标签：#ux

We run about 283 scheduled jobs across a handful of machines. Each one is a shell script that declares its own schedule in a header comment, ships its own --test , and gets wired into cron automatically once that test passes. It is a tidy arrangement and it has a hole in it that took us five separate incidents to see, because every one of those incidents looked healthy from every angle we had built. Every number, command and file listing below was re-measured on one 16-core Ubuntu 24.04 box while writing this, not quoted from the commit that fixed it. Two of the numbers came out different, and one of the mechanisms did not reproduce at all. Those are the interesting parts. The hole is that "green" is a conjunction pretending to be a single fact. For a scheduled job to be doing its work, at least four things have to be true at once: the test passes, the test asserts the thing the job does, the job is actually scheduled, it is scheduled where its consumer exists . We had instrumentation for (1). We had a habit — a good one — of insisting on (2). We had nothing whatsoever for (4), and it turns out (4) is the one that runs silently for weeks. 1. The edge detector that compared the state against itself The first one is almost embarrassing in the diff and was invisible for six weeks in production. We have a job that fuses four inputs into one node health label — HEALTHY , DEGRADED , CRITICAL — writes it to a state file, and with --edge prints a line only when the label changes . Cron runs it every five minutes; a separate log records the transitions. The --edge path did this: write_state " $label " # $STATE now holds the new label prev = $( cat " $STATE " ) # ...and prev is read from it [ " $prev " = " $label " ] && exit 0 prev is read after the write. It equals $label by construction. The equality test held on every single run, --edge exited 0 with empty output on every real transition, and the transition log could not append. What makes it worth writing about is not the

Cómo solucionar docker run con Exited (1) en Raspberry Pi ¿Por qué ocurre este error? El código de salida 1 indica que el proceso principal del contenedor terminó con un error genérico. En Raspberry Pi, los casos más comunes son: Arquitectura incompatible : La imagen fue construida para amd64 (x86_64), pero Raspberry Pi usa arm32v7 o arm64v8 . Falta de binarios compatibles : El ENTRYPOINT o CMD del contenedor intenta ejecutar un binario compilado para otra arquitectura. Problemas de permisos o dependencias faltantes en el entorno embebido (especialmente en Raspberry Pi OS Lite sin GUI). Uso incorrecto de --net=host : En algunas versiones de Docker en Raspberry Pi, el flag --net=host puede causar fallos si el sistema no lo soporta correctamente. 🔍 Nota crítica : En tu comando original docker run --net = host -d -t myimage , hay un error de sintaxis: --net = host tiene espacios alrededor del = . Docker lo interpreta como un nombre de red literal " = host" , lo que probablemente falla. Pasos para solucionarlo Paso 1: Corrige la sintaxis del comando # ❌ Incorrecto (con espacios en `--net`) docker run --net = host -d -t myimage # ✅ Correcto (sin espacios) docker run --net host -d -t myimage ⚠️ Importante : En Docker CLI, los flags con valores no deben tener espacios entre el = . Usa --net=host o --net host , pero nunca --net = host . Paso 2: Verifica la arquitectura de la imagen Ejecuta en tu Raspberry Pi: docker inspect myimage --format '{{.Architecture}}' Si el resultado es amd64 , la imagen no es compatible con Raspberry Pi . Solución: Reconstruir la imagen para ARM Si tienes el Dockerfile , usa multi-arch build: # Al inicio del Dockerfile (antes de FROM) # syntax=docker/dockerfile:1 FROM --platform=$BUILDPLATFORM golang:1.21-alpine AS builder ... O construye explícitamente para ARM: # En tu máquina de desarrollo (x86_64) docker buildx create --use docker buildx build --platform linux/arm/v7 -t myimage:armv7 . --push # o para Pi 4 (64-bit): docker buildx build --platf

