Everything recently published or updated on iximiuz Labs — the same stream the RSS and Atom feeds show, but with a browser-friendly look.
Your feed — All new posts
Practice manually resolving public domains, internal hostnames, and locally defined names to the corresponding IP addresses so you feel confident next time a DNS issue occurs.
Production-grade WordPress 7.1 on Ubuntu 24.04 - systemd-booted, Nginx FastCGI, PHP 8.3-FPM, MariaDB 10.11, Redis 7 Object Cache, WP-CLI, and Cloudflare-ready with zero manual setup.
Fast, repeatable kubectl reps for the ReplicaSet and Deployment lifecycle.
Practice Linux troubleshooting on deliberately broken servers. Investigate vague failures, find the root cause, and make the system work again.
Inspect directory contents from the Linux terminal, read what a listing tells you, sort it to find the entry you need faster, and use shell patterns to name groups of files.
Create files and directory structures from the Linux terminal. Practice using touch and mkdir, building nested directory trees, working with tricky names, and creating groups of files in one go.
Your third hands-on session in a Linux terminal. Learn how the Linux directory tree is organized and practice navigating it with absolute paths, relative paths, and common shell shortcuts.
Practice reading the network configuration of Linux hosts: find interface names, IP and MAC addresses, the default gateway, and detect which routes a server uses to reach different destinations.
Fast, repeatable kubectl reps for the Pod lifecycle.
Your second hands-on session in a Linux terminal. Find out what a command name really runs, learn how to get help with --help and man pages, and stop or suspend commands that do not give the prompt back.
A Go service that has always been shipped as a static binary in a scratch-y image suddenly fails to start in a container, while the local build works as before. Find what recent changes caused it and fix the image without reverting them.
Run a GitHub Actions-compatible continuous integration (CI) job on a private runner and protect its internal API call with mutual TLS (mTLS) and Pomerium. Build separate server and client trust chains, authorize one machine certificate by fingerprint, then revoke, restore, and rotate its credentials through live policy changes.
A new intern learning about probes wrote a small Pod manifest. The exec command and the application are both correct, but the Pod never becomes Ready because one probe parameter is missing. Find it and add it.
The security team left five NetworkPolicy files on the workstation. Only one of them lets the frontend reach the backend while granting nothing more. Identify it and deploy it, unchanged.
Your first hands-on session in a Linux terminal. Practice running commands, reading their output, using arguments and options, checking whether commands succeed or fail, and chaining commands together. No prior Linux experience is required.
Explore live host CPU/Memory/Disk/Network telemetry as an interactive Doom diagnostics lab. All the elements in the game react to system signals (eg, the cpu cores glow red when there's high utilization).
The production Kubernetes cluster lives inside a private VPC, and its API server has no public endpoint. Turn an SSH connection to the bastion host into a SOCKS proxy and teach kubectl to use it, so the cluster becomes manageable from your workstation.
A worker node dropped to NotReady and part of the workload went with it. The container runtime is fine and the control plane is healthy; the trail leads from kubectl symptoms down into systemd and the kubelet configuration. Diagnose the node and bring it back.
Build five ways to combine containers in one Pod: a sidecar that extends the app, an init container that finishes before the app starts, a native sidecar with a startup guarantee, an ambassador that mutates an outbound call, and an adapter that translates an inbound one.
kubectl is dead: the kube-apiserver certificate expired and the control plane is down, while the workload quietly keeps serving. Diagnose the expiry offline, renew the certificates, bring the control plane back, and prove the cluster recovered.
Every kubectl command against a kubeadm cluster fails, and the workload is still serving. With no API to query, the usual tools tell you nothing. Work from the node itself to find what broke and bring the control plane back.
Kubernetes 1.37 can hand every pod its own short-lived X.509 identity, no service mesh and no sidecar involved. The API is served out of the box, but it issues nothing without a signer, and a request nobody answers leaves the pod waiting forever. Get a stalled workload its certificates, give its client an identity of its own, and make the server actually enforce mutual TLS.
A Deployment is running in the platform namespace with 3 replicas. Each pod has configuration files at /app/config/. Copy those files to /home/laborant/config/ on the local machine.
A Snake game Deployment and ClusterIP Service are already running in the snake namespace. Create a Traefik Ingress that serves the game over HTTPS using an existing cert-manager-issued TLS Secret.
Turn the manual storage provisioning workflow into an automation script: partition, format, mount, and persist a blank drive with a single non-interactive script.
A disposable Rust development environment with stable, beta, and nightly toolchains, cargo-watch, rustfmt, clippy, rust-analyzer, and the musl target pre-installed.
This tutorial will help you configure your rootless podman instance to pull from only from specific registries, using different OCI runtimes as well as configure all containers to have specific attributes all without any daemon restarts or sudo calls.
A C++ coordination service designed to replace Apache ZooKeeper
OpenAI gave a presentation about "the Hugging Face Incident", and Simon Willison, my favorite AI journalist, reconstructed the incident's timeline from the video. I recommend reading it in full, and here are my thoughts pertaining to the domain I'm working in - Linux, containers, and security.
Follow along with Liz Rice's classic GOTO 2018 presentation and build your own container runtime in under 100 lines of Go using Linux namespaces, chroot, and cgroups.
