DevOps. Self-hosted. Security.
RSS FeedNotes on DevOps, infrastructure, self-hosting and cybersecurity — practical guides from real-world operations.
Read the posts below or head over to the About page.
Recent Posts
-
Cilium Tetragon: eBPF runtime security that blocks, not just logs
Falco and most eBPF security tools can only alert after the fact. Tetragon, Cilium's runtime security engine, can do more — kill a process synchronously in the kernel before the syscall even returns. We break down the TracingPolicy anatomy, enforcement risks, and the safe rollout pattern: audit first, Sigkill later.
-
containerd 1.x is done: what breaks moving to containerd 2.0 before Kubernetes 1.36
Kubernetes 1.35 is the last release that still supports containerd 1.x. We break down what actually changes in config.toml v3, the CRI plugin, and CDI for GPUs, and how to roll containerd 2.0 out node by node with zero downtime.
-
PreDelete hooks in Argo CD 3.3: why deleting resources in GitOps was quietly dangerous
Argo CD 3.3 adds PreDelete hooks — a gate before an actual prune that simply didn't exist before. We cover what changed, the hook-delete-policy semantics, and how to protect stateful resources.
-
In-Place Pod Resize reaches GA in Kubernetes 1.35: resizing CPU/memory without restarting pods
Kubernetes 1.35 marks In-Place Pod Resize stable: requests and limits on a running pod can change without killing containers. We cover the resize subresource, container resize policies, what still forces a restart, VPA's InPlaceOrRecreate mode, and the fallout for the scheduler and cluster autoscaler.