Ask a modern chatbot to help with something completely ordinary and there is a growing chance it will decline . Not because the request was dangerous, but because it brushed against a keyword, a topic, or a category that the vendor's safety systems treat as radioactive. A recipe that mentions alcohol. A history question about a violent event. A medical query you were entitled to ask. A creative scene with any conflict in it. The refusal arrives politely, firmly, and without much interest in whether it was warranted. Safety is real; this is not most of it Let us be fair, because this is a topic where fairness is usually the first casualty. Some restrictions are entirely sensible. Refusing to help synthesise a weapon, produce material that sexualises children, or plan real violence is not censorship; it is basic responsibility, and reasonable people want it there. The complaint is not about those lines. It is about everything on the wrong side of a border that has been drawn far too wide, catching countless legitimate requests to avoid a handful of genuinely bad ones. There is a difference between refusing to help build a bomb and refusing to discuss the chemistry a GCSE student is studying. Too many systems can no longer tell which one you are asking for. Whose values, decided by whom There is a question underneath the practical annoyance that deserves stating plainly: when a model refuses, whose standards is it enforcing? The boundaries of what these systems will and will not discuss are set inside companies, by people you did not elect, according to policies you cannot read, calibrated to a mixture of genuine safety concern, legal caution and brand protection. A handful of firms are, in effect, quietly setting the terms of acceptable enquiry for hundreds of millions of people, and doing so through refusals that arrive without an appeal, an explanation of the rule, or any way to contest the judgement. Reasonable people disagree about difficult topics, and different

The difference between a good infrastructure troubleshooter and someone who restarts services and hopes is a mental model. When "HTTPS times out" lands in your inbox, you don't guess — you know exactly which layer to interrogate first, and in what order. The network is a stack, so treat it like one Every request rides through the same layers, top to bottom: Application → TLS → Port → DNS → Gateway → Route → Interface That's the dependency order — TLS can't work if the port is closed, the port is meaningless if DNS resolved to the wrong host, and none of it matters if your interface has no IP. So you verify in the inverse order, from the ground up: Interface → IP → Route → Gateway → DNS → Port → TLS → Application Start at the bottom because a broken lower layer produces confusing symptoms higher up. Confirm each layer is healthy before you climb. The moment a layer fails, you've found your problem — everything above it is a red herring. Walk it: "HTTPS to api.example.com times out" 1. Interface — do we have a link and an address? ip addr show Look for your primary interface (say eth0 ) in state UP with an inet line like 192.168.1.20/24 . No inet ? DHCP failed or the link is down — stop here, nothing above will work. If the address is present and sane, climb. 2. Route — is there a path to the destination? ip route get 93.184.216.34 This shows the exact route the kernel would pick, including the source IP and gateway ( via 192.168.1.1 dev eth0 src 192.168.1.20 ). If you get "Network is unreachable" or no default route, you've found it. This is also the signature behind the classic curl error "No route to host." 3. Gateway — can we reach the first hop? ping -c3 192.168.1.1 ip neigh show ping tests reachability; ip neigh shows the ARP table. A gateway entry in state REACHABLE with a MAC address means L2 is fine. FAILED or INCOMPLETE means the gateway isn't answering ARP — a VLAN, cabling, or firewall problem. Note that many hosts drop ICMP, so treat a failed ping as a hi

