Everything recently published or updated on iximiuz Labs — the same stream the RSS and Atom feeds show, but with a browser-friendly look.
Your feed — All new posts
A distroless pod running in the cherry namespace has no shell or debugging tools. Use kubectl debug to attach an ephemeral container, test connectivity to the request-logger service, and verify the request was received in its logs.
OpenAI gave a presentation about "the Hugging Face Incident", and Simon Willison, my favorite AI journalist, reconstructed the incident's timeline from the video. I recommend reading it in full, and here are my thoughts pertaining to the domain I'm working in - Linux, containers, and security.
At last, I ran into a take on user namespaces that resonates with my own view of the problem: Kubernetes Finally Has User Namespace Support. The Shared Kernel Problem Remains (and its spinoff on The New Stack) by Kaylin Trychon of Edera.
Explore the OCI image index, manifests, and configuration of a remote multi-platform image - without pulling a single byte of filesystem layers into the local Docker daemon.
Learn how to build a secure, lightweight, and production-ready Python container image for a FastAPI application by following this hands-on challenge full of practical tips and tricks. Solutions for pip + venv, poetry, and uv are included.
This tutorial will help you configure your rootless podman instance to pull from only from specific registries, using different OCI runtimes as well as configure all containers to have specific attributes all without any daemon restarts or sudo calls.
A developer named siddhi requires read-only access to specific resources in the production namespace. Create a Role and RoleBinding to grant the minimum required permissions without any write access.
A Deployment is failing because application configuration is missing. Mount only specific keys from an existing ConfigMap as files inside the Pod at the correct path so the application can start successfully.
A stubborn process is running on the system, kill it :)
Add the official Argo CD Helm repository, then use helm template to render the Argo CD chart for a dedicated namespace while skipping the chart's bundled CRDs, since they are already installed in the cluster.
Explore Linux/Unix signals in Go, how signals act as asynchronous notifications, who can send them, default kernel behaviors, sending signals with kill and Go, graceful signal handling with os/signal, and why SIGKILL cannot be trapped.
Use kubectl proxy to open a local, already authenticated HTTP endpoint to the Kubernetes API server, then use curl to list every Secret in the gliese-581 namespace and save the raw JSON response to /home/laborant/secret-list.json.
A Deployment running a distroless Chainguard nginx image (cgr.dev/chainguard/nginx) is deployed in the namespace webapps, fronted by a ClusterIP Service. Port-forward that Service to localhost port 3333 on cplane-01, use curl to save the response body to /home/laborant/index.html, and verify the file is accessible and contains the expected content.
A Job manifest at /home/laborant/batch-job.yaml is exiting with a non-zero exit status. The Job has limited retries configured. Inspect the cluster and the manifest to find the bug, fix it, and reapply.
Learn how to reconfigure the Kubernetes cluster DNS domain by updating CoreDNS ConfigMap and kubelet configuration on all nodes, a critical skill for custom cluster networking and CKA exam preparation.
Learn how to configure a Kubernetes CronJob to automatically take etcd snapshot backups every 6 hours — a critical skill for cluster disaster recovery and operational health.
A ready-to-use NixOS server for exploring the full Nix experience without installing it on your own machine.
An app in the web namespace is served over HTTPS by an ingress-nginx Ingress. Create a Gateway and HTTPRoute on a staging hostname, verify traffic, move the production hostname to the Gateway, and remove the Ingress without downtime.
Discover how Go functions under the hood as a modern systems programming language. Learn how Go makes system calls directly, resulting in self-contained binaries that have no libc dependencies.
A helper script that lists every container image running in the cluster — along with its on-disk size and the workload that uses it — has been downloaded to cplane-01. Install it as a kubectl plugin named kubectl-images so that kubectl images works from any directory.
Make a single echo server listen on either a TCP socket or a Unix domain socket, selected by its command-line argument. The challenge illustrates that the same stream-socket workflow works with two address families (AF_INET and AF_UNIX).
