61
It takes 5 cloud services to hear my doorbell
It all started in the winter of 2024. There was a burglary in our apartment building and we decided we needed to invest in our home’s security. The …
Topics /
Infrastructure & DevOps
The most popular blog posts about infrastructure & devops on Hacker News. 138 posts.
62
WSL3 Performance is about 5-60% faster than WSL2 depending on the workload
With the release of the WSL 3.x stack, Microsoft bumped the default virtualization runtime and advanced the shipped guest kernel from the 6.6 LTS branch up to 6.18. WSL upgrades often claim generalized performance gains, but marketing bullet points rarely translate directly to developer workloads. To see what actually…
63
Running My Own XMPP Server
Notes from setting up Prosody in Docker for federated messaging, with file sharing, voice calls, and end-to-end encryption.
64
OTel isn’t going well
For years now one of the most reliable complaints I hear when I try to drag a team off their vendor specific SDK and onto OpenTelemetry is some variation of: "why does it seem like this isn't done yet?" Vendor SDKs for observability are, to put it charitably, idiot-
65
10Gb/s Ethernet: what I did to get it working in my home
I already had 2.5Gb/s working. Here's how I upgraded the whole house to 10Gb/s Ethernet -- including real iperf3 numbers, MikroTik switches, scary thermals, and what actually worked.
66
Running MicroVMs in Proxmox VE, the Easy Way
I’ve been running a mixed Proxmox cluster for years – four nodes of wildly different capability, from an Atom x5-Z8350 with 2 GB of RAM (a z83ii, currently ...
67
Is the RAM shortage killing small VPS hosts?
The AI surge has DRAM producers like Micron focus on HBM (High Bandwidth Memory) to serve AI hyperscalers over the DRAM (Dynamic Random Access Memory) used by ordinary consumers and small businesses. Consequently, for instance, servers which used to cost $2500 on Newegg now cost $5000. RAM alone is $2500 now.
68
MinIO Is Dead, Long Live MinIO
MinIO’s repo is officially archived and abandoned. And how AI Agents helped bring it back from the dead. This post explains how a community fork restores the admin console and ships binaries via CI/CD pipeline.
69
BuildKit: Docker's Hidden Gem That Can Build Almost Anything
Most people know BuildKit as the thing that makes docker build fast. But BuildKit is a general-purpose build framework with a programmable architecture that can produce any artifact, not just container images. Here's how it works and how I used it to build Alpine APK packages.
70
Running out of disk space in production
A tale about misconfiguring nginx, from adventures in production
71
Azure Linux 4.0 is Microsoft's first general-purpose Linux
Microsoft’s in-house Linux, the distribution that grew out of CBL-Mariner, just hit public preview as a general-purpose cloud OS you can run on any Azure VM and coming soon to WSL.
72
Debunking Zswap and Zram Myths
zswap and zram are fundamentally different approaches with different philosophies. If in doubt, use zswap.
73
74
Caddy compatibility for zeroserve: 3x throughput and 70% lower latency
zeroserve is a high-performance HTTPS server that runs eBPF scripts in userspace ( intro ). Now it's got a Caddy-compat mode - when provided a Caddyfile, zeroserve JIT-compiles it to eBPF and then to native x86_64/ARM64 machine code, and runs it in an io_uring event loop.
75
The Ubuntu 26.04 Rust sudo is not compatible with standard sudo
You're probably reading this page because you've attempted to access some part of my blog (Wandering Thoughts) or CSpace , the wiki thing it's part of. Unfortunately you're using a browser version that my anti-crawler precautions consider suspicious, most often because it's too old (most often this applies to versions…
76
Diskless Linux boot using ZFS, iSCSI and PXE
Diskless Linux Boot
77
Self-hosted HTTP tunnels with SSH and Nginx
No extra software to install: OpenSSH remote forwarding and nginx's secure_link module give you a shareable HTTPS URL with an expiring token.
78
CVE-2026-31431: Copy Fail vs. rootless containers
In the previous post about SELinux MCS and GitLab runners, I briefly mentioned CVE-2026-31431 (“Copy Fail”) as a motivating example for per-job VM isolation. After that post went out I spent the weekend setting up a lab to actually run the exploit, trace it at the syscall level, and verify that the rootless Podman…
79
Run OpenBSD on DigitalOcean for $4/month
My homepage now runs on OpenBSD with httpd(8) and Let's Encrypt via acme-client(1) . I previously hosted it on GitHub Pages and then eventually moved to Cloudflare Pages because both options were free and easy. Free and easy is cool, and I understand that writing software full-time leaves us wanting absolutely nothing…
80
NixOS is making me less afraid
Something funny happened a little while ago: I read about FreshRSS, and it sounded nice, so I installed it on a server and started using it . That would not have happened a year ago, but then again, a year ago I didn’t have any NixOS servers.
81
Unikernels were hard. key word: were
Justin Cormack, who worked on MirageOS back in the day, called me at the pub to talk about why unikernels are coming back. The friction that made them hard is gone, the operating system is design debt, and if you care about security you should seriously consider them.
82
Crawling a billion web pages in just over 24 hours, in 2025
For some reason, nobody's written about what it takes to crawl a big chunk of the web in a while: the last point of reference I saw was Michael Nielsen's post from 2012 .
83
AWS Fired the One Employee Who Gave a Damn
Remember Tarus Balog, the AWS employee who rescued my deleted account when nobody else would? AWS just fired him. His proudest accomplishment in four years was saving my data. Leadership didn't care. The finale of a trilogy nobody asked for.
84
10Gb/s Ethernet: switching to a Broadcom SFP+ module
As predicted by several people, one of my Marvell-based SFP+ modules had overheating problems. I've switched it over to a Broadcom-based one, and it looks better, though I can't be certain.
85
I used AWS cognito for a startup. I wouldn't do it again
I let AWS Cognito gaslight me for three weeks so you don't have to. Here's the unfiltered autopsy.
86
Windows Server 2025 Runs Better on ARM
My personal website and blog
87
TLS certificates for internal services done right
No self-signing headaches, no TLS erros.
88
Git's Magic Files
Magic files and where to find them: .gitignore, .gitattributes, .mailmap, .git-blame-ignore-revs, .lfsconfig, and more.
89
WSL 2 is getting faster Windows file system access
From DrvFs in WSL 1 to Plan 9 to virtiofs, cross-OS file access in WSL 2 has improved with each generation. A new change gives each virtio device its own dedicated DMA pool, removing the last major contention point on the virtiofs path.
90
FreeBSD Home NAS, part 3: WireGuard VPN, routing, and Linux peers
Setting up WireGuard VPN on FreeBSD 14.3: PF firewall, routing between networks, and peer-to-peer VPN between FreeBSD and Arch Linux