Recent content on Underkube
A week of running LLM inference on your own Kubernetes clusters, a Secure Boot bypass that went unnoticed for a decade, terminal demo tooling, UPS dashboards and plenty of retro hardware. This is the last post for a while: I’m off on holidays, so the newsletter takes a break and will be back once I’m home. AI, Models & Agents The real AI risk is inside the labs: antirez argues the main…
A week of open-weight model routing and local AI tooling, OCI-backed package managers and registries, a Linux kernel CVE deluge, self-hosting mail and media, plus a good run of retro-computing and hardware rabbit holes. AI, Models & Agents Kimi K3 is competitive with Fable; Kimi K3 + Fable is SoTA: Fireworks benchmarks routing between the open-source Kimi K3 and the closed Fable across 1,000+…
A week of new open frontier models and AI CLI wire-level analysis, a 15-year-old Linux kernel privilege escalation, ZFS and FreeBSD tooling, plus plenty of hardware, SDR and retro-computing rabbit holes. AI, Models & Agents Kimi K3 Tech Blog: Open Frontier Intelligence: Moonshot’s tech blog for its Kimi K3 model, pitched as open frontier intelligence. Announcing Bonsai 27B: The First…
A week of DIY NAS builds and ZFS tooling, new frontier model releases from OpenAI and xAI, clever local inference tricks, and a couple of serious virtualization and AI-agent security stories. AI, Models & Agents GPT-5.6: Frontier intelligence that scales with your ambition: OpenAI’s latest release, pitched on more intelligence per token and stronger performance per dollar. Introducing Grok…
A week centred on running LLMs locally, new model releases from Anthropic and the government vetting of others, a big Immich release and self-hosting tooling, a couple of unsettling disk-encryption and firmware stories, and reviving old hardware. AI, Models & Coding local-inference-lab/rtx6kpro / jamesob/local-llm: A wiki on running large LLMs (Qwen3.5-397B, Kimi-K2.5, GLM-5) on PCIe GPUs without…
A week mixing local LLM tooling, terminal-driven virtualization, OCI registries and PXE boot servers, a few BSD and mobile Linux releases, and some hardware tinkering. AI, Models & Coding microgpt: Karpathy’s minimal GPT implementation in a single gist, for understanding the architecture from the ground up. vLLM + LMCache: A Starter Guide, No GPU Required: A contributor-focused walkthrough…
A week heavy on local LLM coding setups, token-trimming tooling, dotfile managers, ZFS self-hosting, and a couple of supply-chain security reminders. Local AI & Coding Agents Running local models is good now / Ask HN: Has anyone replaced Claude/GPT with a local model?: Vicki Boykis argues local agentic coding has become genuinely good over the past few months, alongside the Hacker News thread of…
An export directive on frontier AI models, an AI agent running amok in Fedora, GPU passthrough to keep Adobe on Linux, Apple’s container machines, and Steam running on a Nintendo Switch. AI, Agents & Tools Statement on the US government directive to suspend access to Fable 5 and Mythos 5: The US government has issued an export control directive to suspend all access to Fable 5 and Mythos 5…
Running LLMs on a Game Boy Color and a £200 datacenter GPU, GPS jamming over Europe, npm supply chain compromise, aircraft tracking on your ceiling, and DOOM’s kryptonite: the Neo Geo. AI, Agents & Tools maddiedreese/gbc-transformer / Reddit discussion: TinyStories-260K running locally on a stock Game Boy Color — no phone, PC, Wi-Fi, link cable, or cloud. The cartridge boots a ROM and the…
Claude Opus 4.8 dropped and the Claude Code ecosystem exploded this week — undocumented configs, deep-dive guides, GitHub Actions, and tools to catch the slop agents leave behind. Also: Gentoo speedruns, Linux Secure Boot expiration concerns, mesh networking deep-dives, and ambient sound apps. AI, Agents & Tools Introducing Claude Opus 4.8: Anthropic’s latest Opus-class upgrade — stronger…
Heavy FreeBSD week — a new kernel LPE (CVE-2026-45250), a decade-long Ubuntu migration story, and OpenBSD 7.9 out. Also: Flipper One opens up community development, a self-healing WireGuard mesh, and tools for stripping AI watermarks. AI, Agents & Tools microsoft/AI-Engineering-Coach: Microsoft’s toolkit for better agentic engineering — patterns, prompts, and workflows aimed at improving…
Busy week in AI agent land — Hermes Agent keeps growing, Anthropic’s Mythos finds a real CVE in curl, and dnsmasq ships fixes for six serious vulnerabilities. Also: Faraday cages busted, a GPU-rendered terminal with a spinning rat, and the Mac clock project gets a proper full-length video. AI, Agents & Tools NousResearch/hermes-agent / I Switched from OpenClaw to Hermes Agent: Hermes Agent…
