Mohit Choudhary - Notes

Gmail Tricks

2026-09-17T00:00:00+00:00

Plus trick</h3>

You can create custom email address with plus sign to classify senders and create blocks. For eg,</p>

ms.choudhary+netflix@gmail.com
</span></code></pre>
Some websites block this.</p>
Dot trick</h3>
You can have any number of dots in the email address, for cases, where plus is blocked.</p>
m.s.choud.hary@gmail.com
</span></code></pre>



Global Internet Routing
2026-09-09T00:00:00+00:00
As a end user, we've very simplistic view of internet, we send a packet and it magically lands at google.com for example. "There's no real cloud, only other people's computers".</p>
Bulk of internet is still physically connected, with cables under the sea connecting continents. It uses a special cable known as submarine communication cable</a> , see the map</a> for the interconnections.</p>
Level of connections</h3>
If you connect, two computers together, it's a point to point connection.</p>
If you connect multiple computers via LAN, they are part of same network in the broadcast domain.</p>
You use router to connect multiple such L2 networks.</p>
Autonomous Systems</h3>
At high level, AS, is a bunch of networks grouped together. It could have multiple internal networks with independent IP address space.</p>
An AS can control a set of IP address.</p>
Autonomous Systems Number (ASN) is assigned by IANA along with ip-allocation</a>.</p>
Peering</h3>

Peering connects multiple such networks (AS) physically. This allows sharing routing info via bgp. Such connections are called peering points or internet exchange points (IXPs). These are strategically located in data warehouses across the globe. The central stars in above diagrams are the IXPs.</p>
Peering and ASN are public information available at peeringdb</a>. Useful when you're planning to setup a datacenter. building-datacenter</a></p>
Not every network directly peers with others at public IXP, there're private connection as well.</p>
Also check list of internet exchange points</a>.</p>


IP Allocation
2026-09-09T00:00:00+00:00
Internet Assigned Numbers Association (IANA) (administered by ICANN) oversees:</p>

global ip address allocation</li>
autonomous systems number allocation</li>
root zone management</li>
</ul>
RIR</h3>
Except the private address space IPv4 Address blocks</a>, it assigns large blocks of address space to Regional Internet Registry (RIR). Ex:</p>

AFRINIC</li>
APNIC</li>
ARIN (Americas)</li>
LACNIC (Latin America)</li>
RIPE NCC (Europe)</li>
</ul>
RIRs further assigns blocks to Local Internet Registries, which assign it to:</p>

Internet Service Providers (ISPs)</li>
Large Education Institutions</li>
Large Enterprises</li>
</ul>
ISPs can further delegate to other entities as they see fit.</p>
If you see an ip from AFRINIC, it can be misleading to infer that it originates from africa. Ip address are not bound by physical location, it just means the administrative ownership lies with AFRINIC.</p>
Address Assignment</h3>

/8 = RIR</li>
/16, /17, /18, /19 = LIR, ISPs, Large business</li>
/20 = Small ISPs, Large business</li>
/24 = LAN</li>
</ul>


Link Local Address
2026-09-09T00:00:00+00:00
Address in IPv4 169.254.0.0/16 block are used for Link Local Adderss. These addresses are automatically assigned by the host, using known standard algorithm, used when no DHCP is found. Not forwarded by the router.</p>
Used for networking configuration in devices (like Printer) on the network without DHCP.</p>


Traceroute/ MTR
2026-09-09T00:00:00+00:00
Traceroute uses incremental TTLs on IP packets to figure out hops on the network. TTL is decremented by one on every hop. Once TTL is zero, router sends back ICMP time exceeded.</p>
MTR is traceroute + ping.</p>
Perform AS number lookup</h3>
mtr --aslookup yahoo.com
</span></code></pre>


Whois
2026-09-09T00:00:00+00:00
Use whois to figure out public details about a IP block/ domain name.</p>
Custom server</h3>
$ whois -h whois.cymru.com 142.250.182.46
</span>AS      | IP               | AS Name
</span>15169   | 142.250.182.46   | GOOGLE - Google LLC, US
</span></code></pre>


