Loading…
Topic
15 posts about Linux. Every summary links to the original.
See the idea
BPF is not one hook but a set of attachment points, and each one sees different traffic. This diagram maps XDP, TC, socket-level BPF LSM, and sched_ext so you can pick the layer that can actually enforce your rule.
Alpine Linux shrinks container images by replacing glibc with musl and using a minimal base, but introduces compatibility trade-offs you must evaluate before switching.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Network bandwidth is a compressible resource, so setting a flat cap wastes capacity when the link is idle. The real goal is to prioritise production traffic while guaranteeing background workloads a minimum floor, allowing either class to burst to full capacity when the other is idle. The upcoming NetworkQoS CRD in OVN-Kubernetes will bring declarative traffic management, but until then administrators can use Linux traffic control (tc). A hierarchical token bucket (HTB) qdisc tree on the node’s physical interface, with filters matching background traffic by destination IP, provides the desired dynamic prioritisation. In a lab test with 25 Gbps bonded NICs, production traffic maintained 19.5 Gbps under contention while background traffic was throttled to 2.7 Gbps, just above its guaranteed floor.
A platform engineer traces why a non-root OpenShift container configured with CAP_NET_RAW still fails ping with Operation not permitted. The root cause is that SCC is only an admission-time gate that does not enforce runtime privileges. CRI-O translates the PodSpec into an OCI spec with the capability in the Bounding, Effective, and Permitted sets but deliberately omits ambient capabilities. During the runtime’s UID transition from root to the target non-root user, the kernel clears both Permitted and Effective sets, leaving an empty CapEff. The only mechanism that survives a UID transition for non-root processes is ambient capabilities, which CRI-O intentionally avoids to preserve the Kubernetes assumption that switching to a non-root user drops capabilities. To resolve this, file capabilities can be applied directly to the binary via setcap, avoiding the need for ambient capabilities.
Confidential VM technologies such as AMD SEV-SNP and Intel TDX protect runtime data but leave persistent storage protection to the guest OS. This article demonstrates a method using Fedora Rawhide that combines dm-verity integrity for the immutable base image with a dm-crypt encrypted overlay for mutable parts. The base /usr partition remains verity-protected, while on first boot systemd-repart creates an encrypted root partition with a key sealed to the virtual TPM, ensuring each VM gets a unique key. An overlay filesystem mounts the immutable base under the writable overlay, avoiding a full copy of the base image and reducing boot time significantly in cloud environments. The article also outlines current limitations, including the lack of proof of origin for the overlay partition and the absence of integrity or replay attack protection.
BoxCompute VM Sandboxes are now the default runtime for every account, giving agents a full Linux virtual machine rather than a shared-kernel gVisor container. Each disposable VM boots its own kernel and provides root access, outbound internet with public IPv4 and DNS, and a unified approximately 10 GiB filesystem covering / and /workspace, while preserving the existing create, execute, file-transfer, and delete API. The CLI or HTTP API can create a VM, and users can opt out with vmSandbox: false or disable networking with blockNetwork: true. VMs remain billable until explicitly deleted and currently use a fixed profile of 0.5 CPU, 1 GiB memory, and a minimal Ubuntu image. The beta does not include inbound ports, SSH, custom images, or volumes.
KubeVirt, VSOCK, and eBPF address different layers, so none replaces the others. KubeVirt adds virtual-machine lifecycle management to Kubernetes, running QEMU in a launcher Pod while KVM uses hardware virtualization features to execute guest code; it does not replace either component. VSOCK provides host–guest communication through a CID-and-port socket address, independently of guest IP networking, but attaching virtio-vsock does not define permitted applications or provide authentication and authorization. For host-enforced control, BPF LSM can use the socket_listen hook to deny unapproved host-side VSOCK listeners before creation, whereas ordinary XDP and TC filters on VM network interfaces do not see VSOCK traffic; this still leaves existing listeners, per-guest permissions, kernel attack surface, policy lifetime, and other virtual devices to address.
BoxCompute chose KubeVirt for its VM sandboxes because workloads need a real Linux machine with a guest kernel, systemd, and machine-level workflows that process-oriented environments do not fully provide. KubeVirt adds VM resource types and controllers to Kubernetes, while launcher Pods run QEMU/KVM and the guest on a worker. The arrangement keeps placement, lifecycle, permissions, storage, and cleanup within the Kubernetes model, avoiding a separate VM management platform, although resource accounting and readiness still require sandbox-specific work. The post stresses that full virtualization does not automatically provide security: the platform still needs deliberate controls for host access, guest traffic, credentials, persistence, and cleanup after failures.
Remote Fedora or Red Hat Enterprise Linux servers with encrypted LUKS roots can stop in the initramfs, waiting for a passphrase at an unattended console. The documented setup installs dracut-sshd from EPEL, adds dracut’s network-manager module, enables rd.neednet=1 and ip=dhcp in GRUB, then rebuilds the initramfs and boot configuration. NetworkManager brings up the initramfs network, while SSH exposes systemd-tty-ask-password-agent; the SSH session closes after unlocking because the root transition destroys the initramfs sshd. The rd.neednet=1 argument creates the neednet flag that gates nm-initrd.service, and the generated connection profile carries into the real root. Initramfs credentials sit unencrypted on /boot, so dedicated host keys, separate known_hosts entries, and physical testing are recommended before relying on remote recovery.
