Tech-related posts from a sysadm engineer.
I started using neovim when v0.5.0 was released, that version was the first to introduce init.lua as your starting point. I was happy with vim, but always found vimscript cumbersome to use. I like to customize my editor a bit, nothing really complicated or defying the defaults, but you know, some QoL mapping here, a time-saving function there... and vimscript was setting me back. Lua is a very…
Internet is plagued with bots searching for security vulnerabilities, often this involves running a port scan of some sort to discover services on remote hosts. I run a small VPS to host some services and while most of them are only listening on the wireguard interface I wanted a system that automatically blocked such port scans. In the process I also wanted to switch the system to fully utilize…
I was surprised to learn that Kubernetes doesn't include a built-in mechanism to pre-pull images before initiating a deployment rollout. In my mind, it makes perfect sense to pull the image before any other action. Of course, this choice aligns with the Kubernetes philosophy of managing stateless, ephemeral workloads where multiple replicas and nodes are expected to mitigate the impact of pod…
Today, I wanted to create a basic locking mechanism in Python to prevent certain commands/functions from running concurrently. I have an script that runs inside of a CI/CD pipeline but it can also be triggered manually. The problem is that certain commands within the script shouldn't be executed in parallel and I would like to handle that gracefully. use case Imagine a Python script…
NixOS and its ecosystem offer a robust tool known as the NixOS Integration Test Framework , which is the backbone for testing NixOS modules and packages . This framework has the capability to orchestrate multiple virtual machines within virtual networks, where each machine is configured declaratively. The tests are scripted in Python, providing a suite of objects for interacting with and testing…
NixOS offers native support for systemd-nspawn containers, a powerful and simplified alternative to LXC. Systemd-nspawn is like a supercharged chroot , harnessing the capabilities of the Linux kernel, using cgroups and namespaces to provide isolation within a container. This isolation covers: Full virtualisation of the file system hierarchy Management of the process tree IPC subsystems Restricted…
Systemd implements powerful resource limit controls thanks to linux cgroups. In this short post I explain how to configure and test those limits. setting resource limits In the systemd configuration, you can define resource limits for services and units. Here's an example configuration snippet that sets memory and CPU limits for a service: [ Service ] # Define a custom slice for these limits…