Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
Request body limits set a boundary
A request-body limit bounds accepted input, not merely the number written in Content-Length. Enforce it while consuming the body, before committing application effects. Compressed input needs separate limits for encoded and decoded bytes. A 413 response is useful only if the expensive allocation or irreversible write has not already happened.
...
$@ and friends give a function its whole argument list
A wrapper should pass the arguments it received without changing their boundaries. In Bash, "$@" does that when used as command arguments: each positional parameter becomes a separate quoted word. This matters for empty values, spaces, newlines, and literal wildcard characters. A command that happens to work with two simple filenames can still be broken if its wrapper reconstructs the list as a single string.
...
Default ports are conventions, not protocol detection or security
A default port lets a client omit a number when a protocol or configuration already supplies it. HTTP commonly uses TCP 80, HTTPS TCP 443, and SSH TCP 22. These assignments reduce configuration, but they do not inspect a listener’s bytes or establish its identity. An endpoint includes an address and transport as well as a port, and its application protocol still has to match the caller.
...
Request buffering controls when the backend receives an upload
An upload has two separate connections: client to nginx and nginx to the application. proxy_request_buffering on reads the complete client request body before sending that request upstream. Turning it off lets nginx forward body bytes as they arrive. This changes when the application becomes occupied; it does not create unlimited capacity or make a slow sender disappear.
...
A sequence allocates numbers independently of rollback
A PostgreSQL sequence allocates numbers independently of whether the caller’s transaction eventually commits. That makes ordinary identifier generation practical under concurrency, but it also makes gaps normal. A sequence number describes an allocation; it does not prove that a row exists, that a transaction committed, or that every smaller number has been used.
...
A PodDisruptionBudget limits eviction-based disruption
A PodDisruptionBudget limits eviction-based disruption for a selected group of Pods. It can help preserve serving capacity or quorum during maintenance, but cannot guarantee either. Its protection depends on the caller using the Eviction API, the selector identifying the intended members, and Ready conditions meaning something useful for the application.
...
Retries with jitter and backoff
A retry is another unit of work, not an automatic improvement in reliability. It can recover from a transient failure, but can also repeat an unsafe operation or add demand to an overloaded dependency. Decide whether the operation is eligible, how much total effort is allowed, and when that effort should happen before choosing a delay formula.
...
Compose startup ordering needs an explicit readiness condition
Docker Compose describes a graph of services and can start them according to declared dependencies. Process startup is only one possible condition in that graph. A database or API may be running before it can accept the operation another service needs. An explicit service_healthy condition lets Compose wait for a dependency’s configured healthcheck before starting the dependent service, provided that check represents meaningful readiness.
...