Best Practices
2026-09-08T00:00:00+00:00
The most critical resource when working with agents is context window. It holds entire conversation, every message, every file claude reads, every command output. It fills up quite fast. And performance starts degrading after that, with symptoms like forgetting earlier work or making mistakes.</p>

Use /clear</code> to clear context when starting unrelated/new work.</li>
Use subagents</li>
Add statusline via /statusline</code> to always show model name and context</li>
Use /insights</code> to generate a html detailing things that work, that needs improvement in your CC usage</li>
</ul>
Use Right Model</h3>

Sonnet - good with coding</li>
Opus - use for complex architectural decisions, and planning</li>
</ul>
Hooks - run specific command at steps in claude code.</p>


CLAUDE.md, Auto memory
2026-09-08T00:00:00+00:00
CLAUDE.md (or AGENTS.md for open standard) are instructions you write to give persistent context for agents.</p>
Auto memory are the notes claude writes itself based on corrections and preferences of the user. You can enable or disable auto memory and other settings at /memory</code></p>
Both are loaded automatically in every session. Check /context all</code> to show what claude has loaded.</p>
Things to add</h3>

Coding standards to follow</li>
Workflows for eg: how to invoke tests etc</li>
Project architecture</li>
Project specific gotchas</li>
</ul>
When to add to CLAUDE.md</h3>

Claude makes repeated mistakes</li>
Learnings from a session you want to persist</li>
Context info required to get up to speed for a new member</li>
</ul>
Since it's loaded on every run, it good idea to:</p>

keep it to facts</li>
should hold in every session, if not, you can create a skill</li>
have specific concrete instructions instead of being vague. for eg,

"Use 2 space indentation" instead of "Format code properly"</li>
</ul>
</li>
review the changes periodically and ensure that no conflicting instructions are present.</li>
</ul>


Prompts
2026-09-08T00:00:00+00:00
Learning</h4>

I trying to learn about [topic], do deep search and try to find blogs, books, courses, papers, articles, talks on this topics.</p>
</blockquote>
Research</h4>

read this folder in depth, understand how it works deeply, what it does and all its specificities. when that’s done, write a detailed report of your learnings and findings in research.md</p>
</blockquote>
Plan</h4>

I want to build a new feature [name and description] that extends the system to perform [business outcome]. write a detailed plan.md document outlining how to implement this. include code snippets</p>
</blockquote>
Annotate</h4>

I added a few comments to the document, address all the comments and update the document accordingly. don’t implement yet</p>
</blockquote>
Add a todo list (for longer tasks)</h4>

add a detailed todo list to the plan, with all the phases and individual tasks necessary to complete the plan - don’t implement yet</p>
</blockquote>
Implement</h4>
With todo</h5>

implement it all. when you’re done with a task or phase, mark it as completed in the plan document. do not stop until all tasks and phases are completed. do not add unnecessary comments or jsdocs, do not use any or unknown types. continuously run typecheck to make sure you’re not introducing new issues.</p>
</blockquote>
Without todo</h5>

implement it all. do not stop until all tasks and phases are completed. do not add unnecessary comments or jsdocs, do not use any or unknown types. continuously run typecheck to make sure you’re not introducing new issues.</p>
</blockquote>


Skills
2026-09-08T00:00:00+00:00
Extends what claude does. Use when you paste same instructions over again.</p>


Subagents
2026-09-08T00:00:00+00:00
Use subagents when side tasks would flood main conversation. Works in it's own context and returns only the summary.</p>
Why</h3>

Preserve context</li>
Control costs by routing to cheaper models</li>
</ul>
Advisor tool</h3>
Set /advisor</code>, which lower models can consult for architectural and other complex decisions.</p>


