Tag: linux

fstrim vs discard: Keeping SSDs Fast

Run fstrim.timer, skip the discard mount option on ext4 and XFS, then check LUKS, VMs, and LVM for layers that silently swallow TRIM. Measured demo included.

rsync --link-dest: Snapshot Backups

Build dated, browsable snapshot backups with rsync and hard links, then let a systemd timer run and prune them. Includes a tested script and the traps.

systemd Path Units: React to New Files

Run a job the moment a file lands. A systemd .path unit plus a oneshot service, tested triggers, the retrigger loop that kills it, and when inotifywait wins.

inotifywait: Scripts That React to Files

Use inotifywait to run shell scripts when files change, and entr to rerun a command on save. Tested gotchas: half-written files, rename saves, watch limits.

systemd DynamicUser: No useradd Needed

systemd DynamicUser=yes plus StateDirectory= gives a daemon a throwaway UID and a private data folder. No useradd, no dead accounts. Here are the four traps.

polkit Rules: Restart a Service, No sudo

Let a group restart one systemd service with a polkit JavaScript rule instead of a sudoers NOPASSWD line. Tested rule, a sudo comparison, and debugging gotchas.

yq: Editing YAML From the Command Line

Install the Go yq, not the Python one. Bump compose tags, patch Kubernetes manifests, merge configs and edit front matter from the shell, plus the gotchas.

systemd Credentials: Secrets Without Env

Stop putting passwords in Environment=. systemd credentials hand secrets to services as locked-down files, encrypted at rest. Setup plus a demo you can run.

PUID and PGID: Container Permission Fights

Why Sonarr, qBittorrent and Jellyfin fight over bind-mounted files, how PUID/PGID works in the image, when Docker's user: fits better, and how to share media.

systemd-run: Units Without Unit Files

systemd-run starts transient services, scopes, and timers with resource limits and sandboxing, no unit file needed. Replace nohup, at, and ulimit habits.

sudo vs doas vs run0 on Linux

sudo, doas, and run0 all get you root. We compare how each one works, the config syntax, the attack surface, and which one belongs on your home-lab server.

Lynis: Reading a Hardening Audit Report

Run Lynis 3.1.7, read the warnings, suggestions, test IDs and hardening index, fix the findings that matter, silence the rest, and track the score weekly.