I discovered #docker buildx can bind mount files from one build stage into another. This simplifies #distroless container image modifications when combined with Busybox. Instead of writing a new post, I updated my existing tips and tricks with Busybox. amf3.github.io/articles/vir...

I like educational posts, but this includes the challenge of "how fast could I answer"? For just_enough minimal containers, I'd say 3-5 minutes. Long enough for me to either extract the SBOM from the container image or to click the #buildroot project link on gitlab. github.com/amf3/just_en...

Docker@docker.com · last mo.

If a critical vulnerability dropped tomorrow, how fast could you answer: where are we exposed? That's the problem SBOMs solve. This guide explains what they are, why they matter, and how teams are using them in practice: https://bit.ly/3SyH53j

Pi-Hole felt too heavy. I wanted a local recursive resolver that supports ad-lists, split horizon records, and reporting. The final runtime is a #distroless Unbound DNS container. The config generator can be found here: github.com/amf3/adlist_... #selfhosted #docker

FYI: Fees for the California Parks Historian Passport pass have been waived until July 6th. www.gov.ca.gov/2026/06/17/g...

Governor Newsom announces special free pass to California’s state historic parks in honor of Juneteenth and America’s 250th anniversary | Governor of California

gov.ca.gov

I didn't know that #Golang had these compile options for AVX instructions. Useful for CPUs made after 2011. lemire.me/blog/2026/06...

How much do amd64 microarchitecture levels help in Go?

Our 64-bit Intel and AMD processors have evolved over decades. When you compile a Go program for a 64-bit Intel or AMD processor, the compiler targets, by default, a nearly 20-year-old instruction set...

lemire.me

Lessons from my software supply chain adventures. * Control the build pipeline, control the artifact. * Declaritive image contents are the goal. Small image sizes are a byproduct. * Stop waiting for vendor patches. Update the base git hash & rebuild. Resulting in a 51MB #Python flask app.

I just found out BusyBox can self generate all its applet links. This could be handy if you want to inject a shell into a #distroless or minimal container image. "/bin/busybox --install -s /bin" Screenshot is an example Dockerfile showing how this is done.

I'm exploring self-hosted software supply chains and building appliance style containers from #buildroot generated binaries. Today I got OCI image attestation working on an Unbound DNS container build. Seeing provenance attached from build system to container image feels like a big milestone.

‪I wrote a runc wrapper that uses bpftrace to log openat system calls made by an application inside a Docker container. It turns out static analysis misses a lot. amf3.github.io/articles/vir...

Why does a Python container need a Perl interpreter? It's not wrong but it's unexplained. Here's a demo showing how a manifest is applied to a scratch image so every file exists with intent. No need for a base image or removal of existing packages. amf3.github.io/articles/vir...

I finally wrote this up: amf3.github.io/articles/vir... What I found interesting wasn't what's in the base image but how much content is present without intent. Looking forward I'm planning for better declarative builds with a new approach in github.com/amf3/just_en...

Adam Faris@af9.us · 5mo ago

I'm going to drop this here and see who notices. 👀 Yes it's related to a new article I'm writing. No it doesn't need to be this way.

I'm going to drop this here and see who notices. 👀 Yes it's related to a new article I'm writing. No it doesn't need to be this way.

Nice. I just noticed the #zrepl project updated their Go dependencies in the recent 0.7.0 release. Tooling with earlier versions was getting long in the tooth. #zfs zrepl.github.io/changelog.html

If you're tired of the "Docker vs Podman" marketing noise, it's time to look at the OCI spec under the hood. I built an image manually with just tar and sha256sum to prove a point. amf3.github.io/articles/vir... #OCI #Containers #DevOps #Hacking #Docker #Podman

Apparently running “apt autoremove” on Ubuntu 25.10 can remove netplan. Without netplan, networking does not survive the reboot, so fun times. At least I still remember how to bring up an interface manually.

