Everything recently published or updated on iximiuz Labs — the same stream the RSS and Atom feeds show, but with a browser-friendly look.
Your feed — All new posts
A Deployment is running in the platform namespace with 3 replicas. Each pod has configuration files at /app/config/. Copy those files to /home/laborant/config/ on the local machine.
A Snake game Deployment and ClusterIP Service are already running in the snake namespace. Create a Traefik Ingress that serves the game over HTTPS using an existing cert-manager-issued TLS Secret.
Turn the manual storage provisioning workflow into an automation script: partition, format, mount, and persist a blank drive with a single non-interactive script.
A disposable Rust development environment with stable, beta, and nightly toolchains, cargo-watch, rustfmt, and clippy pre-installed.
This tutorial will help you configure your rootless podman instance to pull from only from specific registries, using different OCI runtimes as well as configure all containers to have specific attributes all without any daemon restarts or sudo calls.
A C++ coordination service designed to replace Apache ZooKeeper
OpenAI gave a presentation about "the Hugging Face Incident", and Simon Willison, my favorite AI journalist, reconstructed the incident's timeline from the video. I recommend reading it in full, and here are my thoughts pertaining to the domain I'm working in - Linux, containers, and security.
Follow along with Liz Rice's classic GOTO 2018 presentation and build your own container runtime in under 100 lines of Go using Linux namespaces, chroot, and cgroups.
Understand how the chroot system call changes the root directory for a process, learn how dynamic linkers resolve dependencies inside a jail, and see what an isolated process perceives as its filesystem root.
Export an Alpine container rootfs using crane, set up a chroot environment, and execute a musl-linked binary that fails to run on the host system.
A stubborn process is running on the system, kill it :)
A Deployment running a distroless Chainguard nginx image (cgr.dev/chainguard/nginx) is deployed in the namespace webapps, fronted by a ClusterIP Service. Port-forward that Service to localhost port 3333 on cplane-01, use curl to save the response body to /home/laborant/index.html, and verify the file is accessible and contains the expected content.
Learn how to reconfigure the Kubernetes cluster DNS domain by updating CoreDNS ConfigMap and kubelet configuration on all nodes, a critical skill for custom cluster networking and CKA exam preparation.
Learn how to configure a Kubernetes CronJob to automatically take etcd snapshot backups every 6 hours — a critical skill for cluster disaster recovery and operational health.
A ready-to-use NixOS server for exploring the full Nix experience without installing it on your own machine.
A Job manifest at /home/laborant/batch-job.yaml is exiting with a non-zero exit status. The Job has limited retries configured. Inspect the cluster and the manifest to find the bug, fix it, and reapply.
Add the official Argo CD Helm repository, then use helm template to render the Argo CD chart for a dedicated namespace while skipping the chart's bundled CRDs, since they are already installed in the cluster.
A helper script that lists every container image running in the cluster — along with its on-disk size and the workload that uses it — has been downloaded to cplane-01. Install it as a kubectl plugin named kubectl-images so that kubectl images works from any directory.
Create a Pod that uses a generic ephemeral volume backed by a dynamic StorageClass. Unlike emptyDir, ephemeral volumes are provisioned as PersistentVolumeClaims and support storage requests and access modes.
Discover how Go functions under the hood as a modern systems programming language. Learn how Go makes system calls directly, resulting in self-contained binaries that have no libc dependencies.
Refactor a slow, single-threaded C file downloader that fetches files sequentially into a multi-threaded program using POSIX Threads (pthreads) to achieve concurrent downloads.
Learn how you can control multiple podman instances on remote machines without SSHing into them manually. Also learn to deploy your Compose application stacks without SCP / SSH with podman remote feature and Docker Compose v2
A container image and a bootable root filesystem are not the same artifact. This tutorial builds both from the same Dockerfile so you can see exactly where they diverge: what a plain ubuntu:24.04 is missing, the five requirements an iximiuz Labs playground rootfs has to satisfy, and how to prove an image would boot without being able to boot it. Ends with the same image built the easy way, from the official rootfs base.
A webapp deployment in the prod namespace is stuck in CrashLoopBackOff. The application's startup probe checks that its existing config directory is intact before the container is marked healthy. Fix the deployment so configuration is injected correctly and the pod reaches Running state with its health check endpoint responding on port 8080.
A MariaDB deployment and its PVC were accidentally deleted. The PersistentVolume survived due to its Retain policy. Restore the database by rebinding the existing PV without losing any data.
Configure a Vertical Pod Autoscaler (VPA) with a per-container resource policy that provides recommendations for the main container while excluding the sidecar container from any VPA-managed scaling.
Create a multi-container Pod with different user IDs per container while sharing a common group ID at the Pod level for collaborative file access.
Write a C program that calls fork() to clone a process and execve() to execute a command, then print and retrieve the child process PID.