Another Linux LPE in the wild, OpenAI launches ads in ChatGPT, and a solid batch of self-hosted tooling covering monitoring, photo sharing, and pastebins. Security V4bel/dirtyfrag: Linux privilege escalation that chains the xfrm-ESP and RxRPC page-cache write vulnerabilities — deterministic (no race condition), affects ~9 years of kernel versions, and gains root on Ubuntu, RHEL, Fedora, and…
Big week: a no-race, 100% reliable Linux LPE hitting all major distributions, a flood of AI agent sandboxing content, and another wave of Claude Code tooling. Security Copy Fail — CVE-2026-31431 / Copy Fail: 732 Bytes to Root: A 100% reliable Linux local privilege escalation exploiting AF_ALG + splice() for a 4-byte page cache write — no race condition, no per-distro offsets, bypasses on-disk…
This week features a heavy focus on AI agent tooling and Claude Code in particular, a notable cluster of sandboxing and security links, fresh SDR and hardware hacking projects, and a few significant industry moments including Apple’s leadership change and Intel pulling back from open source. Cloud, Kubernetes & Infrastructure Btrfs | Internals for Interns - A deep dive into Btrfs internals,…
This week’s highlights feature the latest in AI agent orchestration, local LLM accessibility on Apple hardware, and a nostalgic trip through classic Mac OS emulation and ports. Cloud, Kubernetes & Infrastructure Flightdeck - A fault-tolerant, event-driven AI agent framework built on Kafka that manages session context and infrastructure. Running AI agents safely in a microVM using Docker…
This week’s collection explores the latest in AI agent strategies, Linux security tools, and deep dives into LLM architectures. Cloud, Kubernetes & Infrastructure Prometheus Workshop - A comprehensive hands-on workshop for mastering Prometheus monitoring. SpinKube - A project that streamlines developing, deploying, and operating WebAssembly (Wasm) workloads in Kubernetes. Podman in…
After a refreshing week off on PTO, I’m back with a double-sized edition covering two weeks of interesting finds in the tech world. This update features a heavy focus on the emerging “NanoClaw” ecosystem, several critical supply chain security disclosures, and some fascinating hardware hacks. Cloud, Kubernetes & Infrastructure 7 Configuration Changes That Turn a Multi-Homed Host…
A diverse week featuring deep dives into Btrfs scaling, a flurry of new AI agent control planes, and some critical security updates for CI/CD pipelines. Cloud, Kubernetes & Infrastructure FOSDEM 2026 - The Filesystem Diaries: Scaling Btrfs in an Enterprise - A detailed look at the challenges and solutions for employing Btrfs at scale in large organizational environments. Scaling Btrfs to petabytes…
This week’s collection highlights the rapid advancement of local AI agent infrastructure, critical security advisories for Linux armor, and significant updates across the Kubernetes and FreeBSD ecosystems. AI, Agents & Tools Oh My OpenAgent - An open-source multi-agent orchestration harness designed for autonomous codebase tasks, featuring specialized agents for planning, execution, and…
This week’s reading list is a mix of high stakes security post mortems, ranging from the XZ backdoor to recent GitHub Actions exploits, alongside the rapid evolution of the OpenClaw ecosystem and some surprising hardware moves from Apple. AI, Agents & Tools OpenClaw: Our Comprehensive Guide for Beginners A deep dive into the open source framework for building proactive, personalized AI…
This week’s roundup covers a wide range of topics, including the architectural limits of etcd, GPU-initiated networking, the nostalgic design of Apple’s breathing lights, and the surprising persistence of floppy disks in transit systems. Cloud, Kubernetes & Infrastructure Why etcd breaks at scale in Kubernetes - A deep dive into the architectural limitations of etcd and how…
This week’s reading list is heavily focused on Kubernetes observability, AI orchestration, and some very handy tools for navigating the modern web. Cloud, Kubernetes & Infrastructure Fatih Koc’s Observability & Infrastructure Series: Kubernetes Security Observability - A guide to establishing effective security observability in your Kubernetes clusters. OpenTelemetry Kubernetes…
This week’s roundup features 40 fresh links covering everything from sandboxing AI agents in Kubernetes to benchmarking LLMs in the game Balatro, along with some spicy open-source drama. Cloud & Kubernetes Kubernetes Gateway API Guide / Archive - A complete step-by-step setup guide for the Kubernetes Gateway API. Agent Sandbox - An official Kubernetes SIGs project for sandboxing AI agents.…
This week is a massive roundup. The AI agent ecosystem is exploding with new tools (and security leaks), while the “privacy & tunneling” toolbox gets a major refill. AI, Agents & Security Moltbook Database Exposure - Wiz reveals a massive breach in “Moltbook” where millions of API keys were exposed. Moltroad - A “Silk Road” for AI agents to list and trade black…