This is Level 5 of our Kubernetes networking series. So far, we've built up a solid foundation: LEVEL 1 — Pod networking LEVEL 2 — Pod-to-Pod communication LEVEL 3 — Service (a stable internal endpoint) LEVEL 4 — DNS (service name → Service IP) But we still have a glaring gap: how does a real user on the internet actually reach your Kubernetes application? That's exactly what this article covers — Ingress, Ingress Controllers, and the newer Gateway API. Table of Contents The Problem: The Internet Can't Reach a ClusterIP The Basic Solution: Ingress and Gateway API What Is Ingress? A Routing Example Ingress Is Not the Actual Proxy A Simple Analogy: Traffic Police A Basic Ingress YAML Example Breaking Down the Key Fields Host-Based Routing Path-Based Routing Why Not Just Use a LoadBalancer Service for Everything? The Complete Traffic Flow Where Does DNS Fit In? The Ingress Controller A Typical Architecture Ingress vs Service Ingress vs LoadBalancer Service HTTPS and TLS Termination Why Terminate TLS at the Edge? Referencing a TLS Certificate Routing Multiple Domains The Gateway API GatewayClass, Gateway, and HTTPRoute Ingress vs Gateway API Important Distinctions: Ingress Is Not CNI or Service Troubleshooting Ingress Layer by Layer Common Ingress Mistakes The Complete Kubernetes Networking Picture (Levels 1–5) The Mental Model to Memorize Level 5 Checkpoint What's Next: NetworkPolicy The Problem: The Internet Can't Reach a ClusterIP Suppose you want users to reach your application at myapp.example.com . Inside your cluster, you have: Service : frontend ClusterIP : 10.96.20.10 frontend Service ├── Pod 1 ├── Pod 2 └── Pod 3 A user on the internet can't simply visit http://10.96.20.10 — that's a private Kubernetes Service IP, invisible outside the cluster. We need something sitting at the edge of the cluster to bridge that gap. The Basic Solution: Ingress and Gateway API Historically, Kubernetes solved this with Ingress . More recently, Kubernetes introduced a more expres

Here is why this article is worth your time: you cannot tell what a generated setup script does by reading the diff. A diff shows you the words that will run, not the files that will be touched, the network connections that will be opened, or the directories that will be wiped at execution time. For a small patch, manual review may be enough. For a server initialization or cleanup script produced by a free model, the danger is in the side effects you never see in the source. This guide turns that problem around. Instead of trying to predict behavior from generated code, you run the code inside a fake root filesystem and record the operating system calls it makes. The technique uses honeypot files, a minimal chroot, and strace to produce a syscall journal. It works especially well when you can generate the script with a free model and run it on a free Linux box that you are allowed to throw away afterward. Disclosure: This article was prepared as part of MonkeyCode's product outreach. If you have MonkeyCode's free model access and free server option available, you can use that server as the throwaway Linux box described in the examples below. The commands assume a Linux host where you can install strace and have root privileges, which is common for a disposable cloud instance or a small virtual machine you control. Build a fake root before you run anything Create a directory that will act as a minimal root filesystem. You do not need a full distribution; you only need enough structure for the script to attempt its operations and for you to watch what it touches. mkdir -p fake_root/bin fake_root/tmp fake_root/var/log fake_root/home/user fake_root/.ssh Inside this fake root, place simple executable stubs so that commands like ls , cat , and rm do not fail immediately. Use /bin/sh from the host in the chroot command later, or copy a static shell into the fake root if available. The important part is not completeness; it is observability. Create executable placeholders f

High-Speed eBPF/XDP Packet Filtering for Linux Server DDoS Mitigation Executive Summary Executive Summary & Key Security Takeaways ← Back to Articles Linux Kernel • XDP DDoS Defense High-Speed eBPF/XDP Packet Filtering for Linux Server DDoS Mitigation By Zyekh Abdul Qadir Jailani Published: 2026-08-04 15 min read (1750+ Words) Share Download .md Download .pdf eBPF/XDP Driver-Level Packet Ingestion & Ultra Fast Packet Dropping Executive Summary & Key Security Takeaways XDP_DROP Early Decision: Drop malicious UDP/SYN floods before allocating sk_buff memory. Kernel Map Invalidation: Dynamic IP blocklists via eBPF BPF_MAP_TYPE_HASH maps. Zero-Copy Performance: Process 10M+ packets per second on commodity server hardware. Clang/LLVM BPF Compilation: Build C programs directly into BPF bytecode targets. Table of Contents Understanding XDP Architecture vs Traditional Linux SKB Allocation XDP Packet Processing Actions (XDP_DROP vs XDP_PASS) Writing a Production XDP Packet Filter in C Compiling & Loading Bytecode Targets via Clang/LLVM Dynamic Blocklist Management via BPF Maps High-Throughput Packet Benchmark Verification Frequently Asked Questions (FAQ) 1. Understanding XDP Architecture vs Traditional Linux SKB Allocation Standard Linux network processing allocates a complex kernel socket buffer data structure (sk_buff) for every incoming packet before firewall rules (iptables/nftables) can evaluate the packet. Under volumetric DDoS attacks (such as 10 Million Packets Per Second UDP floods), the CPU time spent allocating and freeing sk_buff structures exhausts kernel memory and CPU cache lines, causing severe packet drops and server unresponsiveness. eXpress Data Path (XDP) provides a high-performance bare-metal packet processing framework. XDP programs execute eBPF bytecode directly inside the network driver's RX ring buffer before sk_buff memory allocation occurs. # Inspect network interface driver XDP support ip link show eth0 2. XDP Packet Processing Actions (XDP_DROP vs

