Compiled templates, container caches and route caches are regenerated on demand and written thousands of times, and every one of those writes goes to disk for no reason.…
Alpine uses musl rather than glibc, and musl’s resolver queries all configured nameservers in parallel and takes the first answer — which behaves differently from glibc under partial…
The journal already stores structured records with unit, priority, hostname and timestamps; the text output is a rendering, not the data. Following the journal in JSON and piping…
A predictable temporary path in /tmp is a symlink attack and a collision between two concurrent runs, and both are avoided by the same three lines. Registering the…
19.03 made rootless mode usable, and it is worth knowing what it costs before installing it on a machine that matters. The security gain is real and specific:…
PID 1 in Linux does not get default signal handlers, so a shell script as the entrypoint ignores SIGTERM entirely — and docker stop waits ten seconds and…
A nightly dump reading the entire database saturates the disk queue, and every application query behind it waits — so the backup window is also a latency incident…
The default logging driver writes to a JSON file that grows without bound, so a chatty container will fill the host disk over a fortnight and nothing warns…
Rules added with iptables directly are gone after a restart, which is how a database port ends up open on a machine that was firewalled last Tuesday. UFW…