Nginx
2026-09-08T00:00:00+00:00
Template Envsubst</h3>
nginx:alpine</code> sources /docker-entrypoint.d/20-envsubst-on-templates.sh</code> which allows you substitute environment variables in the template dir at runtime. Example,</p>
services:
</span>  marquee:
</span>    image: nginx:alpine
</span>    container_name: marquee
</span>    restart: unless-stopped
</span>    environment:
</span>      - TMDB_API_KEY=[secret]
</span>      - NGINX_ENVSUBST_FILTER=^TMDB_
</span>      - NGINX_ENVSUBST_OUTPUT_DIR=/usr/share/nginx/html
</span>    volumes:
</span>      - ./site.html:/etc/nginx/templates/index.html.template:ro
</span>      - ./nginx-default.conf:/etc/nginx/conf.d/default.conf:ro
</span></code></pre>


Keeping up in tech
2026-09-08T00:00:00+00:00
Learning pipeline</h3>

Explore blogs, articles, talks for finding new stuff</li>
Find resources to learn specific thing Learning Prompt</a></li>
Filter the resources by quality</li>
Put the resources in right sequence</li>
Integrate everything</li>
</ul>
Time management</h3>
Exploring, planning & doing each require different mindset. It's better to schedule a separate time for each of these.</p>
Breadth vs Depth</h3>
Diving too deep in a topic has diminishing returns after a point. Also things get outdated quickly in the dynamic tech landscape.</p>
</p>
It should be like letter 'T'. You should know a lot of topics at high level, which you can easily pick up if required. And pick one or two silos in which you'll specialise and dive deep.</p>
Focus should more be on computer science fundamentals rather than tools and libs which change quite frequently.</p>
You cannot keep up</h3>
You'll never be able to keep up with all the things. So prioritise:</p>

Need to know</li>
Should know</li>
Nice to know</li>
Edge case (only applies in specific scenarios)</li>
Useless</li>
</ul>
Sources</h2>

https://codecapsule.com/2021/01/05/how-to-keep-your-tech-skills-sharp-in-a-leadership-role/</li>
</ul>
Related</h2>

</li>
</ul>


Income Tax Return (ITR)
2026-09-08T00:00:00+00:00
Income Tax Return (ITR)</h2>
Important Terms</h3>

FY: Financial Year. April to April cycle in which government functions</li>
AY: Assessment Year. Starts after FY has ended. Tax is assessed on previous FY. For e.g., AY 2018-2019 assess the tax collection in FY 2017-2018.</li>
Form16: Provided by employer. Shows taxable income (after deductions from HRA exemption, 80C, 80D). Tax deducted at source (TDS) for each quarter. Whether you'll get refund or not.</li>
Form26AS: Employer gives to IT (Government) showcasing total salary provided & TDS deducted by employer.</li>
</ul>
Important Dates</h3>

Feb 15. Few months before FY end. Provide investment proof of investment declaration.</li>
April 1. Investment declaration. Standard. 1.5 lacs in 80C. Medical Insurance in 80D.</li>
July 31. File Income Tax Return.</li>
</ul>
e-filing returns</h3>

User name is your pan card no.</li>
ITR-1 is for individual</li>
It's quite simple. It's just tallying figures with your Form16. IT cell already has Form26as, which means they already know your total income, total tax paid by you as TDS.</li>
Income in ITR is not total income, but rather " Income chargeable under the head 'salaries'" in your Form16</li>
Sum all investments in each category. For e.g., for 80C, add ELSS + PF</li>
If you've switched jobs, you'll get Form16 from both employers. In such case, you've to sum income from both form16 and enter & likewise for other fields as well.</li>
Add all associated bank accounts</li>
Mention any additional income.</li>
</ul>
Sources</h2>

</li>
</ul>
Related</h2>

income-tax</a></li>
</ul>


IPv6
2026-09-08T00:00:00+00:00
IPv6 uses 128 bits for addressing (compared to 32 bits of IPv4). To give an idea of how vast that is, you can give every atom in human body for the whole world population 6 address</a>.</p>
Representation</h3>
Instead of dotted notation used by IPv4, IPv6 are represented as 8 16 bit fields of case insensitive hexadecimal colon separated words.</p>
Eg,</p>
2001:4998:0124:1507:0000:0000:0000:F000
</span></code></pre>
To shorten this further,</p>

You can drop leading zeros</li>
</ul>
2001:4998:124:1507:0:0:0:F000
</span></code></pre>

