Hoist: Label-Driven Docker Updates
Per-container control over Docker image updates with labels. Auto-update or notify via Discord, Slack, ntfy, no sidecar needed.
Tag: devops
All the articles with the tag "devops".
Incident Response for Self-Hosters
You've been compromised. Now what? A practical incident response playbook for self-hosters who didn't think they'd need one until right now.
Restic vs Borg vs Kopia: Backups That Actually Deduplicate
rsync is not a backup. Restic, Borg, and Kopia do deduplication, encryption, and incremental snapshots properly. Here's which one fits your home lab and why.
SBOMs and Supply Chain Security
A Software Bill of Materials tells you exactly what's in your software. Syft generates one, Grype scans it for CVEs. Together they're your supply chain paper trail.
Woodpecker CI vs Drone CI: Lightweight Pipelines for People Who Hate Waiting
Jenkins needs a server. GitHub Actions needs GitHub. If you're self-hosting your Git and want CI that doesn't weigh more than the code it's testing, Drone CI and its community fork Woodpecker CI are worth knowing about. One changed its license. The other exists because of that decision.
Container Security: Scan and Sign Your Images Like You Mean It
Pulling unscanned images onto your server is a gamble. Trivy finds the CVEs. Cosign proves the image hasn't been swapped out. Here's how to add both to your workflow.
Gitea vs Forgejo vs GitLab CE: Self-Hosted Git Without the Existential Crisis
You want to self-host your git. Noble. Responsible, even. But now you're staring down three options and a Reddit thread that's somehow both 4 years old and still being argued about. Gitea, Forgejo, GitLab CE, let's cut through the noise and figure out which one won't ruin your weekend.
Loki vs ELK: Centralized Logging Without the RAM Tax
ELK does everything and wants all your memory. Loki does logging the Prometheus way, label indexes, not content, and runs on a fraction of the resources. Here's the honest comparison.
Vault vs Infisical: Secrets Management for Teams Who've Learned the Hard Way
Your database password is in 14 different `.env` files across three repos, one of which is public on GitHub. Somewhere out there, a bot is already trying it. It's time to fix the secrets sprawl problem, and pick the right tool to do it without spending three weeks on setup.
Cockpit vs Webmin: Web Admin Panels That Don't Make You Cry
Cockpit is the modern systemd-native Linux admin panel. Webmin is the veteran that configures everything. Here's which one should be on your servers, and which shouldn't.
Trivy + Cosign: Scan and Sign Your Images
You're pulling container images from strangers on the internet. Trivy scans them for CVEs. Cosign proves they haven't been tampered with. Use both.
Prometheus + Grafana: Monitoring That Doesn't Lie to You
Prometheus scrapes metrics. Grafana makes them pretty. Alertmanager wakes you up at 2 AM. Here's how to wire all three together into a monitoring stack that actually works.