When Ubuntu Builds Fail on libvips but macOS Does Not
Why a Rails test suite can fail on Ubuntu because of an older native libvips, and how to upgrade it safely without confusing it with the ruby-vips gem.
Category: devops
Tightening a dev VM that was quietly living without a firewall
What a routine security audit found on a small always-on dev VM: passwordless databases, no host firewall, over-privileged jobs, and how it got fixed.
When an Always Free server gets smaller
What Oracle's smaller Ampere A1 Always Free limits mean for a self-hosted ARM server, and how I redesigned mine around a 12 GB, 2-core budget.
Rebuilding a Small k3s Host Without Making It Precious
Notes from wiping an old single-node k3s setup and rebuilding it with a smaller, cleaner baseline for ingress, certificates, and persistent storage.
Voice Control for Hermes Agent over Telegram
How I wired Hermes Agent to accept Telegram voice notes, transcribe them locally, and reply with local text-to-speech without adding another paid speech API.
Giving Hermes Read-Only Access to GCP, AWS, and Kubernetes
A practical setup giving an AI agent read-only access to debug QA and production on GCP, AWS, GKE, and EKS without touching workloads or secrets.
Cloud Run as a Gemini proxy for an unsupported region
How I used Google Cloud Run as a small AI gateway so clients in an unsupported region can still call Gemini through a supported GCP region.
Production Ruby Debugging: A Progressive Escalation Guide
A progressive escalation guide to debugging Ruby applications in Kubernetes production without restarting: rbspy, kubectl debug, signals, rbtrace, and gdb.
Incus vs. Docker: System Containers vs. App Containers
A practical comparison of Incus and Docker: when system containers suit development environments better than single-process application containers.
Redis High Availability: Shared Sessions and Fault Tolerance
How to split Redis into isolated session, cache, and Sidekiq instances so a cache blip never logs users out or stops background jobs.
Identity-Aware GCS Access Instead of Hashed Secret URLs
Replacing hashed 'secret' URLs in Google Cloud Storage with IAM Conditions and domain-restricted access that verifies identity instead of hiding a path.
How I Finally Got Sentry to Create GitHub Issues (After 3 Hours of Clicking Around)
How to fix Sentry's GitHub integration when it shows connected but issues won't create, plus why linking Sentry errors to GitHub issues is worth the setup.
Faster Rails Docker Feedback Loop: Runtime Deps and HMR
How I reduced Docker development friction across three Rails apps by removing rebuild-heavy steps, adding runtime dependency sync, and enabling webpack HMR.
Redis Cleanup and Memory Management in Kubernetes
A production-tested guide to keeping Redis healthy in Kubernetes: memory control, safe cleanup patterns, Sidekiq pitfalls, backups, and troubleshooting.
Fixing the Asia/Rangoon Postgres Error on Alpine Linux
If you recently updated your Docker images and were greeted by a PG::InvalidParameterValue: ERROR: time zone "Asia/Rangoon" not recognized, you aren't alone.
Sending Email from an Ubuntu VM on Oracle Cloud (OCI)
A Postfix and OCI Email Delivery setup guide covering SMTP auth, sender approval, SPF/DKIM/DMARC, and the errors that block delivery.
Optimizing a 1C1G Ubuntu Cloud Server
A production-tested checklist for making a 1 vCPU, 1GB RAM Ubuntu server stable: swap, kernel tuning, service removal, and MySQL/PHP-FPM limits.
Zero-downtime GKE upgrades with PostgreSQL failover
Blue/green node pools plus a Kubegres replica promotion let you upgrade a GKE cluster, PostgreSQL included, without a maintenance window.
OpenSSH on WSL: enabling remote SSH access on Windows 10
Install and configure OpenSSH inside WSL2, enable systemd, and forward a Windows port so you can SSH into your WSL environment from anywhere on your LAN.
From 499 to 200: Fixing Nginx Timeouts in a Rails API
How Puma worker timeouts and Nginx 499 errors expose slow Rails requests, and how to fix them with aligned timeouts, background jobs, and caching.
Signed React Native Android APKs from GitHub Actions
A GitHub Actions pipeline that decodes a base64 keystore from repository secrets and produces a signed React Native Android APK on every push.
Optimizing Android Builds in GitHub Actions
Android builds in GitHub Actions run 10-30 minutes unoptimized; layered Gradle and Yarn caching plus scoped environment secrets get that down to a few minutes.
Migrating a GCP Classic Load Balancer to Global External
GCP lets you migrate a Classic Application Load Balancer to the Global External Load Balancer with a staged, four-state rollout that avoids downtime.
Enabling Local HTTPS for Development and Debugging
Local HTTPS matters because browser APIs like Service Workers require a secure context, and this covers Caddy, Nginx with mkcert, Puma-dev, and Cert-Manager.
Troubleshooting pgpool Connection Termination in Kubernetes
Intermittent pgpool connection drops in Kubernetes usually trace to max_connections, idle timeouts, or NetworkPolicy issues, found layer by layer.
GKE's Two Health Check Systems and the Premature 502
GKE deployments can pass every readiness probe and still serve 502s, because Kubernetes probes and the Cloud Load Balancer run two separate health checks.
Speeding Up Docker: Fixing Slow Host-to-Container File Sync
Bind-mounted host directories make Docker Desktop file access painfully slow on macOS and Windows, and this covers volumes, docker-sync, Mutagen, and WSL 2 fixes.
Enabling Gzip and Brotli Compression on Google Cloud CDN
Google Cloud CDN can compress responses with Brotli or Gzip automatically, covering the compressionMode setting, cache invalidation, and verifying it works.