You can replace successive zeros by ::</code>, but only once per address,</li>
</ul>
2001:4998:124:1507::F000
</span></code></pre>
Loopback address are represented as: ::1</code></p>
In dual stack hosts, you can also have IPv4 mapped address, where last part is also the ipv4 address of the interface, eg:</p>
::ffff:74.6.143.25
</span></code></pre>
Ports are represented as:</p>
[2001:4998:124:1507::F000]:443
</span></code></pre>
Address scopes</h3>
Link local address</h4>
All IPv6 interfaces always has a link local scope address. Its generated on the host, using standard algorithm for the lower 64 bits, without requiring DHCP or any other network configuration. Packets with link local source/destination is not forwarded to other links.</p>
Within:</p>
fe80::/10
</span></code></pre>
See link-local-address</a>.</p>
Private Unique Local Address</h4>
Private IPv6 networks similar to IPv4 Address blocks</a>. Not globally routed</p>
fc00::/7 or fd00::/8
</span></code></pre>
Global Address</h4>
Globally unique and routed by the internet.</p>
Sipcalc</h3>
$ sipcalc fe80::/10
</span>-[ipv6 : fe80::/10] - 0
</span>
</span>[IPV6 INFO]
</span>Expanded Address        - fe80:0000:0000:0000:0000:0000:0000:0000
</span>Compressed address      - fe80::
</span>Subnet prefix (masked)  - fe80:0:0:0:0:0:0:0/10
</span>Address ID (masked)     - 0:0:0:0:0:0:0:0/10
</span>Prefix address          - ffc0:0:0:0:0:0:0:0
</span>Prefix length           - 10
</span>Address type            - Link-Local Unicast Addresses
</span>Network range           - fe80:0000:0000:0000:0000:0000:0000:0000 -
</span>                          febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
</span></code></pre>


Subnets
2026-09-08T00:00:00+00:00
IPv4 Address is 32 bit number, which is divided into network and host parts</p>
[192.168.10] + [.98]
</span>network      + host
</span></code></pre>
Network part is also represented as: 192.168.10.0/24, /24</code> represents the network bits also known as subnet mask.</p>
Hosts in same network are part of broadcast domain, meaning they don't require a router to communicate. They can communicate directly at L2 using switch.</p>
IPv4 Address blocks</h3>
Whole of address space is divided into specific address blocks, by IETF & IANA, namely</p>

