Tag: linux

Read-Only Docker Containers: What Breaks

Turn on read_only: true and watch nginx, Postgres, Redis, Python and Node fail in specific ways. Real errors, plus the minimum tmpfs and volume set for each.

Firewall Rule Audit: Find the Dead Rules

Find unused firewall rules on a Linux box with nftables counters, then retire them safely with a snapshot-and-diff routine, a jq script, and a systemd timer.

Idle Watts Audit: Halve Your Lab's Draw

Find what pins your home lab at high idle power: ASPM, package C-states, disks, NICs, and chatty containers. Measure at the wall and fix one blocker at a time.

One PC, Many Players: Steam Headless

Run several Steam Headless v2 containers on one Linux box so a household can play at once, each seat streamed with Moonlight. Compose file, numbers, gotchas.

AppArmor Profiles for Docker, Step by Step

Docker puts every container under the docker-default AppArmor profile. See what it blocks, then build a tested nginx profile with audit deny and complain mode.

Btrfs Send/Receive: Incremental Backups

Back up btrfs with send and receive: full and incremental streams over SSH, parent snapshots, restores, failure modes, and btrbk to automate the whole loop.

Sync Game Saves Without a Cloud Account

Sync game saves between PC, Linux, and Steam Deck without a cloud account. Ludusavi backs up the saves, Syncthing moves them, and Proton paths get sorted out.

zstd vs lz4 vs gzip vs xz: Measured

zstd -3 compresses 4 to 6x faster than gzip -6 with smaller files. At the top end, xz -6 beat zstd -19 on speed. 19 configs, 4 public data sets, measured.

Network Namespaces by Hand, No Docker

Rebuild Docker's bridge network with ip netns, veth pairs, a Linux bridge and nftables NAT. Six iproute2 commands, three nft rules, and a 2 AM debugging edge.

journald Structured Logging, No ELK

journald already stores structured key/value log fields. Learn to write custom fields, query them, and ship logs to one box before reaching for Loki or ELK.

LinuxGSM: Boring Game Servers Done Right

LinuxGSM manages 140 game servers from one script. Compare bare-metal tmux plus cron against the official Docker image, using a Valheim server as the example.

IPv6 Dual-Stack: The Hard Parts

Dual-stack IPv6 for home labs: DHCPv6-PD delegation, stable addressing past SLAAC privacy extensions, real nftables firewall rules, and Docker IPv6 done right.