DEBUGGING A SILENT SELINUX DENIAL IN A NETDATA KUBERNETES DAEMONSET
A Netdata child DaemonSet in Kubernetes hit a chmod ‘Permission denied’ on a hostPath directory it already owned as root - with zero trace in ausearch or journalctl. The real cause was a silenced SELinux denial, and the fix is a one-line relabel, not chmod 777 or setenforce 0.
FIXING GNOME BOXES 'PERMISSION DENIED' WHEN OPENING ISOS FROM DOWNLOADS ON FEDORA 44
Encountered a ‘Permission denied’ error in GNOME Boxes when booting from an ISO in ~/Downloads. The root cause was SELinux labeling, and the the warkaround easy enough: moving the ISO to a different directory.
SANDBOXING OPENCODE WITH BUBBLEWRAP AND ANTHROPIC'S SANDBOX RUNTIME
AI coding agents are powerful and, by default, far too liberal with accessing of your filesystem and network. Here’s how I ended up sandboxing OpenCode with Anthropic’s open source Sandbox Runtime (srt), a simple lightweight Bubblewrap wrapper with a plain JSON policy file: the Nix home-manager install, the allowlist config itself, and two real edge cases I hit along the way - a Nix multi-user daemon socket that can’t be scoped on Linux, and an agent orchestrator that spawns processes without a shell.
AUTOMATING BORGBACKUP COMPACTION FOR APPEND-ONLY REPOS IN BORGWAREHOUSE
Append-only mode in BorgWarehouse protects your backups from compromised clients - but it also means borg compact never runs from the client side, causing repositories to grow indefinitely. This post explains the problem and shares a Bash script that automates server-side compaction across all repos, handles quota mismatches, retries on lock contention, and reports per-repository status to UptimeKuma.
FIXING CLOUDFLARE WARP ON FEDORA 44 WITH NIX HOME-MANAGER
End of April, the Fedora team released F44. After a few weeks of wait-and-see, I upgraded at the end of May. I have run Fedora on my main Linux workstations for 10+ releases now, and recent upgrades have been remarkably smooth - nothing unforeseen breaking.
SETTING UP NIX ON FEDORA 44
A practical, step-by-step guide to installing and configuring Nix on Fedora 44 with SELinux, flakes, and direnv for a sandboxed, reproducible development environment.
I FINALLY ADOPTED NIX ON FEDORA 44 (WITHOUT COMPROMISING SELINUX)
Why I finally adopted Nix on Fedora 44 to bridge the gap in my dev workflow—balancing isolation, reproducibility, and cross-platform consistency without sacrificing SELinux.
FIXING PANGOLIN NEWT FAILING TO START UNDER SYSTEMD ON ENTERPRISE LINUX (SELINUX)
Pangolin’s newt client silently fails under systemd on SELinux-enforcing Enterprise Linux due to a wrong file context. Here’s the one-command fix.
EXPANDING A VDI DISK SIZE ON XEN
How to safely identify and expand the right VDI on XCP-ng or XenServer using xe commands, avoiding DR backup confusion, and letting CloudInit resize the filesystem on next boot.
MAKE FEDORA BULLETPROOF: BTRFS SNAPSHOTS, TIMESHIFT AND GRUB FOR EASY SYSTEM ROLLBACK
I recently saw a friend’s LinkedIn post that stuck with me: their PopOS system was borked after a failed update, and they’re now reinstalling Fedora from scratch. It’s a familiar tale in Linux circles, but not inevitable.