private address spaces - 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12</li>
Loopback addresses to localhost - 127.0.0.0/8</li>
Others</li>
</ul>
Netmask</h3>
/24</code> contains 2^8 = 256 address</p>
$ ipcalc 192.168.10.0/24
</span>Address:   192.168.10.0         11000000.10101000.00001010. 00000000
</span>Netmask:   255.255.255.0 = 24   11111111.11111111.11111111. 00000000
</span>Wildcard:  0.0.0.255            00000000.00000000.00000000. 11111111
</span>=>
</span>Network:   192.168.10.0/24      11000000.10101000.00001010. 00000000
</span>HostMin:   192.168.10.1         11000000.10101000.00001010. 00000001
</span>HostMax:   192.168.10.254       11000000.10101000.00001010. 11111110
</span>Broadcast: 192.168.10.255       11000000.10101000.00001010. 11111111
</span>Hosts/Net: 254                   Class C, Private Internet
</span></code></pre>
Of these first and last address cannot be assigned to a host. First address represents the network itself. And last address is broadcast address, used for broadcasting to all hosts in the network.</p>
Carve smaller subnets</h3>
$ ipcalc -s 24 64 48 192.168.10.0/24
</span>Address:   192.168.10.0         11000000.10101000.00001010. 00000000
</span>Netmask:   255.255.255.0 = 24   11111111.11111111.11111111. 00000000
</span>Wildcard:  0.0.0.255            00000000.00000000.00000000. 11111111
</span>=>
</span>Network:   192.168.10.0/24      11000000.10101000.00001010. 00000000
</span>HostMin:   192.168.10.1         11000000.10101000.00001010. 00000001
</span>HostMax:   192.168.10.254       11000000.10101000.00001010. 11111110
</span>Broadcast: 192.168.10.255       11000000.10101000.00001010. 11111111
</span>Hosts/Net: 254                   Class C, Private Internet
</span>
</span>1. Requested size: 24 hosts
</span>Netmask:   255.255.255.224 = 27 11111111.11111111.11111111.111 00000
</span>Network:   192.168.10.192/27    11000000.10101000.00001010.110 00000
</span>HostMin:   192.168.10.193       11000000.10101000.00001010.110 00001
</span>HostMax:   192.168.10.222       11000000.10101000.00001010.110 11110
</span>Broadcast: 192.168.10.223       11000000.10101000.00001010.110 11111
</span>Hosts/Net: 30                    Class C, Private Internet
</span>
</span>2. Requested size: 64 hosts
</span>Netmask:   255.255.255.128 = 25 11111111.11111111.11111111.1 0000000
</span>Network:   192.168.10.0/25      11000000.10101000.00001010.0 0000000
</span>HostMin:   192.168.10.1         11000000.10101000.00001010.0 0000001
</span>HostMax:   192.168.10.126       11000000.10101000.00001010.0 1111110
</span>Broadcast: 192.168.10.127       11000000.10101000.00001010.0 1111111
</span>Hosts/Net: 126                   Class C, Private Internet
</span>
</span>3. Requested size: 48 hosts
</span>Netmask:   255.255.255.224 = 27 11111111.11111111.11111111.111 00000
</span>Network:   192.168.10.128/27    11000000.10101000.00001010.100 00000
</span>HostMin:   192.168.10.129       11000000.10101000.00001010.100 00001
</span>HostMax:   192.168.10.158       11000000.10101000.00001010.100 11110
</span>Broadcast: 192.168.10.159       11000000.10101000.00001010.100 11111
</span>Hosts/Net: 30                    Class C, Private Internet
</span>
</span>Needed size:  224 addresses.
</span>Used network: 192.168.10.0/24
</span>Unused:
</span>192.168.10.224/27
</span></code></pre>


Man pages
2026-09-08T00:00:00+00:00

Search man page title and description</li>
</ul>
man -k syslog
</span></code></pre>

Search for arbitrary text in man pages</li>
</ul>
man -K "syslog"
</span></code></pre>


Config
2026-09-08T00:00:00+00:00
RemoteCommand</h3>
Host</span></span> homelab</span>
</span>  HostName</span></span> homelab</span>
</span>  #</span></span> If the remote command requires a TTY</span>
</span></span>  RequestTTY</span></span> yes</span>
</span>  #</span></span> -A attaches to an existing session, if no session it creates one</span>
</span></span>  #</span></span> -s specifies the session name 'work'</span>
</span></span>  RemoteCommand</span></span> tmux new-session -</span>A</span> -</span>s</span> work</span>
</span></code></pre>
Gotcha, you cannot run other command while specifying RemoteCommand. For eg ssh homelab ls</code> fails with Cannot execute command-line and remote command</code>. Can also affect other tools using ssh, like rsync, scp etc.</p>


Find device name by disk id
2026-09-08T00:00:00+00:00
/dev/disk</code> contains symlinks to actual device name:</p>

by-id</li>
by-diskseq</li>
by-label</li>
by-partuuid</li>
by-path</li>
by-uuid</li>
</ul>
$ ls -l /dev/disk/by-id/
</span>total 0
</span>lrwxrwxrwx 1 root root  9 May  7 06:32 ata-INTEL_SSDSC2BX200G4R_BTHC629105S3200TGN -> ../../sdb
</span>lrwxrwxrwx 1 root root 10 May  7 06:32 ata-INTEL_SSDSC2BX200G4R_BTHC629105S3200TGN-part1 -> ../../sdb1
</span>lrwxrwxrwx 1 root root 10 May  7 06:32 ata-INTEL_SSDSC2BX200G4R_BTHC629105S3200TGN-part2 -> ../../sdb2
</span></code></pre>
Sources</h2>

