// notes
Blog
Notes on what I build and operate: infrastructure, databases and measurements. Published in Portuguese and English.
-
When is it worth switching from grep to ripgrep?
Across 20,000 files, rg finished in 0.11 s against 0.18 s for grep -r and skipped the binary on its own. See when to switch and when not to.
-
How do you measure a process's memory for real?
RSS is not what the cgroup charges. Learn to read PSS, USS, and memory.current to know a process's real cost.
-
A container is not a virtual machine: what it really is
A container is an ordinary Linux process with namespaces and a cgroup. No own kernel, no virtual disk, no init. Run two command blocks and compare PID 1, hostname, network and namespaces side by side.
-
How to benchmark disk speed without taking the server down
Measuring disk with the OS cache measures RAM, not the disk. The script uses O_DIRECT and fsync, a small test file and automatic cleanup, and delivers sequential throughput, IOPS and latency without taking the service down.
-
Guardrails with a small model: filtering output on your own machine
A 12-weight classifier plus 4 rules blocked 2 injection attempts and 2 secret leaks, and let 2 legitimate questions through. Runs in pure Python, no large model, no cloud. Granite Guardian 2B is Apache 2.0; llm-guard is MIT.
-
How to use journalctl to find the error
journalctl filters the systemd journal by unit, priority, time window and boot. Three filters in sequence turn a failure buried in thousands of lines into 3 lines. Nothing to install: the journal is already there.
-
Lazygit: can you use git in the terminal without memorising commands?
Lazygit is a terminal UI on top of git. The script reproduces partial staging, rebase and conflict resolution with plain git.
-
How do you store a secret in an environment variable without leaking it?
A .env file with mode 600, a git ignore rule and masked reading cover most leaks. The script tests this by itself.
-
Cost per consumer: how much each service spends on models
Record each call with consumer, model and day. A script groups them and shows who spends. Most of the cost usually sits in a single consumer.
-
How to harden SSH: what to turn off and what to keep
Turn off password, root and X11; require a public key. The rest is limits and ciphers. sshd_config line by line.
// By e-mail
Posts published here also go out by e-mail. Delivery has not started yet: whoever leaves an address now joins the first batch.