Lakebase Postgres uses disaggregated storage backed by object storage, so compute-side caching must deliver low latency and high throughput while avoiding inefficient memory use. Its original design paired a conservatively sized PostgreSQL shared buffer with a local file cache (LFC), but the roughly 1 GB shared-buffer cap pushed many hits to slower NVMe storage and could create double buffering. For fixed-size computes with CU >= 80, the new configuration disables the LFC and sets shared buffers to 75% of DRAM, using explicit 2 MB HugeTLB pages to control page-table and TLB overhead. Benchmark tests found huge pages reduced tail read latency by up to ~40% and CPU use by up to ~30%, while production examples reported doubled throughput, 5× fewer storage reads, or 5× lower CPU use. Work is underway to dynamically resize shared buffers and huge pages for autoscaling computes.
Auto-approved terminal commands make coding agents more capable but increase the risk of destructive changes and secret leakage, while repeated approval prompts create approval fatigue. Over three months, the team rolled out a uniform sandbox API across macOS, Linux, and Windows, allowing agents to run freely inside controlled environments and request approval mainly for internet access. macOS uses dynamically generated Seatbelt profiles; Linux combines Landlock, seccomp, and overlay filesystems to enforce workspace and ignored-file restrictions; Windows runs the Linux sandbox through WSL2. Changes to tool descriptions and result rendering help agents recognize constraints and escalate instead of retrying failed commands. Production data reports that sandboxed agents stop 40% less often, and the sandbox now handles a third of requests on supported platforms, although native Windows isolation remains under development.
Sprites are Linux virtual machines designed as fast, disposable computers with root access, persistent 100GB durable filesystems, automatic sleeping, and low inactive cost. To make creation feel instantaneous, the platform removes user-facing OCI container images and keeps pools of preloaded standard Fly Machines, so a new Sprite mainly performs startup work rather than pulling and unpacking an image. Its storage stack follows a hacked-up JuiceFS model, splitting immutable data chunks from metadata, keeping metadata durable with Litestream, and using a sparse NVMe volume as a dm-cache-like read-through cache for object storage; checkpoints and restores primarily shuffle metadata. This design supports migration and recovery without depending on local storage, while low-cost sleeping and object-backed disks suit interactive work more than warm, containerized production workloads, and billing applies only to storage blocks actually written.
Fly.io needed to restore the ability to drain physical workers after attached NVMe volumes made stateful Fly Machines tied to particular servers. Snapshot restoration could lose data, while killing a machine before copying its volume caused unacceptable downtime; copying first risked losing writes. The solution was an asynchronous clone operation built around Linux device mapper’s dm-clone: a new volume is created immediately, reads of unhydrated blocks are fetched from the original over iSCSI, writes go to the destination, and background copying rehydrates the rest. The work also required orchestration across flyd and a fix for Fly Postgres configurations containing literal 6PN IPv6 addresses. After cautious early migrations, the infrastructure team could drain hosts without much ceremony by summer 2024, though routine automated rebalancing remained a future goal.
A customer support ticket exposed poor performance in clock_gettime(3) and gettimeofday(2) for an application making many timing calls through transaction tracing. Heroku's Runtime Infrastructure team found that Linux was selecting the Xen clocksource, whose Xen version did not support virtual dynamic shared object (vDSO) acceleration, forcing costly userspace-to-kernel context switches. The team evaluated available clocksources and selected tsc, which uses the Time Stamp Counter and supports vDSO; they assessed concerns about backwards clock drift, including older CPU inconsistencies and Xen VM freezing, against their newer Intel CPUs and EC2 environment. After vdsotest validation, the configuration was deployed across the Common Runtime and Private Spaces dyno fleet, and the initiating customer plus other customers observed performance improvements.
Seccomp filters let a Linux process restrict its available system calls, reducing the process attack surface beyond the Dyno’s existing restrictions. This tutorial builds a Go binary that creates /tmp/moo, uses strace -c to identify its runtime syscalls, and configures a whitelist with libseccomp-golang. The filter starts with libseccomp.ActErrno returning EPERM for unlisted calls, then adds ActAllow rules for named calls before loading the filter at runtime; the example also checks kernel support and installs libseccomp-dev. With the listed calls enabled, the program creates the folder successfully, while a later syscall.Exec attempt to run ls -l cannot perform unlisted ioctl, getdents, and statfs operations and reports “Operation not permitted.” The post then describes deploying the dependency with Govendor or Godeps on Heroku.
An August 11, 2016 incident caused increased routing latency in Heroku’s EU Common Runtime, even though CPU, packet, memory, request, and socket metrics remained normal. The routing layer received EADDRINUSE while connecting to dynos, leading engineers to investigate Linux TCP port allocation, TIME_WAIT, and the Erlang VM’s system calls with strace. They found that the VM called bind() with 0.0.0.0:0 before connect(), forcing Linux to allocate an ephemeral source port without knowing the destination; this made the ephemeral port range an effective per-instance traffic limit and could fail before 65,536 connections. Testing reproduced the failures and showed that setting SO_REUSEADDR before bind(), exposed in Erlang as {reuseaddr, true}, removed the bind errors; the corresponding Vegur patch was deployed a few days later.
An aborted Cedar-14 stack-image upgrade led container tools to truncate and overwrite a disk image while it was mounted as the read-only / filesystem for running dynos. Because direct writes bypassed filesystem caching and consistency mechanisms, reads alternated between cached pages from the old image and missing data from the truncated file, partially corrupting newly loaded programs. Applications consequently experienced elevated segmentation faults and other hard crashes for about five hours; a virtual-machine reproduction using an ext4 loop-mounted image and sleep reliably produced the same failure. Engineers migrated affected dynos to fresh hosts, then changed host-side permissions so installed filesystem images are read-only, and retested the conditions that triggered the incident.
The best engineering reads, once a week.