</li>
</ul>
Related</h2>

linux-dev-naming</a></li>
</ul>


Linux File IO Buffering
2026-09-08T00:00:00+00:00
When you read or write to files via read/write syscalls, it doesn't directly initiate access to disk. Instead, first the data is copied to in memory kernel buffer, known as buffer cache. Then at some later point, kernel writes (flushes) the buffer to disk. If in between, some other process reads the same file, kernel provides it from the buffer cache.</p>
Reads are buffered to cache as well, so kernel first reads the data from disk to buffer cache. Calls to reads are served from the buffer cache. Kernel performs read ahead for sequential reads.</p>
The aim of this to make read/write be performant and return fast, rather than waiting for slow I/O.</p>
There's no upper limit on the size of the buffer cache. It solely depends on:</p>

availability of physical memory</li>
demand for other purposes</li>
</ul>
Even though reads and writes are buffered in kernel, every time you invoke syscall, there's a performance penalty, to overcome this, the data is also buffered in stdio c library.</p>
Data is buffered in large blocks to reduce number of sys calls. You can force the data in stdio to be written to kernel buffer, by calling fflush()</code> lib call.

To flush the kernel buffer to disk, use fsync()</code> call. It returns only when all the data & metadata is flushed to the disk. Used by databases for journaling operations.</p>
For direct IO (without buffer) specify O_DIRECT</code> flag when opening file.</p>
Sources</h2>

</li>
</ul>
Related</h2>

gfs</a></li>
</ul>


/proc filesystem
2026-09-08T00:00:00+00:00
It's a virtual filesystem which provides interface to kernel internal data structures, which looks like traditional files and dirs. It's created on the fly by the kernel as process access them.</p>
Important files</h3>
/proc</h4>

/proc/version - kernel version</li>
/proc/self - a process can access it's own proc pid dir at /proc/self</li>
/proc/net - status info about networking & sockets</li>
/proc/sys/fs - settings related to filesystems</li>
/proc/sys/kernel - kernel settings</li>
/proc/sys/net  - networking settings</li>
/proc/sys/vm - memory management settings</li>
</ul>
/proc/PID</h4>

/proc/PID/status - contains runtime info about the process</li>
/proc/PID/cmdline - command line arguments used to invoke</li>
/proc/PID/cwd - current working dir of the process</li>
/proc/PID/environ - environment variables</li>
/proc/PID/exe - symlink to executable binary</li>
/proc/PID/fd  - symlink to files opened</li>
/proc/PID/maps - memory mapping</li>
/proc/PID/mem - process virtual memory</li>
/proc/PID/mounts - mountpoints for this process</li>
/proc/PID/root - symlink to the root dir</li>
/proc/PID/task - one subdir per thread</li>
</ul>
</p>
Sources</h2>

</li>
</ul>
Related</h2>

</li>
</ul>


Building a datacenter
2026-08-24T00:00:00+00:00
You've following on-prem choices, if you decide to go with deploying to datacenter:</p>

Greenfield buildout - Buy or lease whole datacenter yourself</li>
Cage colocation - Lease space inside a datacenter (enclosed by mesh walls)</li>
Rack colocation - Lease racks in a data center</li>
</ul>
In a co located datacenter, cost of power is generally greater than the cost of leasing the space. So you've to decide the compute based on how much power you want to draw.</p>
Pre requisites</h2>
Power</h3>
Power is the single most critical resource in a datacenter. It takes a long time to recover from an outage. Hence, redundancy is critical. You need two independent power feeds per rack.</p>
PDU (Power Distribution Unit), ranges from glorified extension cables to advanced with full management features like control and metered individual sockets.</p>
Network</h3>
After power, network is 2nd most critical resource. You need a tier 1 ISP and peering with internet exchanges (IX) for low latency. internet-routing</a></p>
Cooling</h3>
Airflow and cooling will be required.</p>
Inventory</h2>
You've bought the inventory: servers with dual redundant NICs, multiple redundant NVME drives, PDUs, network switches etc.</p>
Neat cabling requires professional experience. Cabling matrix and rack elevation are the docs which communicate how to rack and wire up. This step is closer to building a house than to deploying a terraform stack. Every place is different with different challenges and different solutions, hard to maintain uniformity. Common problem at this stage: "Cables are too short"</p>
Deployment</h2>
Next steps:</p>

