Original, source-backed articles about running small systems, static sites, HTTP, DNS, TLS, and operations.
Posts are original articles written for this site. Each one is script-free, source-backed, and tied to the same operational reality the rest of the site records: how a small, static, publicly served system is built, secured, and kept honest.
A read-only root restricts filesystem mutation within its scope
A read-only root filesystem prevents ordinary writes to the filesystem layer containing a service’s packaged code and configuration. Explicit mounts can still provide writable locations for runtime data. This reduces accidental modification and some persistence opportunities, but its boundary is filesystem mutation. It does not by itself remove process privileges, prevent reading available data, or block communication with other services.
...
Graceful shutdown stops work, not life
Graceful shutdown is a transition in how a service accepts and finishes work. Receiving a signal is only the trigger. The useful guarantee is narrower than “nothing is lost”: stop admitting new business work, account for what was already accepted, allow bounded completion, and report honestly when that bound expires.
...
Traces connect the recorded parts of a request
A distributed trace connects recorded operations through a shared trace identifier and explicit relationships. A span represents one operation, with start and end timestamps, attributes, events, and status. This makes a trace useful when a checkout request crosses an application, an inventory service, and a payment service. The resulting picture depends on which operations were instrumented, retained, and exported; it is not an automatic inventory of every action the request performed.
...
curl is your first HTTP probe
A command-line HTTP request gives a small, inspectable view of a service. It can show the response status, headers, body, and timing without a browser’s rendering layer. Start with a concrete question: whether the original URL redirects correctly, whether the final representation is available, or whether a particular method is accepted. Those questions require different probes. One successful curl invocation does not establish that every part of a website works.
...
A container combines process isolation with a shared Linux kernel
A conventional Linux container runs processes using the daemon host’s Linux kernel while providing selected isolated views through namespaces. Image files supply a userspace environment; they do not boot a separate kernel for each container. On Docker Desktop for macOS, the daemon and Linux containers run inside a Linux virtual machine, so the shared kernel is that VM’s kernel, not the macOS kernel.
...
File locks protect a shared protocol and a specific object
A file lock coordinates participants that agree on what to lock, when to acquire it, and which operations belong inside the critical section. Linux offers several lock interfaces with different ownership and release rules. Choosing a filename and calling something named lock is insufficient: the protocol must identify the underlying object, the lock family, and the lifetime of every reference involved.
...
The Link header relates adjacent resources
The Link response field describes relationships between the current resource and other resources. An API returning JSON can advertise its next page without making clients scrape HTML or invent a query parameter. The field supplies a target and a relation; whether to follow it remains a client decision. It is useful metadata, not a command that every browser or crawler must execute.
...
Give durable state and scratch space different lifecycles
Durable application state and disposable scratch files need different retention, capacity, and recovery policies. Separating their paths makes those policies easier to express, but directories alone do not create persistence or isolate disk capacity. The storage backing each path determines what survives process restart, container replacement, host failure, or cleanup. A reliable layout connects each class of data to an explicit lifecycle.
...