Write your first TCP client for a push-only telemetry server that starts sending sensor readings as soon as you connect. Likely the easiest way to get started with TCP socket programming.
Write a TCP client to hold a back-and-forth conversation with a "chat" server: send a line, read the reply, send another line - repeat until the session is over. A hands-on lesson in designing an application protocol on top of a byte-oriented TCP stream.
The Hello World of network programming: implement a tiny TCP echo server in the language of your choice.
Learn how servers actually work by building a tiny TCP server and client from scratch. A hands-on introduction to sockets, TCP, and the network programming model every backend, DevOps, and platform engineer should go through at least once.
Create a Pod that uses a generic ephemeral volume backed by a dynamic StorageClass. Unlike emptyDir, ephemeral volumes are provisioned as PersistentVolumeClaims and support storage requests and access modes.
Refactor a slow, single-threaded C file downloader that fetches files sequentially into a multi-threaded program using POSIX Threads (pthreads) to achieve concurrent downloads.
Explore what a thread actually is in Linux, how threads relate to processes, how the Linux kernel treats both as tasks (task_struct), and how kernel scheduling enables concurrency.
Learn how you can control multiple podman instances on remote machines without SSHing into them manually. Also learn to deploy your Compose application stacks without SCP / SSH with podman remote feature and Docker Compose v2
We ♥️ supply chain security, thus was created SBOM - the Bill of Materials- but, we also need SBOB -the Bill of Behavior - This livelab proposes to standardize how to record a benign behavior profile, extract, sign and publish it, for users to consume, ingest, verify it and detect attacks and tampering. For software-vendors, a SBOB creates trust and transparency, For users, it makes anomaly detection realistically achievable.
A webapp deployment in the prod namespace is stuck in CrashLoopBackOff. The application's startup probe checks that its existing config directory is intact before the container is marked healthy. Fix the deployment so configuration is injected correctly and the pod reaches Running state with its health check endpoint responding on port 8080.
A MariaDB deployment and its PVC were accidentally deleted. The PersistentVolume survived due to its Retain policy. Restore the database by rebinding the existing PV without losing any data.
Configure a Vertical Pod Autoscaler (VPA) with a per-container resource policy that provides recommendations for the main container while excluding the sidecar container from any VPA-managed scaling.
Create a multi-container Pod with different user IDs per container while sharing a common group ID at the Pod level for collaborative file access.
Write a C program that calls fork() to clone a process and execve() to execute a command, then print and retrieve the child process PID.
Explore what a program is, when it actually becomes a process and how the Linux scheduler manages process execution.
A hands-on course on securing Model Context Protocol (MCP) servers and MCP apps with Pomerium, covering OAuth 2.1, upstream OAuth to APIs like GitHub, and per-user, per-tool authorization from dev to production.
Try Shell Gym - an interactive Linux command-line trainer - in a ready-made Ubuntu VM: daemon running, web UI open, sample learning path loaded.
Compile a small C loop with -O2 -S, inspect the generated assembly, report how many add instructions gcc produced and see how much it has optimized the equasion.
Walk through the C compilation pipeline: preprocessor, compiler, assembler, and linker. Start with a normal hello world, inspect macros and generated assembly, and end by producing a running binary that has no main() function.
This tutorial provides an in-depth know-how of working with Pods (group of container) with Podman. It also gives insights into how the podman CLI works well with Kubernetes, albeit in limited capacity to develop better Container Workflows.
Explore what a computer, CPU architecture, and kernel are, learn the history and family of Assembly ISAs, compare CISC vs RISC, and write your first x86_64 assembly "Hello, World!" program.
Produce a valid ELF binary that runs and exits cleanly, but does not define a main() function.
Run gcc -E on a small C program and find the exact line where the preprocessor expanded a macro into a printf call.
Several internal microservices live inside a private VPC and are reachable only from within it. Use SSH dynamic local port forwarding to turn your dev machine into a single SOCKS proxy that reaches all of them through one bastion host.
SSH port forwarding explained in a clean and visual way. How to use local and remote port forwarding. What sshd settings may need to be adjusted. How to memorize the right flags.
