Hardening options that actually matter: ProtectSystem, PrivateTmp, DynamicUser — and which ones will break your app at 3 a.m.
Notes on keeping servers boring.
Practical write-ups on Linux administration, containers, CI/CD and monitoring — mostly things I had to figure out the hard way, written down so future me doesn’t repeat the process.
Alerting without noise: my Prometheus rules
Oct 18, 2026How I cut alert volume by 80%: rate windows, for clauses, and the two alerts every host should have before anything fancy.
Measuring real image size, why COPY --link helps cache, and a Makefile target that keeps images under 80 MB.
A small k3s cluster on three VMs: lessons
Sep 12, 2026etcd quorum, baked-in Traefik, and why I stopped using NodePort for anything user-facing. Full kubectl cheat sheet inside.
Reading journalctl like a person
Aug 25, 2026Time windows, unit filtering, priority levels and the grep patterns I keep in my shell history for post-mortems.
GitHub Actions: caching that actually works
Aug 3, 2026Cache keys that don’t rot, actions/cache vs registry layers, and cutting a 14-minute pipeline down to 4.
Remote backends, locking, terraform plan in CI — and a recovery story involving a hand-edited state file. Learn from my pain.
PostgreSQL backups you can actually restore
Jun 27, 2026pg_dump in a container cron, restic to object storage, and a monthly restore drill script. Untested backups are rumors.
The four Grafana panels I actually look at, and how I stopped building dashboards nobody opens.
About
I’m Mikhail, a systems engineer. I run a handful of Debian boxes for side projects and write up whatever I learn the hard way. Everything here is tested on real machines before it’s posted — if a command breaks something, the post says so.
Posts are short on purpose. No 3000-word intros, no affiliate links. Corrections welcome: notes [at] example.com.