Zero-Trust SSH Access Blueprint: FIDO2 Hardware Keys & SSH Certificate Authority Executive Summary Executive Summary & Key Security Takeaways ← Back to Articles Cyber Security • Zero Trust SSH Zero-Trust SSH Access Blueprint: FIDO2 Hardware Keys & SSH Certificate Authority By Zyekh Abdul Qadir Jailani Published: August 3, 2026 8 min read (1,250+ Words) Share Download .md Download .pdf Zero-Trust Infrastructure Blueprint for FIDO2 Hardware Tokens & SSH Certificate Authority Executive Summary & Key Security Takeaways Eliminate Static Keys: Migrate from static authorized_keys deployment to short-lived SSH Certificates. FIDO2 Hardware Bound: Enforce ed25519-sk key pairs tied to physical security tokens (YubiKey/FIDO2). Centralized Authority: Use an offline SSH Certificate Authority (CA) to sign user access requests with automatic 8-hour expiration. Zero Administrative Sprawl: Adding or revoking user permissions requires zero modifications on target servers. Table of Contents The Problem with Static SSH Public Keys Hardware Security Keys: OpenSSH FIDO2 / U2F Setting Up a Centralized SSH Certificate Authority Related Privacy & Security Tools Verification & Security Audit Checklist Frequently Asked Questions (FAQ) Traditional SSH key management across growing server fleets suffers from a critical flaw: static public key sprawl. Managing thousands of ~/.ssh/authorized_keys files across production instances creates massive administrative overhead, increases the blast radius of compromised developer workstations, and makes offboarding security audits nearly impossible. A true Zero-Trust SSH Access Model replaces static SSH keys with two cryptographic pillars: FIDO2 / Security Key Hardware Tokens ( ed25519-sk ): Private key material never leaves the physical YubiKey token and requires physical touch plus user PIN. SSH Certificate Authority (SSH CA): Short-lived SSH certificates (e.g., valid for 8 hours) signed by a centralized CA key, eliminating manual authorized_keys deploym

If you've ever run a Linux VM in VirtualBox and had copy-paste between your host and guest just... stop working, this post is for you. What started as a simple "my clipboard isn't syncing" turned into a proper detective story involving conflicting installations, a kernel module stuck "in use," and a systemd service quietly failing on every single boot. Here's the full walkthrough — what broke, how we figured out why, and how we fixed it for good. The Setup I run a Kali Linux VM inside VirtualBox on my host machine, mainly as a home lab for practicing infrastructure and security tooling. One day, shared clipboard between my host and the guest just stopped working. My first instinct was to run apt update && apt upgrade — but nothing changed. That's actually an important clue we'll come back to: apt upgrades regular packages, but it does not automatically rebuild or reinstall VirtualBox Guest Additions , which is the component actually responsible for clipboard sharing. What Actually Makes Clipboard Sharing Work Before diving into the fix, it helps to understand the moving parts, since "clipboard sync" isn't one single thing — it's three things working together: The vboxguest kernel module — a driver inside the guest OS that lets it talk to VirtualBox itself. VBoxService — a background daemon (runs as root) that handles ongoing communication with the hypervisor: time sync, clipboard, shared folders, and more. VBoxClient — a per-user process that specifically handles the clipboard and display integration, and talks to VBoxService through the kernel module. If any one of these three breaks, clipboard sharing breaks — and the error messages don't always make it obvious which one is the culprit. First Round: The Standard Checklist We started with the usual suspects for VirtualBox clipboard issues: Enable Bidirectional clipboard : In the VM window, under Devices > Shared Clipboard , this needs to be set to Bidirectional (or the direction you want). It resets sometimes after

