Linux
Recovery Paths
4 min Arranging a way back before taking the next step, from shell cleanup to snapshots and atomic publication.
nftables listed the wrong byte order
1 min Missing nftables set and map metadata made correct kernel values print in the wrong byte order.
A hosts file for one service
1 min A systemd bind mount gave each Snap lobby its own hosts file while leaving the host machine’s resolver file in place.
A pidfile that is really a cgroup
3 min Encoding cgroup2 CPU limits into a --pidfile flag, so moving a PID between two cgroups becomes the whole throttle.
Rewriting a packet in place, from inside the game
4 min An LD_PRELOAD send() shim that swaps an advertised address for an equal-length one, so the surrounding framing lengths never move.
Autoscaling with no coordinator
3 min Symlinked peer status, systemd path activation, and one-neighbor watcher logic form a ring that starts, drains, and stops lobbies without a central controller.
Pushing terminfo over ssh’s stdin
2 min Fixing ‘unknown terminal type’ by streaming terminfo through ssh’s stdin and compiling it remotely, with no separate copy step.
Reading a kernel version out of a bzImage
2 min hexdump plus strings pulls the version string from a kernel image via the x86 boot protocol’s version pointer at offset 0x20E.
Couch Multiseat
4 min Five weeks to build a from-scratch X11 window manager that gave each gamepad an independent pointer so several Minecraft clients could share one TV.
A file with size zero
1 min uWSGI read a procfs setting as empty because its file reader trusted stat size instead of reading to EOF.
Relocatable Python with $ORIGIN
3 min A runtime library path relative to the executable lets a built interpreter move as a tree—verified in the ELF policy and the loader’s result.
Converting a daemon by deleting machinery
2 min The systemd conversion checklist from a mailing-list reply: forking, pidfiles, private logs, and stop scripts all come out.
$JAVA_OPTS is an argv problem
2 min One variable string becomes one argument or several depending on who tokenizes it—verify the argv, not the config text.
After the image is built
2 min A PandaBoard needed one more image-wrapping step after mkinitcpio, and the available extension points ran at the wrong stage.
A missing zero in fwknop
1 min An idle fwknop daemon kept waking because a microsecond constant disagreed with the fraction written beside it.
Never Boot the Real Root
5 min The __active/__snapshot/__rollback scheme: snapshot-and-rollback boot for Arch, with a conversion wizard living inside the initramfs.
/proc/self/tags
4 min Proposing process-relative cgroup tags after an earlier namespace question exposed an isolation guarantee that never existed.
Process substitution as a pipe endpoint
2 min A successful read-write open retains a process substitution’s pipe for independently launched producers and consumers.
Propagation is a direction
3 min Mount propagation is two separate trust decisions, not one switch—the argument from an lxc-users thread about read-only roots.
Read mountinfo first
3 min Before explaining a mount, read /proc/self/mountinfo—the kernel’s live table shows what mount(8) output hides.
The missing python2 shebang
1 min Pygments recognized python and python2.7 but missed python2, just as Arch made the major-version name useful.
The 2011 KVM diagnostic
2 min Checking QEMU’s arguments and open KVM descriptors to distinguish configured acceleration from the running process.
The prompt that asks the kernel
2 min A bashrc derived container identity from /proc/self/cgroup and prefixed the prompt with VPS[name]—no environment variable involved.
Containers in 2010
6 min vps-lxc: templates as btrfs subvolumes, containers as writable snapshots, and the host-local image model I built around them.
runlevel(8) reads whatever utmp you point it at
2 min A container supervisor read a guest’s shutdown intent from the guest’s own utmp, because runlevel accepts an alternate path.