Permissions and Privilege, Properly
Six independent layers stand between a process and a file, and every one of them can say no on its own. Mode bits, ACLs, capabilities, LSMs and user namespaces —…
The Life of a Packet: What Really Happens When Your Application Sends Data
From write() to the wire and back again — sockets, the routing decision, netfilter, conntrack, ARP, queueing disciplines, offloads and the container detour. The long version, because almost every hard…
A Second Machine: Redundancy, and Whether You Actually Need It
Two servers is not twice as reliable. It is twice as much to maintain, plus a class of failure that only exists when there are two. Here is how to…
Hardening a Public-Facing Service Beyond the Basics
You have closed the ports and set up key-only SSH. This is the next layer: making the service itself unable to do damage if it is compromised, using directives you…
Getting a Domain and Its DNS Right
Buying the domain is the easy part. Where the nameservers point, which records exist, and what your TTL is on the day you move — those are what decide whether…
Centralising Logs When One Server Is No Longer Enough
Three machines means three journals and no way to follow a request across them. Here is a small, honest setup using Loki and Alloy — and a note about Promtail,…
Manjaro, EndeavourOS and CachyOS: The Arch Derivatives Compared
They all give you Arch without the manual install, and then they differ on the one thing that matters most — whether you are getting packages from Arch's repositories or…
The BSDs: FreeBSD, OpenBSD and NetBSD, for Linux People
Not distributions of a kernel but complete operating systems, developed as a single thing, under a licence that lets anyone ship them without giving anything back. What that actually changes,…
Slackware: The Oldest One Still Standing
The last stable release was in February 2022, which sounds like abandonment and is not — the development branch was updated yesterday. Here is what Slackware actually is, and the…
Container Host Distributions: Fedora CoreOS, Flatcar and Talos
Server operating systems that exist only to run containers. No package manager to speak of, no SSH in one case, and updates that arrive as a whole new image —…