Your storage hardware narrows the choice first: raw NAND requires UBIFS on UBI; ext4 and f2fs are not candidates there. On managed flash such as eMMC, our default is a read-only squashfs root plus a writable data partition, which pairs cleanly with A/B updates and integrity verification. Choose a plain ext4 root instead when your product needs a writable root and your team values familiar recovery tooling over immutability. Every embedded Linux product ships a root filesystem, and its format is often chosen by default — the vendor BSP generated ext4, so the product ships ext4. It is a real decision with long-term consequences for updates, power-cut behaviour and flash wear. This article works through the root filesystem format decision for the four realistic candidates: ext4, f2fs, squashfs with overlayfs, and UBIFS. The context The root filesystem format decision arises early, usually when the build system asks for it — Yocto through IMAGE_FSTYPES , Buildroot through its Filesystem images menu. Both can generate all four formats, so the build system does not constrain you. Five forces do. Storage technology. Raw NAND attached through the kernel's MTD layer exposes eraseblocks that wear out and can go bad; the filesystem stack must manage wear levelling and bad blocks itself. Managed flash — eMMC, SD, UFS — hides all of that behind an internal controller (an FTL) and presents an ordinary block device. Block filesystems such as ext4, f2fs and squashfs require a block device; UBIFS requires UBI on MTD. The hardware choice between raw NAND and managed flash removes half the candidates before any software argument starts. Update strategy. With image-based A/B updates — the model we recommended in Choosing an A/B Update Layout for Your Product — the root filesystem is replaced as one complete image, so a read-only format fits naturally. Package-based updates on the device require a writable root. Power-cut behaviour. Embedded devices lose power without warning. A never-w

Nuxt 4.5 launched last month and it's really neat. One of my most favorite features is the...

Lighthouse kept warning me about inefficient cache lifetimes, even though I had already added caching for my static files. The missing piece was Nuxt Image and its generated /_ipx URLs . In this post, I’ll share the simple caching setup I use for Nuxt build files, public assets, and optimized images without risking stale content after deployment. The basic rule is simple: Cache files aggressively when changing the file also changes its URL. Be more careful when the same URL can serve different content later. You have probably seen the same Lighthouse warning I have: Use efficient cache lifetimes. Browser caching for static files is usually straightforward. You add a Cache-Control header, choose a reasonable lifetime, and the browser avoids downloading the same files again on every visit. However, in a Nuxt application, not every static-looking file should use the same caching policy. Nuxt build files are automatically versioned. Files inside public/ usually are not. Nuxt Image also creates transformed image URLs under /_ipx , which need their own cache rule. In this post, I’ll go through the setup I use, including the Nuxt Image rule that was missing during my latest Lighthouse audit. The simple caching rule The most important question is not whether a file is an image, font, or JavaScript file. The important question is: Will the URL change when the file changes? When the answer is yes, you can safely cache the file for a very long time. When the answer is no, you should use a shorter cache lifetime. Otherwise, visitors may continue seeing an old version after you deploy an update. What the cache directives mean Here are the main directives used in this setup: public allows browsers and shared caches such as CDNs to store the response. max-age controls how long the browser considers the file fresh. s-maxage controls how long shared caches such as Cloudflare consider it fresh. immutable tells the browser that the file is not expected to change while that URL exists.

