The Website Was New. The CSS Was Four Months Old.
A production site passed its build, origin, route, header, and preview checks—then looked broken on mobile because immutable CDN caching preserved the previous stylesheet.
Read the field noteSystems nominal. Decisions questionable.
Production habits.
Home-lab consequences.
Architecture notes, failure reports, security trade-offs, and exact fixes from a home rack operated by a SecOps engineer who should know better.
- Approach
- Evidence first
- Stack
- Linux · Docker · ZFS
- Bias
- Simple > clever
01
View all writing →Latest field notes
What Actually Runs in the Home Lab
A curated inventory of the services behind 76 running containers—what each group does, why it exists, and which pieces are temporary.
Read the field noteWhy the Lab Is Boring on Purpose
The design choices behind a two-host Docker home lab: leaving Kubernetes, centralizing ingress, separating state, treating sockets as root, and applying before committing.
Read the field notePrometheus on NFS: Healthy Until It Wasn't
A network filesystem stall blocked shutdown, corrupted the Prometheus WAL, and demonstrated why a green health check is not a storage architecture.
Read the field note02
Explore the architecture →Inside the lab
Public-safe system mapTwo Docker hosts.
Two Docker hosts.
Several deliberate failure boundaries.
The compute, DNS, ingress, database, storage, monitoring, and backup design—without publishing addresses or turning the site into reconnaissance.
See how it fits together- 76
- running containers
- 2
- Docker hosts
- 3
- Patroni nodes
- 2
- recursive DNS paths
03
Operating principles
Healthy is not working
A green container is an alibi, not evidence. Verify application behavior and committed data.
Root access has many spellings
Docker sockets, automation tokens, and friendly dashboards all deserve the same suspicion.
Write down the regret
The useful lesson is usually the decision that looked reasonable five minutes before the incident.