Putting a PBX in Docker Did Not Remove the Networking
Containerizing a SIP service added another address and NAT boundary, which made port publishing, advertised addresses and RTP ranges more important rather than less important.
Linux
Thermals on a 2014 Mac mini Are a Production Signal
A production-engineering deep dive into thermals on a 2014 mac mini are a production signal, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
The Default Route Is a Fact, Not a UI Guess
A topology view should consume routing state rather than infer a gateway from labels or layout.
Linux PSI Changed How I Think About Saturation
A production-engineering deep dive into linux psi changed how i think about saturation, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Inode Exhaustion Can Break a Filesystem with Free Gigabytes
Free-space graphs can remain green while a workload creates huge numbers of tiny files and consumes the available inode table.
PSI Made Short Resource Spikes Easier to Interpret
Some periods looked acceptable in average CPU and RAM graphs while interactive services still felt slow.
Swap Provides Space, but Time Is the Price
Swap is sometimes treated as a direct replacement for RAM, but memory moved to storage has to be read back when active work needs it again. Swap creates room while introducing a time cost.
Disk Throughput Is Not Disk Latency
A production-engineering deep dive into disk throughput is not disk latency, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Using `dig` to Stop Treating DNS Like a Black Box
`dig` gave me a way to separate resolver configuration, authoritative answers, record types and response timing instead of reducing DNS to 'name works' or 'name fails'.
Sudo Authentication Failures Belong in the Security Timeline
Repeated sudo failures may be operator error, expired credentials or suspicious privilege-escalation attempts, and they often happen outside application logs.
Why 0600 Was Too Strict for a Containerized Private Key
The strictest-looking file mode is not automatically the safest usable mode when a non-root service must read the key.
Ubuntu 18.04 on a Lab Machine: The Networking Commands I Kept Reusing
Ubuntu 18.04 was a good excuse to stop relying on desktop network icons and start reading interface state, routes, sockets and DNS configuration directly from the system.
Observability Became Useful When Every Graph Had an Operational Question
Dashboards improved once I stopped collecting attractive metrics and started collecting evidence for specific failure modes.
Swap Usage Needs Duration and Context
A few megabytes of swap on an old Linux host did not automatically mean an incident, especially after long uptime.
Why I Monitor MemAvailable Instead of “Free RAM”
A production-engineering deep dive into why i monitor memavailable instead of “free ram”, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Tailscale SSH and Ordinary SSH over Tailscale Are Two Different Models
I can send SSH packets over the tailnet without asking Tailscale to become the SSH authentication system.
Normalize Load Average by CPU Count
A load average of four means something very different on a two-core system than on an eight-core system.
The Execute Bit on a Directory Is Really a Path Permission
A protected parent directory can block a perfectly readable child file because directory execute controls traversal.
Memory Usage Is Not the Same as Memory Pressure
The host looked busy enough that a simple percentage could easily become the whole diagnosis, but Linux memory reclaim makes that misleading.
Full RAM and Memory Pressure Are Not the Same Thing
On Linux, a high used-memory number does not automatically mean the system is under pressure. Cache consumes memory too and can often be reclaimed. A full-looking memory graph and work actually stalling for memory are different events.
Understanding Small Linux Parts Makes Larger Systems Legible
One reason I like Linux is that its parts can be followed. Behind a command, you can trace processes, files, permissions, and network relationships. You do not need to understand everything at once for the larger system to start opening up.
Docker Networks Hid Less Once I Drew the Packet Path
Container networking stopped feeling magical when I separated host routing, bridge interfaces, NAT and the application socket.
systemd Logs Became Part of My VoIP Troubleshooting
Service state, bind failures and restart loops often explained a broken PBX before I needed to inspect a single SIP packet.
Load Average Without CPU Count Is Almost Meaningless
A production-engineering deep dive into load average without cpu count is almost meaningless, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Why systemd Stop, Disable, and Mask Are Different
Stopping a service now, preventing automatic startup at boot, and making the service impossible to start are different operational intentions. systemd's stop, disable, and mask reflect those distinctions.
Clock Synchronization Is an Availability Dependency
A production-engineering deep dive into clock synchronization is an availability dependency, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Linux Routing Tables: The Moment `ip route` Replaced Guessing
Once I started reading Linux routes as prefix decisions instead of interface settings, multi-interface hosts and lab gateways became much easier to debug.
Monitoring TCP Retransmission on a Server That Also Runs VoIP
A production-engineering deep dive into monitoring tcp retransmission on a server that also runs voip, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Swap Usage Alone Is a Bad Memory Alert
A production-engineering deep dive into swap usage alone is a bad memory alert, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Building a Small Home Lab from an Old PC and a Cheap Switch
A useful home lab does not need enterprise hardware. A spare PC, a small switch and a few isolated network experiments are enough to learn a lot about real interfaces, routes and services.
sngrep Became the Fastest Way to Answer the First SIP Question
Before opening a full packet capture, sngrep gave me a quick view of call legs, response codes and dialog timing directly on the server.
Disk Full and Inodes Full Are Two Different Outages
A production-engineering deep dive into disk full and inodes full are two different outages, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
The TLS Key Existed, but OpenBao Still Could Not Read It
A file can have the right contents and still be unusable when directory traversal or group permissions are wrong.
Disk Busy Time Needs Latency Beside It
A device at high utilization can be handling work efficiently, while a lower-utilization device can still be returning slow requests.
eBPF/XDP: The Verifier Passing Does Not Mean Your Network Program Is Safe
The verifier proves classes of memory and control-flow safety. It does not prove that returning the wrong XDP action, updating the wrong map, or attaching at the wrong hook will preserve network connectivity.
Disk Latency Explains More Than Disk Throughput
The host can show modest megabytes per second while applications still wait because each storage request takes too long.
SSH Keys Made My Home Lab Feel Like a Real Network
Moving from local console access to SSH keys changed the lab from a collection of machines into something I could actually operate and troubleshoot remotely.
CPU Utilization Without CPU Modes Hides the Bottleneck
The host can report high CPU usage even when the useful question is whether time is going to user work, system work, steal, or I/O wait.
Traverse-Only ACLs Are Useful When Secrets Live Under Root-Owned Trees
A service can be allowed through one protected directory without being allowed to inspect the directory itself.
KillMode Matters When a Backup Script Spawns Child Processes
Stopping only the shell does not necessarily stop pg_dump, tar or helper processes that the shell launched.
tcpdump Became My First Tool Before Wireshark
On a headless Linux box, tcpdump was faster than moving captures around blindly. A narrow capture at the right interface often answered the question immediately.
Socket Counts Are Capacity Clues, Not Health by Themselves
A rising established-connection count can represent normal load, a leak, slow clients or a downstream dependency holding sockets open.
How I Add a Linux Machine to My Tailnet Without Turning It into a Snowflake
Joining a machine is easy; making its identity, hostname, access and role predictable is the part that matters later.
tcpdump on a PBX Taught Me to Trust the Wire Before the GUI
On a headless PBX, a narrow tcpdump capture often answered the important question faster than a full GUI trace: did the signaling or media packet actually reach the server?
Page Cache Is Not a Memory Leak
A production-engineering deep dive into page cache is not a memory leak, grounded in the 2014 Mac mini hserver observability stack and its accepted runtime evidence.
Context Switches and Interrupts Explain Some Invisible CPU Cost
CPU percentage alone did not reveal when the kernel was spending more work scheduling tasks or servicing device activity.