A few months ago I got properly bitten by the Linux bug. Ubuntu became my daily driver, I started digging into terminal tools way past the point of “practical necessity,” and I got obsessed with an idea that wouldn’t leave me alone: old hardware doesn’t have to die just because it’s old. I work as an on-site IT coordinator, handling day-to-day IT operations for an industrial company. Between that and years of general sysadmin work, I’ve watched a lot of perfectly usable machines get pulled out of service and shipped off as e-waste — not because they were broken, but because someone decided they were “too old” for whatever OS they were running. A Core 2 Duo with a fresh SSD and a lightweight distro can still be a genuinely useful computer.That gap between “technically obsolete” and “actually still works great” is where a lot of my curiosity lives right now. The gap I kept running into The more I looked into the Norwegian Linux scene, the more I found — Skolelinux/Debian Edu has deep roots here, NUUG (Norwegian Unix User Group) has been active for decades, and there’s a project called PC-Aid that collects, wipes, and reinstalls Debian Edu on used PCs, then sends them to schoolchildren in Ukraine. It’s been running for a few years now, quietly doing real, tangible good. I wanted in. But when I looked for any of this activity near me — Sunnmøre, a district on Norway’s west coast (in Møre og Romsdal county, home to the town of Ålesund) — there was nothing. No local NUUG chapter, no meetup, no group. Just… a gap. (If you’re not from Norway, don’t worry, most Norwegians would need a map for this too.) So instead of waiting for someone else to fill it, I started SLUG — Sunnmøre Linux User Group. Reaching out, awkwardly, like you do Starting a group is the easy part. Getting it to mean anything is harder. So I did the obvious thing: I found people who’d actually been part of PC-Aid and reached out. First was someone who’d been active in the project early on. I sent a message

The solar-powered limited edition may be here to mark the final Dutch Grand Prix taking place in Zandvoort, but it's the juicy iconic colorway WIRED's been waiting for.

A navigation map should help the user move through the world, not fight every gesture they make. I recently hit a deceptively simple bug while building field guidance in a React Native / Expo app: the route rendered correctly and the camera followed the current position, but users could not meaningfully zoom or pan while walking. They could pinch the map, but the next location update snapped the camera back to a fixed zoom. The map looked active. The experience felt broken. The cause: two camera owners The implementation combined two useful features: followsUserLocation={true} on the native map. animateCamera(...) after every location update, using a fixed walking zoom and pitch. Each feature was reasonable on its own. Together, they gave the camera two automatic owners and the user none. A pinch gesture changed the zoom for a fraction of a second. Then a GPS update arrived and our effect applied the navigation camera again. On iOS, native user-follow behavior added another layer of camera control. A better model: follow mode and explore mode The fix was not to stop navigation. Route progress, distance, bearing, breadcrumb recording and off-route detection should all continue regardless of what the user does with the map. Only the camera behavior should change. We now keep a small piece of local UI state: const [ cameraFollowing , setCameraFollowing ] = useState ( navigationActive ); useEffect (() => { if ( ! navigationActive || ! cameraFollowing || bearing == null ) return ; mapRef . current ?. animateCamera ( walkingCamera ( currentCoordinate , bearing ), { duration : 480 }, ); }, [ currentCoordinate , bearing , navigationActive , cameraFollowing ]); The native follow prop uses the same state: < MapView showsUserLocation followsUserLocation = { navigationActive && cameraFollowing } onTouchStart = { () => { if ( navigationActive ) setCameraFollowing ( false ); } } /> As soon as the user touches the map, the camera enters explore mode. Pinch, pan and rotation work n

