linux
The operating system underneath everything: permissions, systemd, sysctl, and the parts that bite.
-
From a Large Allowlist to Three Denials: Permissions for a Coding Agent
A command allowlist for an autonomous agent never converges, because the set of legitimate commands a real task needs is not enumerable in advance, and a name-based list is also easy to defeat. This article moves the boundary from command names to blast radius using kernel-level sandboxing, with a runnable script and its trade-offs.
-
Host Probes via the Textfile Collector Pattern
A single custom host measurement does not justify a dedicated exporter process, but it still needs to reach the same scrape pipeline as everything else. The textfile collector is node_exporter's answer, and it has two failure modes that only show up under load. This covers both, with a complete, runnable example.
-
WireGuard Route Selection: Per-Host /32 Versus Subnet Routes With NAT
WireGuard's AllowedIPs sets both which packets a peer may send and which route the kernel installs for it, and overlapping AllowedIPs resolve by longest-prefix-match rather than by which peer you meant. This walks through a reproducible case where that silently breaks the return path, and how to make the route explicit on both ends.
-
Overlay Mesh Networking with NetBird: Peer Addressing and the Public DNS Fallthrough
An overlay mesh gives every machine a stable address and a direct encrypted path to every other one, replacing a hub-and-spoke VPN. It also gives internal hostnames a silent way to resolve to the wrong place the moment the mesh resolver is not in the loop. This walks through why, and includes a runnable DNS setup that reproduces the fallthrough and the one-line fix that closes it.
-
Auto-Unsealing Vault Without Cloud KMS or a TPM, Using Tang and Clevis
Manual unsealing does not scale once other services depend on Vault being available at boot, but Vault's built-in auto-unseal options assume a cloud KMS, a TPM, or an HSM, none of which fit every environment. This shows how to bind Shamir unseal key shares to a Tang server with Clevis instead, so a host can unseal itself automatically while it is on the expected network, verified end to end including what happens when the Tang server is unreachable.
-
SMR Drives in a Replicated Cluster: Finding the Disk That Ruins the Pool
Drive-managed SMR disks report the same capacity, connector and SMART attributes as conventional drives, then fall off a latency cliff once their persistent cache is exhausted by sustained random writes. This walks through why that pattern matches exactly what a Ceph OSD does to its backing disk, and gives a reproducible benchmark that catches the problem before the disk is holding data.
-
Infrastructure as Code with Ansible: Making a Host Reproducible from the Repository
Infrastructure as code only works if the repository is the single source of truth for a host's configuration, and that discipline is easy to state and easy to break under pressure. This walks through why partial coverage buys almost none of the benefit, why idempotence is the actual product rather than a nice property, and ends with a complete Ansible role, run against a throwaway container, that a reader can use to watch drift get corrected.
-
Provisioning a Single-Board Computer as an Industrial Edge Node
Turning a bare carrier board into a working edge node is usually a manual sequence someone follows from memory, and it differs subtly between board revisions in ways the checklist never mentions. This builds an Ansible role that detects the board at runtime, loads revision-specific settings, and applies a common baseline, tested against a throwaway container so the logic can be verified without any real hardware.
-
chmod -R and the setgid Bit: Why a Four-Digit Mode Is Not Enough
Fixing shared-volume permissions with chmod -R 775 looks like a correct fix and passes an immediate check, but it clears the setgid bit that made new files inherit the directory's group, so the fix quietly regresses days later. This covers how the octal digits actually work, why the fix has to treat files and directories differently, and a way to test it that a one-off manual check will not catch.
-
Docker Registry Credentials for Two Local Users on One Host
The Docker CLI reads credentials from the config file of whoever runs it, not from a single host-wide location, so a login task that only runs as root leaves any other user pulling private images unauthenticated and failing with a generic denied error. This shows how to provision registry credentials for every user who actually needs them, with a reproducible local registry to test against.
-
Reasserting Kernel Sysctls That Docker Silently Reverts
Docker sets several networking sysctls itself whenever it starts or creates a bridge network, and it does so after boot-time hardening has already run, overwriting values you set on purpose. This walks through which values move, why systemd-sysctl cannot protect you, and a small systemd unit that reasserts the values after Docker has finished starting.
-
Migrating the SSH Port Mid-Playbook Without Locking Ansible Out
Changing sshd's port during provisioning severs Ansible's own control connection unless the validation, restart, connection update and firewall change happen in the right order. Here is that order, and the two guards that make it safe to re-run.