To make CoreDNS recursively resolve addresses I need to link and compile against libunbound? coredns.io/manual/setup... Then why not run unbound? I must be missing something.

I just discovered a-Shell for IOS. It’s like reliving the coLinux on WindowsXP days. I can write markdown in Textastic and use a-Shell to push markdown changes to git repos or even running code. 🤯 holzschu.github.io/a-Shell_iOS/

I finally found the feature that has me wanting to switch from Make to Just. Just has command line argument support. just.systems/man/en/setti...

Huh. #podman has a rest API with coarse grained access like #docker. If I can read the Podman socket I can dump secrets within the container. I know the API is disabled by default, but enabling it seems to have similar risk as rootless Docker. I never stop being amazed by marketing.

I was checking backlinks and realized I ended up on Hacker News. news.ycombinator.com/item?id=4656... I mean it's not front page content but baby steps right? 😃

I wrote a new #docker post on why mounting /var/run/docker.sock with the :ro option doesn’t do what people thinks it does. It walks through Unix sockets, the Docker API, why “read-only” fails, and what socket proxies actually provide.

amf3.github.io/articles/vir...

I learned Docker Engine exposes a prometheus compatible /metrics endpoint. It looks like I can stop using cAdvisor, meaning one less container with access to docker.sock. #docker docs.docker.com/engine/daemo...

Collect Docker metrics with Prometheus

Collecting Docker metrics with Prometheus

docs.docker.com

New post: Why a Two-Node Docker Swarm w/ ZFS Snapshots Is Enough This isn't about defending Swarm, it's about designing systems with clear failure modes and using storage that doesn't pretend to scale magically #homelab This makes 12 posts in 12 months. 2025 goal met amf3.github.io/articles/arc...

Neat, a SSO (single sign-on) middleware that supports OpenID on the frontend and simple HTTP auth with backend apps. This might be what I need for self-hosted services at home. 😀 www.authelia.com

Authelia

Authelia is an open-source authentication and authorization server and portal fulfilling the identity and access management (IAM) role of information security in providing multi-factor authentication ...

authelia.com

This is fun and shows which topics I discussed throughout the year. My most-used words in 2025 were: 1. "docker" (12×) 2. "plugin" (11×) 3. "cloudinit" (11×) 4. "router" (8×) 5. "qemu" (8×) See which words you used the most here: anisota.net/harvest

Anisota's Annual Bluesky Harvest 2025

A recap of your year on Bluesky. Discover patterns, connections, and insights from your journey in the ATmosphere.

anisota.net

Will I ever settle on a storage format when writing this app? So far its been SQLite -> Parquet -> NDJSON. I find the JSON part boring. No compression and is it any better than CSV when not using nested fields? Now I'm tempted to try Protobuf to get the compression that I likely don't need.

I use git submodules to pin the Papermod theme version used by my blog. Tonight I realized I can pin the Hugo web framework by using go modules. The pinned Hugo version is ran with "go tool Hugo". One of those things that became obvious to me once it was obvious. Now for some CI pipeline updates 😐

Nice summary of past AWS re:Invent videos on how S3 works behind the scenes. bigdata.2minutestreaming.com/p/how-aws-s3...

how AWS S3 serves 1 petabyte per second on top of slow HDDs

Learn how Amazon built the backbone of the modern web that scales to 1 PB/s and 150M QPS on commodity hard drives

bigdata.2minutestreaming.com

Do you ever have those moments of running across a fun article, only to realize it was posted on hacker news two months ago? Me, this morning. 🤦‍♂️ bogdanthegeek.github.io/blog/project...

Hosting a WebSite on a Disposable Vape

Someone's trash is another person's web server.

bogdanthegeek.github.io

I tasted the forbidden fruit. Running my home router inside a VM. It's delicious. #Mikrotik CHR, #QEMU, PCI passthrough, qcow2 snapshots, full reproducibility. Easy rollback. Manage networks like software projects. Here's how I built it: amf3.github.io/articles/vir...