…

  • An init process, or PID 1 ignores your signals

    PID 1 in Linux gets no default signal handlers, so a shell script as the entrypoint ignores SIGTERM entirely and docker stop waits ten seconds before killing it.…

  • Draining a node on a Wednesday afternoon, on purpose

    A failover that has never been exercised is a procedure nobody has tested, and the first execution is always during an incident with an audience. Every one of…

  • systemd-run for a one-off with a memory limit

    Running a large import by hand and taking the machine down with the OOM killer is a recurring way to turn a routine task into an incident. –scope…