Türker Yıldırım

linux

  • Wildcard certificates, and the DNS challenge

    Deep dive9 min read

    ACME v2 landed in March and wildcards need a different proof. The certificate is the easy part; the API token that can rewrite your zone is not.

  • A swap file on a small VPS, and the OOM killer it prevents

    Note1 min read

    A one-gigabyte VPS running MySQL, PHP and nginx has no headroom, and the kernel resolves that by killing the largest process — which is MySQL, mid-write. Swappiness at…

  • A logrotate config that does not lose the last hour

    Note2 min read

    Rotating a log by renaming the file leaves the writing process holding a handle to the renamed inode, so it keeps writing to a file nobody is looking…

  • Running as a non-root user in the image

    Note1 min read

    A container defaults to root, and root in the container is root on the host for anything mounted — so a build script that deletes a directory can…

  • The build cache misses on a file mode change

    Note1 min read

    A build that rebuilds from scratch on CI while being fully cached locally is usually not a Docker problem — it is that the checkout produced different file…

  • docker system prune, and the disk it gives back

    Note2 min read

    A development machine that builds images daily accumulates dangling layers, stopped containers and orphaned volumes, and none of it is visible until the disk fills. -a –volumes is…

  • journald rate limiting drops your logs silently

    Note1 min read

    systemd-journald discards messages from a service exceeding its burst limit and notes the fact in a single line that is easy to miss — so a debugging session…

  • Alerting that people do not learn to ignore

    Deep dive10 min read

    340 alerts in a month, four of which mattered. An alert channel nobody reads is the same as no alerting, and the cause is alerting on causes.

  • Logging drivers, and why json-file fills the disk

    Note1 min read

    The default driver writes every line to a JSON file with no rotation, so a chatty container quietly consumes the host disk and nothing points at it —…

  • Compose file version 3, and what swarm changed

    Deep dive10 min read

    v3 exists to be deployable to a scheduler, and that removes things a single-host file relied on. What went, why it had to, and what replaces it.