Talos Linux Vendor Lock-In: Five Questions, Run on My Own Nodes
Talos Linux is MPL-2.0 and Sidero can't relicense it alone. The vendor risk sits in the defaults, the BSL code around the core, and a team Yardi bought on 14 September.
Archive
2026
2026
45Supply Chain Security in GitLab CI: SBOM, cosign, and the Policy That Blocks
Generate an SBOM in GitLab CI, sign the image digest with cosign, attach the SBOM as an attestation, and make Kyverno refuse anything unsigned. Plus an honest read of which SLSA level 3 requirements a GitLab runner meets.
Your Dependency's Business Model Is Part of Your Threat Model
Portainer froze its free edition this month. HashiCorp did it to Vault in 2023, MinIO did it in four steps without touching the licence. Thirty-six dated cases, what each one cost, and five questions to score your own stack.
NIS2 for Platform Teams: Which Control Satisfies Which Article
The Dutch Cyberbeveiligingswet has applied since 15 August 2026. Here is article 21 mapped onto Kubernetes controls, with the Kyverno policy and the alerting rules.
Linux Is for Everyone: Why This Blog Now Welcomes Beginners Too
This blog is expanding beyond platform engineering to help Linux beginners. A level taxonomy and a trimmed tag cloud help you find content at your level, from first install to production clusters.
Data Poisoning: Reclaiming Your Privacy Through Offence
When opting out of data collection isn't enough, data poisoning turns surveillance against itself. A practical guide to offensive privacy techniques.
KVM/QEMU Scripts and Aliases: Making Virtualization Actually Usable
Practical shell scripts and aliases for daily KVM/QEMU/libvirt usage. Quick VM creation, snapshots, and management without remembering arcane commands.
Infrastructure as Code for People Who Need to Understand
Why Infrastructure as Code appeals to people who need to understand systems. Making the implicit explicit, and why that matters for control and sovereignty.
Backup Strategy for Your Homelab: The 3-2-1 Rule in Practice
Implement a solid backup strategy for your homelab using the 3-2-1 rule. Practical guide with Restic, Velero, and offsite backup options.
Terminal Multiplexing: tmux vs Zellij vs Screen
Compare terminal multiplexers tmux, Zellij, and GNU Screen. Find the right tool for your workflow with practical examples and configuration tips.
Tailscale for Homelab: Secure Remote Access Without Port Forwarding
Access your homelab from anywhere with Tailscale. No port forwarding, no exposed services, just secure WireGuard mesh networking. Setup guide with Kubernetes integration.
Building an Internal Developer Platform: Where to Start
Build an Internal Developer Platform that developers actually use. Start small, solve real problems, and grow organically. Practical guide with examples.
Grafana Dashboards That Actually Get Used
Build Grafana dashboards people actually look at. Avoid dashboard rot with practical design principles, useful panels, and real-world examples.
Chaos Engineering: Breaking Your Cluster to Make It Stronger
Learn chaos engineering for Kubernetes. Intentionally break things to discover weaknesses before they become outages. Practical guide with Litmus Chaos.
K3s Cluster Setup on Refurbished Mini-PCs
Build a production-ready K3s Kubernetes cluster on refurbished mini-PCs. Complete guide from hardware selection to HA setup with embedded etcd.
Longhorn vs Rook-Ceph: Kubernetes Storage Compared
Compare Longhorn and Rook-Ceph for Kubernetes persistent storage. Learn when to use each, their trade-offs, and real-world performance considerations.
Quantum-safe GPG identity with multiple aliases
Your GPG identity is one of the few things AI cannot fake. One offline master, three aliases, post-quantum encryption, layered backups.
Alerting That Works: From Alert Fatigue to Actionable Notifications
Build an alerting strategy that actually works. Reduce alert fatigue, create actionable notifications, and stop waking up for non-issues.
cert-manager: Automatic TLS Certificates in Kubernetes
Automate TLS certificate management in Kubernetes with cert-manager. From Let's Encrypt to private CAs, never manually renew a certificate again.
Cilium: eBPF Networking for Kubernetes
Master Cilium CNI for Kubernetes: eBPF networking, network policies, service mesh, and observability. A practical guide to modern container networking.
Distributed Tracing with Tempo and OpenTelemetry
Implement distributed tracing in Kubernetes with Grafana Tempo and OpenTelemetry. Follow requests across services and debug latency issues.