In this tutorial, we will learn how to use the new plugin system in Flux 2.9 to: validate manifests, mirror charts into local registries and deploy using Gitless GitOps principles.
Use Pomerium's native SSH support to publish a local service through a standard reverse SSH tunnel, with OpenID Connect (OIDC) authentication and continuous authorization on every request. Reach services behind Network Address Translation (NAT) without firewall holes or custom agents, and control both who can use the service and who can open the tunnel. Application traffic stays on infrastructure you control.
Pomerium can be used as a native SSH reverse proxy, adding OAuth authentication and flexible Pomerium policy enforcement to standard SSH connections, without the need for tunnels, or custom clients or servers.
A sandbox where you can experiment with different k8s stacks all you want!
Learn how to manage Podman containers using systemd on your host machine.
Learn how to use systemd inside containers and manage their lifecycle with podman.
A service in the mesh namespace returns only a single IP during DNS lookup, preventing the peer-server pods from finding each other. Investigate why DNS does not return one address per pod and change the service configuration so that peer discovery works correctly.
A deployment is running without health probes or graceful shutdown configuration. Add startup, liveness, and readiness probes plus a preStop hook and terminationGracePeriodSeconds to make it ready for real traffic.
Create a PriorityClass for production workloads and patch an existing deployment to use it, ensuring critical services get scheduled first during resource contention.
Update a production NGINX ConfigMap to restrict TLS to v1.3 only, then verify the change enforces the security policy.
Add a new, separate Service CIDR range for the dev team using the ServiceCIDR API object — without touching or restarting the cluster's default Service CIDR — then create a Service with an explicit ClusterIP inside that new range and verify DNS resolution.
Configure a Kubernetes Service so that requests from the same client IP are always routed to the same backend Pod for a sustained period, using ClientIP-based session affinity.
The production "Calendar Todo" web application has been deployed in the prod namespace but all pods are stuck in Pending. Investigate the cluster, identify why the application cannot run, fix the underlying node issue, and verify the app is serving traffic on NodePort 31777.
In this tutorial we will learn how to use the new scan feature in OpenBao 2.6. It enables apps to dynamically discover secrets scoped to their namespace.
Put OpenClaw, a self-hosted AI assistant with shell and file access, behind a web route and an SSH route, both gated by the same identity and Pomerium's context-aware policy. OpenClaw runs in trusted-proxy mode, trusting signed identity headers instead of its own login, while Pomerium's native SSH proxy signs short-lived certificates for shell access.
Most Kubernetes debugging images ship as a single 200+ MB package. DebugBox takes a different approach: three variants (15 MB, 47 MB, 91 MB) each scoped to a specific debugging task. This tutorial covers when to use lite, balanced, and power, how to run each as an ephemeral container or debug pod, and what tools are available in each variant.
A Deployment is using a disk-backed emptyDir volume. Convert it to a memory-backed tmpfs volume for better performance — but make sure to set a size limit to prevent the Pod from exhausting the node's RAM.
A newly provisioned server is reachable as root with a shared seed password. Create a sudoer admin user, switch SSH to key-based access, disable password and root logins, and retire the seed credential.
Combine an existing ConfigMap and Secret into one volume and mount them at a single path inside a Pod — using only one volume definition.
Build a container image from a Dockerfile and use Docker commands to inspect its size and layer composition.
Understand how podman works with configured Linux User Namespaces and how to configure / update these namespaces for current users.
Learn how to quickly deploy your Python Django-based application to a remote Linux server under your control. This hands-on tutorial covers preparing and packaging a Django application from source code on your local machine and then deploying it to an Uncloud-managed machine, along with the networking ingress configuration and without using any external image registry.
Learn how to create and manage a multi-machine Uncloud cluster from scratch. This hands-on tutorial walks you through initializing a cluster, adding machines, managing contexts, and deploying your first containerized service.
An inventory service lives inside a private VPC and keeps its debugging port bound to 127.0.0.1. Use SSH local port forwarding with a jump-only bastion to query the debugging port from your workstation.