Understand how the chroot system call changes the root directory for a process, learn how dynamic linkers resolve dependencies inside a jail, and see what an isolated process perceives as its filesystem root.
Export an Alpine container rootfs using crane, set up a chroot environment, and execute a musl-linked binary that fails to run on the host system.
A stubborn process is running on the system, kill it :)
A Deployment running a distroless Chainguard nginx image (cgr.dev/chainguard/nginx) is deployed in the namespace webapps, fronted by a ClusterIP Service. Port-forward that Service to localhost port 3333 on cplane-01, use curl to save the response body to /home/laborant/index.html, and verify the file is accessible and contains the expected content.
Learn how to reconfigure the Kubernetes cluster DNS domain by updating CoreDNS ConfigMap and kubelet configuration on all nodes, a critical skill for custom cluster networking and CKA exam preparation.
Learn how to configure a Kubernetes CronJob to automatically take etcd snapshot backups every 6 hours — a critical skill for cluster disaster recovery and operational health.
A ready-to-use NixOS server for exploring the full Nix experience without installing it on your own machine.
A Job manifest at /home/laborant/batch-job.yaml is exiting with a non-zero exit status. The Job has limited retries configured. Inspect the cluster and the manifest to find the bug, fix it, and reapply.
Add the official Argo CD Helm repository, then use helm template to render the Argo CD chart for a dedicated namespace while skipping the chart's bundled CRDs, since they are already installed in the cluster.
A helper script that lists every container image running in the cluster — along with its on-disk size and the workload that uses it — has been downloaded to cplane-01. Install it as a kubectl plugin named kubectl-images so that kubectl images works from any directory.
Create a Pod that uses a generic ephemeral volume backed by a dynamic StorageClass. Unlike emptyDir, ephemeral volumes are provisioned as PersistentVolumeClaims and support storage requests and access modes.
Discover how Go functions under the hood as a modern systems programming language. Learn how Go makes system calls directly, resulting in self-contained binaries that have no libc dependencies.
Refactor a slow, single-threaded C file downloader that fetches files sequentially into a multi-threaded program using POSIX Threads (pthreads) to achieve concurrent downloads.
Learn how you can control multiple podman instances on remote machines without SSHing into them manually. Also learn to deploy your Compose application stacks without SCP / SSH with podman remote feature and Docker Compose v2
A container image and a bootable root filesystem are not the same artifact. This tutorial builds both from the same Dockerfile so you can see exactly where they diverge: what a plain ubuntu:24.04 is missing, the five requirements an iximiuz Labs playground rootfs has to satisfy, and how to prove an image would boot without being able to boot it. Ends with the same image built the easy way, from the official rootfs base.
A webapp deployment in the prod namespace is stuck in CrashLoopBackOff. The application's startup probe checks that its existing config directory is intact before the container is marked healthy. Fix the deployment so configuration is injected correctly and the pod reaches Running state with its health check endpoint responding on port 8080.
A MariaDB deployment and its PVC were accidentally deleted. The PersistentVolume survived due to its Retain policy. Restore the database by rebinding the existing PV without losing any data.
Configure a Vertical Pod Autoscaler (VPA) with a per-container resource policy that provides recommendations for the main container while excluding the sidecar container from any VPA-managed scaling.
Create a multi-container Pod with different user IDs per container while sharing a common group ID at the Pod level for collaborative file access.
Write a C program that calls fork() to clone a process and execve() to execute a command, then print and retrieve the child process PID.
Try ShellGym - an interactive Linux command-line trainer - in a ready-made Ubuntu VM: daemon running, web UI open, sample learning path loaded.
Explore Linux/Unix signals in Go, how signals act as asynchronous notifications, who can send them, default kernel behaviors, sending signals with kill and Go, graceful signal handling with os/signal, and why SIGKILL cannot be trapped.
Explore what a thread actually is in Linux, how threads relate to processes, how the Linux kernel treats both as tasks (task_struct), and how kernel scheduling enables concurrency.
Explore what a program is, when it actually becomes a process and how the Linux scheduler manages process execution.
This tutorial provides an in-depth know-how of working with Pods (group of container) with Podman. It also gives insights into how the podman CLI works well with Kubernetes, albeit in limited capacity to develop better Container Workflows.
Explore what a computer, CPU architecture, and kernel are, learn the history and family of Assembly ISAs, compare CISC vs RISC, and write your first x86_64 assembly "Hello, World!" program.
Produce a valid ELF binary that runs and exits cleanly, but does not define a main() function.
Compile a small C loop with -O2 -S, inspect the generated assembly, report how many add instructions gcc produced and see how much it has optimized the equasion.
Run gcc -E on a small C program and find the exact line where the preprocessor expanded a macro into a printf call.
Walk through the C compilation pipeline: preprocessor, compiler, assembler, and linker. Start with a normal hello world, inspect macros and generated assembly, and end by producing a running binary that has no main() function.
Use kubectl proxy to open a local, already authenticated HTTP endpoint to the Kubernetes API server, then use curl to list every Secret in the gliese-581 namespace and save the raw JSON response to /home/laborant/secret-list.json.
