Practical articles on AI, DevOps, Cloud, Linux, and infrastructure engineering.
Your build fails, your containers won't start, and df says the disk is full. Here's where Docker hides the gigabytes and how to get them back safely.
The daemon socket is owned by root, and your user isn't allowed to touch it. Here's the fix, and why the obvious one is a security smell.
The daemon error almost never means Docker is broken. Nine times out of ten it's a stopped service, a stale context, or a wrong env var. Here's the checklist.
We had 140 engineers with 300 static public keys scattered across authorized_keys files nobody could audit. Moving to SSH certificates with short TTLs made access reviewable again.
Our proxy topped out at 40k connections while the CPU sat half-idle. The bottleneck was kernel defaults tuned for 2009, not the hardware.
When a service is slow and every dashboard looks green, bpftrace lets you watch the kernel directly. These one-liners found our tail latency.
A cron job silently stopped running for three weeks and nobody knew until the backups were missing. systemd timers give you the logging and status cron never did.
A container with a 2-core limit was pegged at 100% CPU yet running slow. The throttling counter told the real story, and it wasn't the number we set.
Free memory is a lie and load average doesn't see memory stalls. How Pressure Stall Information gives you a direct, early signal of memory contention — and how we wired it into alerts and autoscaling.
When the service is slow and the network is suspect, these are the tools we reach for, in this order, with the exact flags that find the answer.
io_uring replaces epoll for new high-throughput services. The patterns that earn their place, the gotchas in older kernels, and where we'd still pick epoll.
cpu.shares vs cpu.cfs_quota_us vs memory.max — the cgroup mechanics behind Kubernetes resource limits, and the surprises that explain the weird symptoms you've seen.
