Sovereignty on Tom Meurs

Talos Linux Vendor Lock-In: Five Questions, Run on My Own Nodes

Tue, 06 Oct 2026 09:00:00 +0200

TL;DR I ran the five questions from my licence post on the OS under my own cluster. The licence holds. The Talos Linux vendor lock-in sits in two defaults that point at Sidero’s servers, the BSL code Sidero keeps adding around the MPL core, and a company Yardi has owned since 14 September.

Your Dependency's Business Model Is Part of Your Threat Model

Wed, 23 Sep 2026 19:00:00 +0200

TL;DR A vendor freezing its free edition belongs in your risk register next to the expiring certificate. Thirty-six dated cases below, three kinds of event, and five questions to score your own stack. My own register had the Vault row missing for three years.

On 11 September, Portainer’s CEO published “Portainer 3.0 is coming, and here’s what it means for you”. I read it the Monday after and shrugged.

Here’s what it says. 3.0 is a Kubernetes-first codebase for enterprise customers, and “we are not cutting a separate CE build of it”. Community Edition stays on 2.x. 2.45 LTS “is the last release in the 2.x line”. A few days later they added a clarification: 2.45 keeps getting security fixes, bug fixes and back-ports of any 3.x feature that has a Docker API equivalent, “for as long as that LTS is supported”. The lifecycle page puts that at May 2027. Want 3.x for free? There’s a Business Edition key called 3 Nodes Free, one per organisation.

Linux Is for Everyone: Why This Blog Now Welcomes Beginners Too

Thu, 11 Jun 2026 20:28:00 +0100

My neighbour is 70 years old. He’s used Windows his whole life. Last month he asked me: “Tom, I keep hearing about Linux. Is that something for me too?”

He’s not the first. Over the past year I’ve had the same question from friends, family and colleagues, each in their own shape. “I want to get off Windows, but where do I start?” “Is Linux hard?” “Can I still use my normal programs?” To me these are easy questions. I’ve been running Linux since SuSE 6.0, back when you picked your hardware by whether a Linux driver existed for it. If you’ve never seen a terminal, they’re not easy at all.

Data Poisoning: Reclaiming Your Privacy Through Offence

Sun, 07 Jun 2026 21:43:00 +0100

Here’s how privacy works today. You read the policy. You dismiss the cookie banner. You hunt through three settings menus for the opt-out toggle that someone buried on purpose. All of that to exercise a right that should’ve been the default. And while you’re still on the first paragraph of the terms of service, every click, scroll, hover and the exact timing of your keystrokes has already been harvested, packaged and sold. Somewhere along the way I stopped finding that strange, and that bothers me more than the harvesting does.

Quantum-safe GPG identity with multiple aliases

Sat, 18 Apr 2026 10:47:00 +0200

TL;DR One GPG masterkey that only certifies, kept offline. Three aliases bound to it, so anyone can check they’re the same person. Ed25519 subkeys for signing and SSH, an ML-KEM plus X448 subkey for encryption so recorded ciphertext stays closed after a quantum computer shows up, and three backups that each assume the other two are gone. Needs GnuPG 2.5.

A cryptographic signature still means exactly what it says. If the key is yours and the signature verifies, the content came from you. No vendor handed you that identity, no CA can pull it, no platform can suspend it. It exists because you generated the key, and it’s yours for as long as you hold the private half. Most of what gets called “online identity” is borrowed. A handle someone can ban, an email address the domain owner can take back the day they feel like it. A GPG signature sits outside all of that.

K8sGPT with a Local 70B Model on Apple Silicon

Thu, 05 Feb 2026 14:00:00 +0100

TL;DR I pointed K8sGPT at a Llama 3.3 70B model running on a Mac Studio in my own office, so no cluster metadata leaves the network, and fed it three broken workloads. It found all three and wrote fixes I’d accept from a colleague, except for the resource numbers, which it made up. Assisted diagnosis works, at 25 seconds a query. Autonomous cluster management is still marketing, and the security section is why I wouldn’t let a model change anything on its own.

Why Privacy Matters More Than Ever

Mon, 02 Feb 2026 14:00:00 +0100

Your phone logged where you slept before you woke up. You check Gmail, search something on Google, message a friend on WhatsApp, pay for coffee with a card and walk past a dozen cameras before lunch. None of that feels like surveillance. It feels like a normal morning.

It felt the same five years ago, and I want to show you what changed in between. The comfortable version of privacy, “I have nothing to hide”, has quietly stopped being true, and I think most people haven’t noticed. Three things happened at once. On its own each one is manageable. Together they’re what worries me.

The Hardware Ownership Paradox: When Sovereignty Gets Expensive

Fri, 30 Jan 2026 14:00:00 +0100

In my previous post about self-hosting for everyone I drew a hopeful picture of managed self-hosting, where anyone can own their data. I skipped over something, and it’s been bugging me since. Hardware costs money, and the sum comes out very differently depending on whether a business or a person is paying.

So here are two rules. Both sound reasonable on their own. Then I’ll put them in the same room.

Self-Hosting for Everyone: A Vision for Digital Agency

Tue, 27 Jan 2026 14:00:00 +0100

Most people keep their photos at Google, their mail at Gmail, their documents in whatever cloud came with the phone and their passwords in a browser built by an advertising company. Every byte sits on a server they don’t own, under terms they didn’t read, in a country they didn’t check. Nobody finds that strange anymore, because the alternative looks like a second job.

I want to talk about that alternative, and about why it sits behind a wall most people will never climb.

Vault for Beginners: Secrets Management in Kubernetes

Wed, 02 Jul 2025 10:00:00 +0200

The first time I ran kubectl get secret myapp -o yaml and base64-decoded the value, I felt my stomach drop. There was my database password, sitting in etcd, readable by anyone who could reach the API with the right RBAC. Kubernetes Secrets are not secrets. They’re base64-encoded plain text with a fancy name. That’s the default, and it’s the thing nobody warns you about on day one.

Every cloud provider has a fix for sale. AWS has Secrets Manager, Google has Secret Manager, Azure has Key Vault. They work. The catch shows up later: the day you need to migrate, the day you want to know exactly what happens to a secret after you write it, the day you realise your most sensitive data lives in a system you can’t inspect.

Running Kubernetes Offline: Edge Computing Without Internet

Tue, 04 Mar 2025 20:47:00 +0100

What happens when your Kubernetes cluster can’t reach the internet? I don’t mean a slow connection. I mean no connection at all. Ships at sea. Remote mining sites. Factory floors with air-gapped networks. Military deployments.

For a lot of people that sounds exotic, like a problem someone else has. I treat it as a baseline design requirement, and I’ll explain why it makes my homelab better even though I almost never actually pull the cable.