While I try to cover everything from budget Kubernetes to BSD tricks, the star of the show this week is of course ClawdBot/MoltBot/OpenClaw. Photo courtesy of Alejandro Martinez :) Cloud & Kubernetes Kubernetes at $2/month - A guide on running a functional Kubernetes cluster for just $2 a month. EmeritOSS Backs MinIO - Chainguard’s EmeritOSS initiative steps in to support MinIO and other…
Here is the roundup of links for this week: Cloud & Infrastructure Exe.dev - A service to spin up instant, publicly accessible virtual machines with persistent disks. Zarf - An open-source tool for declarative software delivery into air-gapped and constrained environments. K3s + Sysbox - A guide on using the Sysbox container runtime with K3s. Cloud Native RAG - A walkthrough on building a fully…
I missed last week’s post because I was too busy trying to beat my high score in UEFI Zaxxon. To make it up to you, here is a double-sized roundup covering the last two weeks. Cloud & Kubernetes Kubernetes Dashboard Archiving - A discussion in the Kubernetes SIG-UI group regarding the potential archiving of the Kubernetes Dashboard project. Ingress Controllers Spreadsheet - A comprehensive,…
I’ve gathered a fresh batch of links to kick off the new year, ranging from Kubernetes networking and BSD tools to security talks from the 39C3 congress. Cloud, BSD & Infrastructure Kubernetes Egress Control with Squid / Hacker News Discussion: A guide on using Squid proxy to control egress traffic in Kubernetes clusters. BSD Tools Collection: A collection of BSD utilities including mfsBSD &…
Here is the roundup of links for this week: Cloud & Infrastructure Debusine Repositories Launch / Main Page: Debian introduces Debusine, a new PPA-like system allowing developers to publish add-on packages with integrated builds and testing. PCI Passthrough in Harvester - A guide on setting up AMD GPUs in Harvester with PCI passthrough. Password Agents - Documentation from systemd.io regarding the…
Here is the roundup of links for this week: Cloud & Infrastructure Kubernetes v1.35 Release - The official announcement for the latest version of Kubernetes. Docker Hardened Images / Catalog: Docker has made its catalog of hardened container images free to use, designed to secure the software supply chain. Why you can’t ping a Kubernetes Service - A technical explanation of why standard ICMP…
Here is the roundup of links for this week: Cloud & Infrastructure IBM to acquire Confluent - Major industry news as IBM announces its acquisition of the data streaming platform Confluent. Netvisor - An open-source observability agent for Kubernetes that provides visibility into cluster traffic and network calls. Kubeterm - A graphical terminal specifically designed for managing Kubernetes…
Here is the list of links for this week: Cloud & Infrastructure AWS re:Invent 2025 - Keynote with Dr. Werner Vogels - The annual keynote from Amazon’s CTO, covering the latest in cloud technology and the “Renaissance Developer”. MinIO is now maintenance mode - Discussion on Reddit regarding the change in development status for the popular object storage server. FreeBSD…
What Edu is Reading This Week « This space for rent » :D AI, LLMs & Automation Model Context Protocol (MCP) Introduction: Documentation for the Model Context Protocol, an open standard designed to enable AI agents (LLMs) to interact securely and predictably with external tools, APIs, and data. Jules: The Autonomous Agent CLI Extension / Jules in 90 seconds / Jules GitHub Repo: The…
What Edu is Reading This Week Plenty of content this week! Cloud Native & Kubernetes Tuning Linux Swap for Kubernetes: A deep-dive article on why and how to correctly configure and tune Linux swap settings when running Kubernetes workloads. Production-Grade Container Deployment with Podman Quadlets: How to deploy and manage containers using Podman and Quadlets, which leverage native systemd unit…
What Edu is Reading This Week Fifth week in a row! Cloud Native & Kubernetes Ingress-Nginx Controller Retirement (K8s Blog): Official announcement regarding the planned retirement and deprecation of the classic ingress-nginx controller, signaling the industry shift toward the Gateway API. ingress2gateway: A tool from the Kubernetes SIGs to automatically migrate existing Ingress resources to the…
My current workflow to create the weekly reading posts Here is a breakdown of the simple, automated, and edited workflow I currently follow every week: 1. Capturing and Collecting Links I use Raindrop.io as a Google Chrome extension and mobile app to save the links I found interesting into a dedicated collection named “00-current”. This collection is configured to be the default saving…
