-
When is it worth switching from grep to ripgrep?
Across 20,000 files, rg finished in 0.11 s against 0.18 s for grep -r and skipped the binary on its own. See when to switch and when not to.
-
How do you measure a process's memory for real?
RSS is not what the cgroup charges. Learn to read PSS, USS, and memory.current to know a process's real cost.
-
A container is not a virtual machine: what it really is
A container is an ordinary Linux process with namespaces and a cgroup. No own kernel, no virtual disk, no init. Run two command blocks and compare PID 1, hostname, network and namespaces side by side.
-
How to benchmark disk speed without taking the server down
Measuring disk with the OS cache measures RAM, not the disk. The script uses O_DIRECT and fsync, a small test file and automatic cleanup, and delivers sequential throughput, IOPS and latency without taking the service down.
-
How to use journalctl to find the error
journalctl filters the systemd journal by unit, priority, time window and boot. Three filters in sequence turn a failure buried in thousands of lines into 3 lines. Nothing to install: the journal is already there.
-
How do you store a secret in an environment variable without leaking it?
A .env file with mode 600, a git ignore rule and masked reading cover most leaks. The script tests this by itself.
-
How to harden SSH: what to turn off and what to keep
Turn off password, root and X11; require a public key. The rest is limits and ciphers. sshd_config line by line.
-
What cgroups are: how linux limits cpu and memory
cgroup is the kernel structure that says how much CPU and memory a process (or a container) can use. Measured in a container with -m 256m and --cpus 0.5: memory.max = 268435456 bytes and cpu.max = quota 50000 us per 100000 us.
-
Disk full: how to find what is taking the space
du per directory, find by size and /proc for a deleted file that still holds space. Measured: 181 MB total, 120 MB in a dump.sql and 30 MB in a file removed but still open.
-
HTTPS on localhost with mkcert, without certificate warnings
mkcert creates a local CA, installs it in the system and browser trust stores, and signs a certificate for localhost. Measured: with the CA in --cacert, curl returns HTTP 200 and ssl_verify_result 0 in 0.006 s; without it, it fails with unable to get local issuer certificate.
-
Cron done right: environment, logs and what silently fails
Cron runs with PATH=/usr/bin:/bin, SHELL=/bin/sh and from $HOME, without loading .bashrc. Three lines in the crontab (PATH, MAILTO="", redirect) plus a wrapper with flock fix what fails silently.
-
How to see what is using memory on Linux
Adding up the RSS of every process overshoots the machine's total RAM and nobody can explain why. The culprit is double counting of shared pages, and PSS, not RSS, is the number that reconciles.
-
What changes in the terminal once fzf handles the search
fzf matches what you type against what is in the list, typos included. Measured over 50,000 paths: grep returns 0 lines with two characters swapped, fzf returns all 500.
-
How to make a Linux terminal that looks good and works
One script installs zsh, oh-my-zsh and three plugins, backing up your .zshrc and proving the shell opens. Measured: 83 ms to 195 ms, and one extra compinit costs 2414 ms.
-
Setting up fail2ban without locking yourself out
Almost everyone who locks themselves out hits one of two mistakes: forgetting their own IP in ignoreip, or setting maxretry too low for a client that opens several connections at once. I measured the real threshold: with maxretry 3 the ban lands on the third failure, and an IP on ignoreip can get it wrong four times and stay out.
-
What happens in a TLS handshake
A TLS 1.3 handshake fits in one round trip: the client sends a ClientHello with a freshly generated public key, the server answers with its own, and everything after that is encrypted. I measured 778 bytes on a full handshake and 241 on a resumed one.
-
What one curl call can measure
With -w, curl breaks a request into five phases and prints the time of each one. Measured: of a 63 ms https call, 41.5 ms is the TLS handshake alone. The post also covers POST, headers, redirects and errors.
-
How to actually run a container as non-root
user, cap_drop ALL, read_only and no-new-privileges. Measured: with no lock the process keeps 14 capabilities and writes to /etc; with user 1000 the capabilities drop to zero and the /dados volume needs an owner.
-
How to stop typing your key passphrase on every command
ssh-agent keeps the decrypted key in memory while you work and ssh uses it on its own. The script below starts the agent, loads the key with a lifetime, and shows you what to check.
-
Replacing the server password with an SSH key
Turning off PasswordAuthentication removes the path password attacks use, because the client stops getting a password prompt at all. I timed 20 wrong passwords in 4.107 seconds against a test sshd and show the script that installs the key and kills the password without locking you out.
-
A backup only counts once you test the restore
I ran a backup with rsync --link-dest, deleted a file, and pulled it back with a matching sha256. Three snapshots of 4.1 MB took 4.1 MB, not 12.3 MB.
-
Compressing memory in hardware, against zstd in software
Meta proposed compressing RAM in hardware to save CPU. I timed zstd at three levels: decompression costs about the same at all of them, and that is the number that matters.
You reached the end. Every post is here.