Try Shell Gym - an interactive Linux command-line trainer - in a ready-made Ubuntu VM: daemon running, web UI open, sample learning path loaded.
Explore Linux/Unix signals in Go, how signals act as asynchronous notifications, who can send them, default kernel behaviors, sending signals with kill and Go, graceful signal handling with os/signal, and why SIGKILL cannot be trapped.
Explore what a thread actually is in Linux, how threads relate to processes, how the Linux kernel treats both as tasks (task_struct), and how kernel scheduling enables concurrency.
Explore what a program is, when it actually becomes a process and how the Linux scheduler manages process execution.
This tutorial provides an in-depth know-how of working with Pods (group of container) with Podman. It also gives insights into how the podman CLI works well with Kubernetes, albeit in limited capacity to develop better Container Workflows.
Explore what a computer, CPU architecture, and kernel are, learn the history and family of Assembly ISAs, compare CISC vs RISC, and write your first x86_64 assembly "Hello, World!" program.
Produce a valid ELF binary that runs and exits cleanly, but does not define a main() function.
Compile a small C loop with -O2 -S, inspect the generated assembly, report how many add instructions gcc produced and see how much it has optimized the equasion.
Run gcc -E on a small C program and find the exact line where the preprocessor expanded a macro into a printf call.
Walk through the C compilation pipeline: preprocessor, compiler, assembler, and linker. Start with a normal hello world, inspect macros and generated assembly, and end by producing a running binary that has no main() function.
Use kubectl proxy to open a local, already authenticated HTTP endpoint to the Kubernetes API server, then use curl to list every Secret in the gliese-581 namespace and save the raw JSON response to /home/laborant/secret-list.json.
In this tutorial, we will learn how to use the new plugin system in Flux 2.9 to: validate manifests, mirror charts into local registries and deploy using Gitless GitOps principles.
A sandbox where you can experiment with different k8s stacks all you want!
Learn how to manage Podman containers using systemd on your host machine.
Learn how to use systemd inside containers and manage their lifecycle with podman.
A service in the mesh namespace returns only a single IP during DNS lookup, preventing the peer-server pods from finding each other. Investigate why DNS does not return one address per pod and change the service configuration so that peer discovery works correctly.
A deployment is running without health probes or graceful shutdown configuration. Add startup, liveness, and readiness probes plus a preStop hook and terminationGracePeriodSeconds to make it ready for real traffic.
Create a PriorityClass for production workloads and patch an existing deployment to use it, ensuring critical services get scheduled first during resource contention.
Update a production NGINX ConfigMap to restrict TLS to v1.3 only, then verify the change enforces the security policy.
Add a new, separate Service CIDR range for the dev team using the ServiceCIDR API object — without touching or restarting the cluster's default Service CIDR — then create a Service with an explicit ClusterIP inside that new range and verify DNS resolution.
Configure a Kubernetes Service so that requests from the same client IP are always routed to the same backend Pod for a sustained period, using ClientIP-based session affinity.
The production "Calendar Todo" web application has been deployed in the prod namespace but all pods are stuck in Pending. Investigate the cluster, identify why the application cannot run, fix the underlying node issue, and verify the app is serving traffic on NodePort 31777.
In this tutorial we will learn how to use the new scan feature in OpenBao 2.6. It enables apps to dynamically discover secrets scoped to their namespace.
Put OpenClaw, a self-hosted AI assistant with shell and file access, behind a web route and an SSH route, both gated by the same identity and Pomerium's context-aware policy. OpenClaw runs in trusted-proxy mode, trusting signed identity headers instead of its own login, while Pomerium's native SSH proxy signs short-lived certificates for shell access.
At last, I ran into a take on user namespaces that resonates with my own view of the problem: Kubernetes Finally Has User Namespace Support. The Shared Kernel Problem Remains (and its spinoff on The New Stack) by Kaylin Trychon of Edera.
Most Kubernetes debugging images ship as a single 200+ MB package. DebugBox takes a different approach: three variants (15 MB, 47 MB, 91 MB) each scoped to a specific debugging task. This tutorial covers when to use lite, balanced, and power, how to run each as an ephemeral container or debug pod, and what tools are available in each variant.
A Deployment is using a disk-backed emptyDir volume. Convert it to a memory-backed tmpfs volume for better performance — but make sure to set a size limit to prevent the Pod from exhausting the node's RAM.
Combine an existing ConfigMap and Secret into one volume and mount them at a single path inside a Pod — using only one volume definition.
Understand how podman works with configured Linux User Namespaces and how to configure / update these namespaces for current users.
A hands-on course on securing Model Context Protocol (MCP) servers and MCP apps with Pomerium, covering OAuth 2.1, upstream OAuth to APIs like GitHub, and per-user, per-tool authorization from dev to production.
