Posts
Page 27 of 58
-
Container Escape: How to Stop It
Containers are not VMs. Here are the real escape vectors, privileged mode, mounted sockets, kernel CVEs, and the runtime hardening that actually helps.
10 min read -
ko vs Jib vs Buildpacks
Build container images without writing a single Dockerfile, ko for Go, Jib for Java, Paketo Buildpacks for everything else. Real benchmarks, real tradeoffs.
11 min read -
Sentry Self-Hosted for Application Errors
Run Sentry on your own hardware to catch real application errors, stack traces, source maps, release tracking, alerts, and when you should just pay for SaaS.
11 min read -
Cosign Keyless: Sign Without Keys
Cosign keyless signing uses GitHub OIDC + Fulcio + Rekor to sign container images without managing private keys. Here's how it actually works and why you want it.
12 min read -
Docker Bake vs Compose Build
Orchestrating multi-image Docker builds: docker buildx bake vs compose build, matrix targets, multi-arch, caching, and when each one actually wins.
10 min read -
Heimdall vs Homepage vs Homer: Status Dashboards
Heimdall, Homepage, or Homer? Pick the right self-hosted dashboard for your homelab, real configs, Docker auto-discovery, and live API status widgets included.
10 min read -
cAdvisor + Prometheus: Per-Container Metrics Done Right
Stop guessing which container is eating your RAM. Set up cAdvisor + Prometheus to get real per-container CPU, memory, and network metrics in your homelab.
10 min read -
cri-o vs containerd
The CRI runtime under your Kubernetes cluster, cri-o vs containerd compared on footprint, distros, performance, and day-2 operability.
10 min read -
RustDesk vs MeshCentral: Self-Hosted Remote Desktop
TeamViewer costs a fortune, AnyDesk wants a subscription, and Chrome Remote Desktop routes everything through Google. Here's how RustDesk and MeshCentral stack up as self-hosted alternatives, and which one fits your use case.
9 min read -
Grafana Alloy: Replacing the Agent After Deprecation
Grafana Agent hit EOL in November 2025. Here is how to migrate all your monitoring nodes to Alloy without losing your mind, your metrics, or your dashboards.
11 min read -
Nerdctl vs Docker CLI
nerdctl is the containerd-native docker CLI replacement, when it's a drop-in, when it's not, and why you'd bother switching at all.
10 min read -
age vs GPG: Modern File Encryption That Doesn't Make You Cry
age replaces GPG for file encryption with a sane CLI, SSH key reuse, and zero key management drama. Here's how they compare and exactly when each one wins.
9 min read