Loki for Kubernetes Logging: The Prometheus-Like Approach
Deploy Grafana Loki for Kubernetes log aggregation. Learn the label-based approach, LogQL queries, and why Loki is cheaper than Elasticsearch.
Thanos Remote Write: Push-Based Metrics for Edge and Multi-Cluster
Scale Prometheus with Thanos Receive using push-based remote write. Ideal for edge clusters, intermittent connectivity, and large multi-cluster environments.
Declarative Infrastructure as Compliance Documentation: Talos, NixOS, and Audit-Ready Systems
How declarative systems like Talos and NixOS make ISO 27001, NIS2, and SOC 2 compliance easier by generating audit evidence automatically.
NixOS as a Hypervisor: KVM and QEMU Can Do Everything
How to use NixOS as a full-featured hypervisor with KVM and QEMU. Live migration, memory ballooning, GPU passthrough - no VMware required.
NixOS vs Talos for Kubernetes Nodes: Two Flavors of Immutable Infrastructure
Comparing NixOS and Talos Linux as operating systems for Kubernetes nodes. Both are declarative and immutable, but with very different trade-offs.
Talos Linux: The Immutable Kubernetes OS That Changed How I Think About Nodes
Why Talos Linux is the perfect OS for Kubernetes: immutable, API-driven, and secure by default. Real experiences from running it in production.
The Lost Art of Software Optimization: What Demoscene Taught Us About Sustainability
Why we stopped caring about efficient code, what the demoscene knew about optimization, and how software bloat became an environmental problem.
Arch vs NixOS as a Workstation: Professional and Personal Use
Comparing Arch Linux and NixOS as workstation operating systems for professional DevOps work and personal use. Real experiences, not theory.
CTF and Forensics Skills That Make You a Better DevOps Engineer
How Hack The Box, CTF challenges, and forensics skills translate directly to daily DevOps, platform engineering, and Linux admin work, with practical command examples.
Simulation, Emulation, Virtualization, and Containers: The Restaurant Metaphor
Understanding the difference between simulation, emulation, virtualization, and containers through a restaurant metaphor. No jargon, just clarity.
Zero Trust Explained: The Hotel Key Card Metaphor
Understanding zero trust security through a simple hotel metaphor. No jargon, just clarity. Perfect for explaining to non-technical colleagues.
Learn the Defaults: Why Portability Beats Customization
Why learning default vim, tmux, and CLI tool configurations makes you more effective than endless customization. Portability matters.
Dotfile Management with mise and chezmoi: The Perfect Combo
How to manage dotfiles across multiple machines with chezmoi, combined with mise for tool version management. A practical guide for developers.
Data-Driven Kubernetes Migration: Why You Need Metrics Before You Move
Migrating to Kubernetes without proper resource metrics is a recipe for disaster. A real Black Friday horror story and how to do data-driven pod sizing.
K8sGPT with a Local 70B Model on Apple Silicon
Hands-on test of K8sGPT with Llama 3.3 70B on a Mac Studio M3 Ultra. Does autonomous cluster management work with local LLMs? Including security analysis.
Why Privacy Matters More Than Ever
Mass data collection meets AI that can actually use it, in a world with more autocracies than democracies. Privacy isn't paranoia - it's survival.
The Hardware Ownership Paradox: When Sovereignty Gets Expensive
Self-hosting requires hardware, but businesses have massive financial advantages over individuals. How do we solve this ownership paradox while maintaining digital sovereignty?
Self-Hosting for Everyone: A Vision for Digital Agency
What if everyone could own their data and services without technical expertise? My vision for accessible self-hosting through managed service clusters.
The space container thought experiment: systems thinking for survival
A thought experiment about surviving in a closed system. What does space exploration teach us about systems thinking, circular processes, and sustainability?
When not to use Kubernetes
Kubernetes isn't always the right choice. Learn when you're better off with alternatives like Docker Compose, Nomad, or plain VMs.
YubiKey + Pass + GPG + SSH: One Key to Rule Them All
How to use YubiKey with pass (password-store), GPG and SSH for seamless authentication. Setup guide and workflow for maximum convenience with hardware security.
Pass: the Unix password manager that just works
Pass is a minimalist command-line password manager. Learn how to get started quickly and discover advanced features like git sync and browser integration.
GPG explained: from first key to daily use
Learn how to use GPG for encryption and signing. From your first keypair to advanced features like subkeys and smartcards.
