What Ships in Your Container Image, and What Happens to It After You Push
A node is replaced, the pod that lands on it goes to ImagePullBackOff, and nothing has changed: the deployment pins the image by digest, the registry still answers for that…
The Life of a DNS Zone: What Your Parent Publishes About You
A company changes DNS providers on a Friday. The new zone is byte-identical to the old one, checked record by record with dig @ns1.newprovider.net; the nameservers are changed at the…
The Half of Patching That Happens After the Patch is Installed
A machine has just taken a real OpenSSL security upgrade. Five processes are still running the deleted library, and the tool that is supposed to say so, run exactly as…
The Life of a System Call: Who Actually Answered
Here is a small program. It opens a file, forks, waits for the child, asks its own PID and exits: five library calls, every one written by name. This is…
etcd, Honestly
Six stages, from the member that answered to the restore that hands your data back on a clock that has been wound backwards. Why a successful etcd restore can break…
The Life of a Unix Socket
Seven stages, from an object with no name to a name with no object. Why every diagnostic tool on the machine prints a path it never checked, why only the…
The Life of a Certificate
The six stages between an ACME account and a certificate your server is actually serving, and the two private keys that never meet. Why a renewal that succeeds proves nothing…
How a Path Becomes a File
Path resolution is not a function from strings to strings. The six stages between a pathname and an open file: the trailing slash that defeats O_NOFOLLOW, why .. is a…
The Life of a File Descriptor: Seven Stages from open() to close()
A daemon starts in under a second on one host and takes forty minutes on another — same image, same version, same configuration. No error, no log line, nothing in…
Kubernetes, Honestly: Seven Stages Between kubectl apply and a Running Container
A self-managed cluster is upgraded from v1.33 to v1.36, and containerd from 1.7 to 2.3 in the same window. Pods start. Over the following days one node kills containers without…