Redis Sentinel Split-Brain: Fixing It on Kubernetes
How Redis Sentinel split-brain happens during Kubernetes node maintenance, and the sentinel tuning, anti-affinity, and PDB changes that stopped it.
Build and Push Docker Images to Quay.io with GitHub Actions
A working GitHub Actions workflow that builds a Docker image and pushes it to Quay.io using a scoped robot account and repository secrets.
Why npm ci Runs prepare Scripts for Git Dependencies
npm ci is not the script-free install it looks like; it still runs prepare scripts for Git-based dependencies, which broke Husky in CI.
Catching Database Configuration Drift Between Microservices
Two services sharing a database can pass every test and still fail in production if their DB configuration silently drifts apart.
Detecting Cloudflare Zero Trust Beyond the WARP Flag
WARP can report itself as off while Zero Trust still routes your Mac's traffic; here is how to check DNS, ASN, and DoH to find out for sure.
Monitor Cloudflare WARP Status on macOS with launchd
A launchd-scheduled shell script that detects when Cloudflare WARP reconnects on a company-managed Mac and sends a desktop notification.
Kubernetes Node Upgrades: Cordon, Drain, and Failover
A cordon-drain-upgrade runbook for Kubernetes nodes, plus the PodDisruptionBudgets, priority classes, and lifecycle hooks that prevent outages.
When AWS Lambda Makes Sense for a Single API Endpoint
A decision framework for when AWS Lambda fits a single API endpoint, and when a container or dedicated server is the better call instead.
Upgrading Bitnami Redis Helm Charts Without Downtime
A runbook for upgrading Bitnami's Redis Helm chart in Kubernetes, covering node migration, debug dry runs, and a tested rollback plan.
Kaniko: building container images without a Docker daemon
Kaniko builds and pushes container images without a Docker daemon, and the setup for it differs across GitHub Actions, Google Cloud Build, and CircleCI.
ARG, ENV, and BuildKit secrets: how each behaves in Docker
ARG, ENV, exported shell variables, and BuildKit secret mounts each persist differently in a Docker image, and only one of them is actually safe for tokens.
Linux kill signals: graceful shutdown in containerized workers
SIGTERM, SIGKILL, and grace periods control whether a containerized worker finishes its job before Kubernetes or Supervisord kills it outright.
Retry mechanisms for flaky CI and Docker builds
Wrapping curl, bundle install, and Docker builds in retry logic turns transient network failures in CI into automatic retries instead of full pipeline restarts.
jq and yq: transforming embedded key-value strings in YAML
jq and yq combine to turn a YAML file's embedded key=value strings into properly structured, typed fields, using a single scan and from_entries pipeline.
Kubectl aliases and functions that actually save time
A set of kubectl aliases and shell functions for pod access, JSONPath queries, and log searching that cut real typing out of day-to-day Kubernetes work.
Docker secrets: how layers leak them and how BuildKit fixes it
Docker's layer history persists secrets baked into ARG and ENV instructions, and BuildKit secret mounts are the practical fix that keeps them out of the image.
Docker Buildx --on-error: drop into a shell when a build fails
The --on-error flag in Docker Buildx drops you into a shell inside the failing build step so you can inspect state instead of guessing from logs.
How to Debug Docker Image Builds
Practical techniques for debugging Docker image builds: BuildKit output flags, inspecting intermediate layers, nsenter tricks, and multi-stage build targets.
Leapp vs aws-vault: Comparing AWS CLI Credential Tools
A practical comparison of Leapp and aws-vault for managing AWS CLI credentials, covering SSO and IAM setup, session tokens, and when each tool fits better.
Running Multiple Processes in a Single Container
Six ways to run multiple processes in one Docker container, from GNU Parallel and Foreman to a custom entrypoint script, Supervisord, and tmux, with trade-offs.
k3s on Ubuntu: Install, kubectl Access, and Unauthorized Errors
How to install k3s on Ubuntu, connect with kubectl, and fix the 'You must be logged in to the server (Unauthorized)' error caused by kubeconfig or expired certs.
How to Rotate GKE Cluster Credentials
The gcloud commands for checking certificate expiry, starting rotation, upgrading nodes to the new certificate, and completing GKE credential rotation.
Building and Deploying pgpool Images with GitHub Actions
A GitHub Actions workflow that builds multi-architecture pgpool images for several versions in parallel and pushes them to GitHub Container Registry.
Supervisord: Process Management for Containers and VMs
How supervisord monitors and restarts UNIX processes through simple INI-style config, with a working example for MySQL, PHP, and an init script.
Rails in Kubernetes: Migrations, Jobs, and Puma
Running a Ruby on Rails app in Kubernetes means containerizing it correctly and handling migrations, background jobs, and Puma as separate concerns.
GitHub Actions Variables: env, Contexts, Secrets, and Matrix
How GitHub Actions variables work in practice: env blocks, context variables, secrets, matrix strategies, and passing step outputs between steps.
Config Approaches: Files, Env Vars, and Config Servers
A comparison of YAML config files, Rails encrypted credentials, environment variables, and centralized config servers, with the trade-offs of each approach.
Redis in Ruby on Rails: Cache Server and Job Queue
Redis serves two very different roles in a Rails app, a disposable read cache and a durable job queue, and conflating the two causes real outages.
GCP 502 Errors from GKE Readiness Probe Failures
A GKE 502 with 'failed_to_pick_backend' traced back to readiness probes failing on every pod at once, and the liveness probe and anti-affinity fixes that resolved it.
When the OOM Killer Silently Kills a Background Job
A missed notification email traced back to the Linux OOM killer terminating a Sidekiq job mid-run, leaving a stuck Redis lock and no error logged anywhere.
count file size from json
A bash one-liner that uses jq to pull resource IDs out of lesson JSON files, then du to total their file sizes on disk.