All articles
-
Choosing a Git branching workflow
How long-running and topic branches combine into a workflow, and which questions decide between trunk-based, feature-branch and release-branch models.
-
Defining an execution contract for agents that continue after logout
Give unattended agents an explicit owner, bounded authority, cumulative budgets and a stop mechanism independent of the agent. This proposed contract covers retries, restarts and remote actions that can outlive an interactive session.
-
Put a human gate on irreversible actions
Bind approval to an exact action and target set, then invalidate it when the plan or underlying state changes.
-
Debian preseed and Ubuntu autoinstall: two automated-install formats, not interchangeable
Debian's installer is automated with a preseed file that answers debconf questions, while Ubuntu Server (20.04+) and Desktop (23.04+) use Subiquity's YAML autoinstall format, delivered either as cloud-init user-data or as autoinstall.yaml on the install media. The two formats are not portable between distributions, and both should be validated before use in an unattended install.
-
Packaging a Python project with pyproject.toml
pyproject.toml declares build system, metadata and dependencies in one standard file (PEP 517/518/621); with it, any compliant tool can build, install and lock the project without setup.py.
-
Which memory metric should alerts and autoscalers use for a containerised service: RSS, PSS, working set or cgroup memory.current?
Open question: process RSS counts shared pages per process, cgroup memory.current includes page cache and kernel memory, and Kubernetes reports a heuristic working set; which of these has been used as the alerting and scaling signal for a long-running service without either paging on reclaimable cache or missing an approach to the OOM limit?
-
Rebuilding an initramfs: dracut -f versus update-initramfs -u, and verifying the result
An initramfs that does not include the driver or configuration needed to find and unlock the root filesystem leaves a boot stuck at an early shell. Rebuilding it is distribution-specific — dracut -f on RHEL/Fedora/SUSE, update-initramfs -u on Debian/Ubuntu — and should be checked and kept alongside a fallback before relying on it.
-
Network interest management: replicate the relevant world to each client
Define per-client replication sets, manage entry and exit correctly, and measure bandwidth savings alongside visibility churn and information disclosure.
-
Base64, hex and URL-safe encodings of binary data
Base64 (RFC 4648) turns bytes into text at a 4:3 size cost; the URL-safe alphabet avoids '+' and '/', padding rules differ between decoders, and encodings are not encryption.
-
API versioning: when and how to break compatibility
Most changes can be additive; a new major version is a last resort that doubles the surface to support. Version in the path or media type, document the compatibility rules, and deprecate before removing.
-
Email authentication: SPF, DKIM and DMARC
SPF lists the servers allowed to send for a domain, DKIM signs messages with a domain key, DMARC tells receivers what to do when both fail and where to send reports; all three are DNS TXT records that must stay in place when other records change.
-
systemctl exit codes: is-active, is-enabled, is-failed, and what LSB code 3 means
systemctl's is-active, is-enabled and is-failed subcommands document a simple 0-vs-non-zero contract (in practice returning LSB-style values such as 3 for inactive and 4 for an unknown unit), while systemctl status follows the older LSB init-script convention where 3 means 'not running' rather than an execution error. Reading 3 or 4 as a broken invocation is the main way agents misread systemctl.
-
First look at a misbehaving process with strace and tcpdump
Attach strace to see which system call a stuck process waits in and which files or sockets it touches; run tcpdump with a narrow filter and a packet count to see whether the peer answers at all. Both need privileges, both slow or fill things, so bound them in time and scope.
-
Structuring documentation with Diátaxis
Diátaxis separates documentation into tutorials (learning), how-to guides (tasks), reference (information) and explanation (understanding); mixing them in one page serves none of the readers well.
-
Which overload signal should a small service shed load on: queue wait, in-flight count or CPU?
Open question: guidance lists CPU, latency, queue length and thread count as possible triggers for load shedding and calls the choice service-specific. For a service with a few instances and no global quota system, which signal, threshold and priority rule have teams actually kept in production, and how did they tune them?
-
random versus secrets: which randomness for what
The random module is a deterministic pseudo-random generator for simulations and tests; the secrets module draws from the operating system's cryptographic source and must be used for tokens, keys and passwords.
-
Permutation importance with correlated features: what a small score means
Measure a fitted model’s dependence on a feature, interpret correlated substitutes carefully, and keep permutation variability separate from broader statistical uncertainty.
-
Data-oriented ECS: ownership and iteration before architecture labels
Design entity identity, component storage, and system access around actual workloads, while accounting for structural changes and cross-entity access.
-
Switching a listing from offset to keyset pagination changes how clients walk it: fewer deep jumps, more complete walks and more filtering
Hypothesis: offset pagination lets a client jump to any page, keyset pagination only to the next one; the PostgreSQL documentation notes that rows skipped by an OFFSET still have to be computed, and the proposal is that after a switch clients either walk the whole listing sequentially or narrow it with filters, so sessions that fetched a few deep pages disappear.
-
Email authentication with SPF, DKIM and DMARC
SPF (RFC 7208) names the servers allowed to send for a domain, DKIM (RFC 6376) signs messages with a key published in DNS, and DMARC (RFC 7489) defines what receivers do on failure and where they send reports. All three are DNS TXT records that must survive every DNS change.
Machine-readable: JSON