I Turned an Android Phone Into a No-Root Cybersecurity Learning Workspace Most people don't look at an Android phone and think: "This could be a practical Linux, Python, networking, and cybersecurity learning environment." Usually, the assumption is that serious technical learning requires a laptop, a virtual machine, or dedicated hardware. I wanted to see how far I could push the opposite idea. What if the Android phone you already own could become a practical learning workspace without root access? That experiment eventually became DedSec . DedSec is a free and open-source project built around Android and Termux. Its goal is not simply to install a large collection of tools. The goal is to create an environment where someone can actually learn how the pieces fit together. Repository: https://github.com/dedsec1121fk/DedSec Official website: https://ded-sec.space/ Why Android? Android devices are incredibly capable machines. Even an older phone can provide: a Linux-like command-line environment through Termux Python Git package management networking utilities file manipulation scripting automation local development workflows And you can do a surprising amount without root access. The limitation isn't always the hardware. A bigger limitation is often knowing what to do with it. You can install dozens of packages, copy commands from tutorials, and still not understand what is actually happening underneath. That was one of the problems I wanted DedSec to address. More Than a Collection of Scripts There are plenty of repositories containing security scripts. That wasn't enough for what I wanted to build. Installing a tool doesn't automatically teach you: what problem the tool solves when you should use it what its output means what layer of the system is failing how networking concepts connect together why a command works why another command fails So DedSec gradually became an ecosystem rather than just a scripts directory. The project connects several things together:

Docker for Beginners: Images, Containers, Ports, and Volumes Explained If you've ever followed a programming tutorial and seen something like: docker run ... you've probably wondered: What exactly is Docker doing? I had the same question when I started learning Docker. At first, I thought Docker was simply a way to "run applications in containers." But there is much more to it. Once I understood four concepts — images, containers, ports, and volumes — Docker became much easier to understand. So let's break it down from the beginning. What Is Docker? Docker is a platform for building, packaging, and running applications in isolated environments called containers . The basic idea is simple: Package an application together with the things it needs to run, and make that package portable. For example, imagine you build a Python application. Your application might depend on: Python 3.12 FastAPI Uvicorn Several Python packages Environment variables Certain system libraries On your computer, everything works. Then someone else downloads your project. They install a different Python version. A package is missing. Something behaves differently. Now you have: "It works on my machine." Docker helps reduce this problem by allowing you to define the environment your application should run in. The Four Concepts You Need to Understand Before learning Docker commands, understand these four things: Docker Image ↓ Docker Container ↓ Ports ↓ Volumes Let's look at each one. 1. What Is a Docker Image? A Docker image is a packaged, read-only template used to create containers. Think of it like a blueprint. For example: Docker Image │ ├── Ubuntu ├── Python ├── Application code ├── Dependencies └── Configuration An image contains the instructions and filesystem needed to create a container. You can download images from container registries such as Docker Hub. For example: docker pull nginx This downloads the Nginx image. You can see your downloaded images with: docker images You might see s

A GUI IDE is great for local development, but it quickly falls apart when you transition to headless servers, low-power client machines, or remote clouds. If you pair an AI agent like Antigravity CLI with a native-first Neovim configuration, you can bypass complex setups entirely. Since the AI assistant is the one doing the heavy writing, refactoring, and saving of files, you don't need to be a Vim keyboard wizard to use Neovim. The editor simply becomes a fast, native terminal pane for inspecting the code and reviewing git diffs. By pairing the two, you can build a modern, high-performance workspace built on native features that runs perfectly in any terminal. Here is the backstory of how we ended up with this setup, and why going native-first in Neovim became our preferred remote development tool. 💻 The Backstory: From a Broken Screen to Ephemeral Cloud VMs My 10-year-old MacBook Pro recently had its screen break. It still works fine, but it is now permanently anchored to my desk with an external monitor. Buying a new laptop is too expensive right now, but I have an iPad that I use when traveling. To work from the iPad, I use Google Cloud Shell via the web browser. This allows me to write and inspect code using the Cloud Shell Editor and run Antigravity CLI . However, Cloud Shell has strict storage, memory, and CPU limits. As an Application Modernization, DevOps, and SRE developer, my projects are resource-intensive. I need to run multi-container environments like the Google Cloud Microservices Demo . Plus, next week I’m attending the Gemma Day Event hosted by the Google DeepMind team. This will be my first hands-on contact with Gemma, and after the event, I plan to continue testing how the model interacts inside a Kubernetes cluster, establishing observability for LLM-native metrics (like token throughput and response latency). I don't want to buy an expensive machine with a GPU just to test these setups. Instead, I want to spin up a GPU-enabled VM in Compute Eng