Taskwarrior, Timewarrior and Vit: The Ultimate CLI Productivity Stack
Complete tutorial for taskwarrior, timewarrior and vit. From basics to advanced: projects, dependencies, time tracking, taskd sync server, and vim-style task management.
2025
2025
23Why I self-host everything: on sovereignty, agency and control
Why I choose self-hosted infrastructure over managed cloud. On digital sovereignty, privacy, agency and the freedom to understand your own systems.
Working with an AuDHD brain: why I automate everything
How autism and ADHD-PI shape my way of working - and why the strategies I use out of necessity deliver productivity gains for everyone.
Unbreakable - My Fascination.
Why I'm obsessed with systems that keep working, even when they're broken.
Prometheus and Thanos: Metrics at Scale
Scale Prometheus with Thanos for long-term storage, global queries, and high availability. Practical guide for production deployments.
Kubernetes RBAC: Least Privilege in Practice
Implement least privilege access control in Kubernetes with RBAC. Limit blast radius through proper role design and binding strategies.
Runtime Security with Falco: Detect Suspicious Behavior in Your Cluster
Implement Kubernetes runtime security with Falco. Detect suspicious syscalls, container escapes, and anomalous behavior in real-time.
SPIFFE and SPIRE: Zero Trust Service Identity
Implement zero trust workload identity with SPIFFE and SPIRE. Cryptographic identity for services without static secrets.
Kyverno Policies: Governance as Code for Kubernetes
Implement Kubernetes governance with Kyverno policies. Enforce best practices, security standards, and compliance automatically.
Vault for Beginners: Secrets Management in Kubernetes
Learn how to set up HashiCorp Vault for Kubernetes secrets management. Self-hosted secrets without cloud dependency.
Progressive Delivery with Argo Rollouts: Canary and Blue-Green Deployments
Implement canary and blue-green deployments in Kubernetes with Argo Rollouts. Reduce deployment risk with progressive delivery.
Container Image Scanning with Trivy in Your CI Pipeline
Learn how to integrate Trivy container scanning into GitLab CI. Find vulnerabilities before they reach production.
Automating Semantic Versioning with GitLab CI
Automate semantic versioning in GitLab CI using conventional commits. Generate changelogs and release tags automatically.
GitLab CI for Kubernetes: From Commit to Deployment
Complete guide to GitLab CI/CD for Kubernetes deployments. Build containers, scan for vulnerabilities, and deploy to clusters with GitOps.
Drift Detection with ArgoCD: How to Know If Your Cluster Is Still in Sync
How to detect and prevent configuration drift in Kubernetes with ArgoCD. Monitor unauthorized changes and keep your cluster in sync with Git.
App-of-Apps Pattern in ArgoCD: Scalable GitOps Architecture
Learn the App-of-Apps pattern in ArgoCD to manage hundreds of applications with a single root application. Scalable GitOps architecture explained.
GitOps Disaster Recovery: Rebuilding Your Cluster from Git
How to recover a Kubernetes cluster from complete failure using GitOps. Turn Git into your ultimate backup and disaster recovery strategy.
ArgoCD vs Flux: When to Choose What
ArgoCD vs Flux comparison for GitOps. Learn the key differences, strengths, and when to choose each tool for your Kubernetes GitOps workflow.
ArgoCD for Beginners: Your First GitOps Deployment
Get started with ArgoCD and GitOps. Learn how to deploy your first application using Git as the source of truth for Kubernetes.
Running Kubernetes Offline: Edge Computing Without Internet
How to run Kubernetes clusters in air-gapped and offline environments. Island mode architecture for edge computing, ships, and sovereign infrastructure.
Graceful Degradation in Kubernetes: What Happens When Components Fail
What happens when Kubernetes components fail? Understand how kube-apiserver, etcd, scheduler, and kubelet failures affect your cluster.
Kubernetes Network Policies: A Visual Guide to Pod Security
Learn Kubernetes Network Policies through visual examples. Understand ingress, egress, selectors, and how to isolate your pods effectively.
How etcd Actually Works: The Heart of Your Kubernetes Cluster
Understanding etcd internals: Raft consensus, leader election, data model, and why it's critical to Kubernetes reliability.
Kubernetes High Availability: Stacked vs External etcd Explained
Understanding Kubernetes HA architectures: stacked etcd vs external etcd. When to use which, and how to build clusters that survive node failures.