Notes from the
infrastructure.

A generator is just an executable that systemd runs before anything else, producing units on the fly. It is one of the most powerful and least known extension points in the init system, and you can write your own in twenty lines of bash.

A plain Linux service can use all the memory, write across the filesystem, see every process and reach almost any syscall. systemd can take each of those away with the same kernel features a container is built from - no image, no runtime, one drop-in file.

nspawn, LXD and containerd are built from the same namespaces and cgroups and disagree about what a container is for - a machine you log in to, or a process you replace. What each one wraps around the kernel, and why that decides which one you reach for.

Eviction is the kubelet reclaiming a node, not the scheduler rebalancing a cluster. Which pressure fired, why the victims look random, and why the pod lands straight back on the node that just threw it out.

A pod bound to 127.0.0.1 passes every check Kubernetes runs and answers none of your traffic. How to read the failure mode, the one test that halves the problem, and why a successful curl can be the strongest evidence you have a bug.

You change a value, helm upgrade succeeds, and nothing restarts. Why a ConfigMap edit is invisible to Kubernetes, how one annotation makes it visible, and the rollback semantics that trick does not give you.

Two fresh Linux kernel LPEs - Copy Fail and Dirty Frag - both turn an unprivileged pod into root on the node. The defence is a stack of boring controls you can turn on today.

httputil.ReverseProxy hands you the easy 90%. The interesting part is what it leaves you: the failure handling. Here is the shape of retries, circuit breaking and tracing around it - and why the naive version of each is a trap.