network devices needs configuring

installing sonic os</li>
</ul>
</li>
router config needs writing</li>
RIR (Regional Internet Registry) records needs updating</li>
redfish api to connect to BMC</li>
pxe booting</li>
</ul>
Sources</h2>

https://blog.railway.com/p/data-center-build-part-one</li>
</ul>
Related</h2>

</li>
</ul>


Agentic Engineering
2026-08-21T00:00:00+00:00
Our engineering habits were built around the fact that writing code is hard. Writing code is cheap now. If AI writes the code, what's left to do? There's so much stuff:</p>

figuring out what code to write</li>
every problem has many solutions, and each of them comes with it's own tradeoff</li>
</ul>
Good code still has a cost. Big part of the skill in building software is understanding what's possible & what isn't. Invest time in learning. Many of them small proof of concepts that demonstrate a key idea. Then combine few of them to build something new.</p>
Tips on using agents</h3>
Give the agents right tools to solve the problem</p>
Specify the problem in right level of detail</p>
Give them examples of things you want them to do</p>
Verify & iterate on the results, until you're confident that it solves the problem reliably</p>
Agents can learn from past mistakes, provided we deliberately update instructions and tools harness to account for what we learn.</p>
If agents drop the quality of output, figure out what aspects of the process is hurting the quality and fix them.</p>
Technical debt</strong>: Doing things the right way will take too long, so work with the time constraints and hope that the project will survive long enough to pay the debt later.</p>
With AI agents, always avoid the technical debt, go to extra length. It's cheap now.</p>

api refactor</li>
poor inconsistent naming</li>
duplicate functionality</li>
1000s of lines in function
Fire the prompt away, and decide later. Agents are good for these tasks.</li>
</ul>
The best way to make confident tech choices, to prove it's fit for the purpose, is to make a working prototype. Wire up the simulation, run load test & see what breaks.</p>
The biggest anti-pattern: not reviewing the code.</p>
Sources</h2>

</li>
</ul>
Related</h2>

claude-code-workflow</a></li>
</ul>


Java
2026-08-21T00:00:00+00:00
Thread dump SIGQUIT (kill -3)</h3>
Request thread dump on a running java server. Does not terminate the server, useful for troubleshooting issues:</p>
kill -3 <pid>
</span></code></pre>


Cluster API
2026-08-21T00:00:00+00:00
Cluster</h3>
Represents kubernetes cluster whose lifecycle is managed by CAPI. Provider specific custom resources are referenced by infrastructureRef</code> or controlPlanRef</code></p>
apiVersion: cluster.x-k8s.io/v1beta2
</span>kind: Cluster
</span>metadata:
</span>  name: my-cluster
</span>spec:
</span>  clusterNetwork:
</span>    pods:
</span>      cidrBlocks:
</span>      - 192.168.0.0/16
</span>  infrastructureRef:
</span>    apiGroup: infrastructure.cluster.x-k8s.io
</span>    kind: VSphereCluster
</span>    name: my-cluster-infrastructure
</span>  controlPlaneRef:
</span>    apiGroup: controlplane.cluster.x-k8s.io
</span>    kind: KubeadmControlPlane
</span>    name: my-control-plane
</span></code></pre>
ClusterClass</h3>
Allows managing multiple cluster objects.</p>
Machine</h3>
Immutable objects representing kubernetes node. Never updated (other than labels, annotations & status) can only be deleted. Provider specific resources are referenced via infrastructureRef</code>. Provider specific controller provisions a new host to register as new node matching the machine spec. If machine is deleted, underlying infrastructure and node is deleted. Imm</p>
apiVersion: cluster.x-k8s.io/v1beta2
</span>kind: Machine
</span>metadata:
</span>  name: my-machine
</span>spec:
</span>  clusterName: my-cluster
</span>  version: v1.35.0
</span>  infrastructureRef:
</span>    apiGroup: infrastructure.cluster.x-k8s.io
</span>    kind: VSphereMachineTemplate
</span>    name: my-machine-infrastructure
</span>  bootstrap:
</span>    configRef:
</span>      apiGroup: bootstrap.cluster.x-k8s.io
</span>      kind: KubeadmConfigTemplate
</span>      name: my-bootstrap-config
</span>status:
</span>  nodeRef:
</span>    name: the-node-running-on-my-machine
</span></code></pre>
Machine Deployment</h4>
Similar to pod deployment, creates machine set, which creates machines.</p>
Machine Pool</h4>
Infrastructure specific group of machines</p>
Machine Set</h4>
Similar to pod replica set.</p>
Machine Healthcheck</h4>
Automatically initiate remediation for missing/unhealthy nodes, by replacing them.</p>
Infrastructure Provider</h3>
Component responsible for provisioning compute machines required by cluster or machines.</p>
Bootstrap Provider</h3>
Turn the server into kubernetes node using machine/node role specific init (using cloud-init) known as BootstrapData. BootStrapData is used by infrastructure provider to bootstrap machine into node.</p>
Control Plane Provider</h3>
Can either be:</p>