Learn how to reach an internal port on a remote machine from the local system, jump through a bastion into a private VPC, expose a development server to the Internet through a reverse tunnel, publish a home network device, and spin up a full-fledged SOCKS proxy with nothing but a regular SSH connection.
Practice real-world disaster recovery — restore a deleted production workload by restoring an etcd snapshot and reconfiguring the etcd static pod to use the recovered data directory.
The application fleet lives inside a private VPC, reachable only through a locked-down bastion that refuses to give you a shell. Find a way to jump through the bastion and place a maintenance lock on two misbehaving servers.
Learn how to take a snapshot backup of etcd and restore it to a specific directory — a critical skill for Kubernetes cluster disaster recovery.
Harden a bastion host so only admins can get a shell on it, operators can open tunnels to arbitrary destinations, and developers can reach only the one internal service they actually need.
Create a Pod in the processing namespace that runs a short task and exits successfully, reaching a Completed status without using a Job controller.
A Deployment is stuck with Pods in ContainerCreating state because the required ConfigMap was not created. Fix the issue to make the application accessible.
A C++ coordination service designed to replace Apache ZooKeeper
Several self-hosted services run on isolated devices in your home network, with no inbound route from the Internet. Use SSH dynamic remote port forwarding to turn a public-facing gateway VM into a single SOCKS proxy that reaches all of them.
A status dashboard runs on an isolated device in your home network, with no inbound route from the Internet. Use SSH remote port forwarding with your workstation as a jump host to publish it on a public-facing gateway VM.
A payment webhook receiver runs as a local build on your dev machine, bound to 127.0.0.1 and invisible from the Internet. Use SSH remote port forwarding to publish it on a public-facing gateway VM so a test payment provider can reach it.
A production search cluster lives inside a private VPC and is reachable only from within it. Use SSH local port forwarding through a public-facing bastion host to query the cluster's API from your dev machine.
A remote VM serves an app on port 80 and keeps an internal debugging port bound to 127.0.0.1. Reach the debugging port from your workstation using an SSH tunnel, without exposing it on the VM's external interface.
Troubleshoot a Deployment where containers are repeatedly OOMKilled. Inspect Vertical Pod Autoscaler (VPA) recommendations and manually apply the recommended memory request and memory limit to stabilize the workload.
A practical deep dive into container image internals that will help you build a clear mental model of how images are composed, identified, stored, and distributed across registries.
Deploy a multi-container Kubernetes Deployment and ensure that no more than one Pod runs on the same worker node, without using a DaemonSet.
Podman Playground with Docker Compose for better Developer Experience. Docker Compose: v5.3.1
Update container images, container names, update strategy, and replica count in an existing multi-container Kubernetes Deployment.
Implement a canary deployment strategy using the Kubernetes Gateway API. Route the majority of traffic to a stable version of a service while gradually shifting a small percentage to a new canary version.
A LimitRange exists in the namespace but Pods are not receiving default resource requests and limits. Investigate the root cause and fix it.
Troubleshoot and update a Kubernetes DaemonSet so that its Pods run on all nodes in the cluster, including the control plane.
A new service needs to run in your development environment, but the port it requires is already in use by another app that has to keep working. Diagnose the conflict, free the port without taking the other app down, and get both services running side by side - a realistic exercise in untangling local port conflicts.
A daemon exposes a Unix domain socket that every local user can talk to. Protect it so that only root and members of a dedicated group may connect - the same way Docker restricts access to /var/run/docker.sock.
Learn how Inspektor Gadget pairs eBPF with WASM to process kernel events—and walk through the same idea yourself by implementing a minimal example.
Practice the most common Linux storage operations in a series of hands-on challenges: discover and mount drives, create partition tables, format partitions with different filesystems, map directories with bind mounts, and make mount points survive a reboot.
A web application is deployed but the website is not accessible. Investigate and fix the issue.
Practice formatting drives in Linux: identify the drive, format it as ext4, mount it, and verify the filesystem works as expected.