Another week goes by, another collection of links I found interesting… Infrastructure and Operating Systems FreeBSD Officially Supported in OCI Runtime Specification v1.3 - The Open Container Initiative (OCI) Runtime Specification v1.3 officially includes FreeBSD support. This major milestone positions FreeBSD as a first-class platform for cloud-native workloads, leveraging its existing…
Another week goes by, another collection of links I found interesting… Infrastructure and Platform Engineering formae: Infrastructure-as-Code Platform Built for the Future - A 100% code-based, agentic IaC tool that automatically syncs code with the actual infrastructure state without needing state files or manual merging of external changes. Container (Apple Open Source) - A tool from Apple…
Another week goes by! Software & DevOps Uber Kraken - A P2P-powered Docker registry developed by Uber, designed for highly scalable and available image distribution. Xpra - Persistent remote applications for X11, MacOS, and MS Windows, known as “screen for X,” allowing disconnection and reconnection to graphical applications. pkgit - An unconventional package manager designed to…
What Edu is Reading This Week People often ask me about the cool stuff I stumble upon during the week. So, I figured, why not share the links that caught my eye? So here we are. This is inspired by some newsletters I read such as Vermandeen’s Valuable News or Kube Today. I’m not 100% sure if I’ll be able to keep a weekly cadence; I really don’t have too much free time…
I wanted to simulate a RedFish BMC to be able to power on/off libvirt virtualmachines and attach ISOs as I do for baremetal hosts. Entering sushy-tools sushy-tools include a RedFish BMC emulator as sushy-emulator (see the code in the official repo). Basically it can connect to the libvirt socket to perform the required actions exposing a RedFish API. metal3-io/sushy-tools container image To easily…
I wanted to have specific permissions on the /var/lib/libvirt/images folder to be able to write as my user. To do it, you can just use setfacl as: $ sudo setfacl -m u:edu:rwx /var/lib/libvirt/images The issue is sometimes those permissions were reset to the default ones… but why? and most important… who? auditd To find the culprit I used auditd to monitor changes in that particular…
I wanted to configure a VM to act as a router between two networks, providing DHCP and DNS services as well. │ │ │ │ ┌──────┐ │ │ │ │ │ ┌────────────┐ ├───┤ vm01 │ ├─┤ dhcprouter ├──┤ │ │ │ └────────────┘ │ └──────┘ │ │ │ │ ┌──────┐ │ │ │ │ │ ├───┤ vm02 │ │ │ │ │ │ │ └──────┘ │ │ public network private network public network is the regular libvirt network created by default (192.
I wanted to compile the hypershift binary but it requires golang 1.17 which is not included in Fedora 35, so I ended up doing this: mkdir ./tmp/ && \ podman run -it -v ${PWD}/tmp:/var/tmp/hypershift-bin/:Z --rm docker.io/golang:1.17 sh -c \ 'git clone --depth 1 https://github.com/openshift/hypershift.git /var/tmp/hypershift/ && \ cd /var/tmp/hypershift && \ make hypershift && \ cp bin/hypershift…
To be able to monitor hardware health, status and information on HP servers running RHEL, it is required to install the HP’s Service Pack for Proliant packages. It seems the Management Component Pack is the same(agent software but for community distros, for enterprise, use SPP. There is more info about those HP tools on the HP site Basically you just need to add a yum/dnf repository, install…
When deploying OpenShift IPI on baremetal, there is only so much you can tweak at installation time in terms of networking. Of course you can do changes after the installation, such as applying bonding configurations or vlan settings via machine configs… but what if you need those changes at installation time? In my case, I have an OpenShift environment composed by physical servers where…
In this blog post I’m trying to perform the integration of an external registry with an OpenShift environment. The external registry can be any container registry, but in this case I’ve configured harbor to use certificates (self generated), the ’library’ repository in the harbor registry to be private (aka. require user/pass) and created an ’edu’ user account…
Introduction I’ve been using Nextcloud for a few years as my personal ‘file storage cloud’. There are official container images and docker-compose files to be able to run it easily. For quite a while, I’ve been using the nginx+redis+mariadb+cron docker-compose file as it has all the components to be able to run an ’enterprise ready’ Nextcloud, even if I’m…
Running a rootless Nextcloud pod Instead of running Nextcloud as independant containers, I’ve decided to leverage one of the multiple podman features which is being able to run multiple containers as a pod (like a kubernetes pod!) The main benefit to me of doing so is they they use a single network namespace, meaning all the containers running in the same pod can reach each other using…