11posts
A sysadmin guide to running OpenTelemetry traces on a small stack: one Collector, OTLP from your applications, sampling that keeps errors and drops the boring traffic, Tempo or Jaeger v2 as the backend, and the limits that bite when the whole pipeline runs on one box.
Docker and Incus both run containers on the same Linux primitives, but they wrap the kernel mechanism in different abstractions: Docker packages an application, Incus launches a whole operating system. A theoretical comparison of application containers and system containers, the lifecycles each one assumes, and when each unit of management is the right one, with links to our Proxmox vs IncusOS coverage.
Docker secrets are a delivery mechanism, not a vault. On a single server they do not encrypt anything. A hands-on comparison of .env, Docker secrets, systemd credentials, SOPS + age, Vault, and Kubernetes Secrets, with the commands and the honest decision rule for each.
A sysadmin's hands-on walkthrough of a scratch-based, rootless Docker image for the SimpleX Chat CLI. Since the chat server binds 127.0.0.1 only (issue #6449 is still open), a small socat bridge exposes it on 0.0.0.0. Full multi-stage Dockerfile, build and run commands, and the honest trade-offs.
A hands-on, sysadmin-grade guide to Vercel Eve: how the filesystem-first agent framework works, from scaffolding and tools to durable sessions, sandbox backends, and deployment, plus a deep comparison of Eve, Mastra 1.55, and Flue 2.0.
After 90 days running self-hosted Immich instead of Google One for our family photos: what worked, what it actually costs, why your data finally stays on hardware you own, and the honest gaps that are still missing for families, straight from the project's own roadmap and issue tracker.
A sysadmin-grade guide to Docker Sandboxes for AI agents: microVM isolation layers, credential injection that keeps API keys out of the sandbox, sbx secret management, the MCP gateway, and what is not isolated by default.
A sysadmin-grade comparison of Docker Compose and Kubernetes for running many self-hosted apps: where Compose starts to hurt, how k3s changes the calculus, and how rootful Kubernetes is actually secured with RBAC, admission control, securityContext, seccomp, and network policies, and how that differs from rootful Docker.
A practical, sysadmin-grade comparison of Docker and Podman for running many self-hosted apps: Compose vs Quadlet, rootful vs rootless security and host-tool debugging, Watchtower vs podman auto-update, Docker API compatibility, and when Kubernetes is the real answer.
Learn how to containerize a SvelteKit app with Prisma and Bun using a multi-stage Dockerfile. Discover workarounds for Prisma compatibility, the benefits of distroless images, and the importance of running non-root containers for enhanced security.
Learn how to containerize and run a legacy Mono application using Docker. This step-by-step guide covers creating a Dockerfile, setting up Docker Compose, and leveraging health checks and auto-healing for seamless deployment.