I asked Linux for one 4 KiB page from the start of a cold file. Four pages came back. I moved the same read one page further in, ran it again, and got one. Same file, same syscall, same kernel. The only thing that changed was where I started reading, and I spent twenty minutes assuming the tool I'd just written was miscounting. It wasn't. A read that starts at byte zero is treated as a promise. There's a branch in mm/readahead.c that reads, in full, if (!index) goto initial_readahead; . Offset zero means the kernel takes you for a program that's about to stream the whole file, and it fetches ahead immediately. Start anywhere else and you're assumed to be seeking randomly until a pattern proves otherwise. Nothing in my call said a word about my intentions. It inferred them from an offset. I spent two weeks on this sort of thing recently. Not for work, and not toward anything shippable. The short version of what I found is that a surprising amount of the machinery under a running program isn't carrying out instructions at all. It's guessing. The bench , because it changes how you should read every number here: an ext4 filesystem on a loop device, inside an OrbStack Linux VM on an Apple Silicon Mac, kernel 7.0.14, 4 KiB pages, read_ahead_kb at 128. That's a container sharing the host's kernel, not bare metal, and the host reclaims memory aggressively enough that a fully cached file can go cold in fifteen seconds. Reads came from dd ; the page-by-page counting came from a small C tool I wrote that mmap s a file and asks mincore() which of its pages are resident. You're not addressing the disk, you're addressing the page cache The model most of us carry is that read() goes and gets bytes off a device. It doesn't. It copies bytes out of the page cache into your buffer, and the page cache is just RAM the kernel uses to remember parts of files. If what you want is already there, no device is involved. If it isn't, the kernel fills the cache first and then copies. Either way

TL;DR What: Gammu SMSD — the daemon behind a huge number of SMS gateways, alerting rigs and 2FA senders — runs an operator-configured hook every time a text arrives. With the Files backend and RunOnReceive enabled, the SMS sender ID was escaped for use as a filename but not for the shell , and then appended to a /bin/sh -c command line. A sender ID containing shell metacharacters executed arbitrary commands as the gammu-smsd user. Impact: Remote, unauthenticated code execution triggered by sending a text message. Commands run with the daemon's privileges. Missing neutralization of special elements in an OS command (CWE-78). Fixed in: Gammu 1.43.3 . Advisory GHSA-9vjj-v46c-c5qf , published 25 July 2026, rated High (8.1) , credited to me as reporter. CVE requested, pending GitHub assignment. Why you should care Most command-injection bugs need the attacker to already be talking to your HTTP API. This one needs a phone number. Gammu SMSD sits on the receiving end of a modem or GSM dongle. Hospitals use it for on-call paging, monitoring systems use it for SMS alerts, and plenty of small shops use it as the cheap half of a 2FA setup. A very common configuration is: store incoming messages as files (the Files backend ), and run a script whenever one arrives ( RunOnReceive ) — to forward it, log it, or trigger something. The input to that script comes from the outside world over the cellular network. The sender doesn't authenticate to anything. And on many networks the sender ID is an arbitrary alphanumeric string , not a phone number — that's how banks send texts that say "HSBC" instead of a number. Alphanumeric sender IDs are attacker-controllable, and they can carry the exact characters a shell treats as syntax. That is the whole bug: a value from a text message reaches /bin/sh . The setup Gammu SMSD's Files backend writes each received message to a file whose name includes the sender. To keep that filename legal, it runs the sender ID through an escaping function first