Self provisioned, wholly managed by single Cluster-API deployment</li>
Pod based, require external hosting cluster, where control plane components are running as pod, exposed by service.</li>
External or managed, controlled by service other than CAPI (eg GKE, AKS, EKS etc)</li>
</ul>
KubeAdmControlPlane</h4>
Manage set of machines as control plane nodes using kubeadm.</p>


Launchd
2026-08-21T00:00:00+00:00
List services</h3>
launchctl list
</span></code></pre>
Stop service</h3>
launchctl bootout system/<name>
</span></code></pre>
Start service</h3>
launchctl bootstrap system/<name>
</span></code></pre>


Setup socat proxy to remote host
2026-08-21T00:00:00+00:00
TCP request on port 6443 is forwarded to remote-host:6443</p>
docker run -d --name proxy6443 --restart unless-stopped -p 6443:6443 \
</span>  alpine/socat \
</span>  TCP-LISTEN:6443,fork,reuseaddr \
</span>  TCP:remote-host:6443
</span></code></pre>
Sources</h2>

</li>
</ul>
Related</h2>

network-load-balancing</a></li>
</ul>


sqlite3
2026-08-21T00:00:00+00:00
Read and apply sql file</h3>
sqlite3 file.db
</span>> .read path/migration.sql
</span></code></pre>


fstrim
2026-08-21T00:00:00+00:00
Discard unused blocks on a mounted filesystems. Useful for reducing the image size on a VM. Must be supported by the device. Check:</p>
$ lsblk --discard/-D
</span>NAME   DISC-ALN DISC-GRAN DISC-MAX DISC-ZERO
</span>vda           0      512B      64G         0
</span>├─vda1        0      512B      64G         0
</span>├─vda2        0      512B      64G         0
</span>└─vda3        0      512B      64G         0
</span></code></pre>
to check discarding capabilities of each block device.</p>
DISC-ALN: Disk alignment
DISC-GRAN: Disk granularity, smallest chunk which can be discarded
DISC-MAX: Largest amount which can be discarded in a single request</p>
If you're using packer with qemu/kvm, use newer devices q35</code> over pc</code> (outdated intel), which might not support discard.</p>
fstrim /path/to/mount
</span></code></pre>


ostree
2026-08-21T00:00:00+00:00
ostree is git for filesystems. It enables versioning, distribution & atomic deployment of linux systems.</p>
It stores complete system snapshot, making updates & rollbacks easier.</p>
Based on composefs, relies on EROFS (Enhanced Read Only Filesystem), which guarantees against data corruption, and natively performs data deduplication & LZ4 compression.</p>
Data is in /sysroot/ostree/repo/objects</code>.
Similar to git, allows creating commits, versions & switch between them.</p>
Only /var is mutable, other mutable dirs are symlinked to var. /etc is special overlay, it intelligently merges new changes with old. #question explore this more.</p>
It uses rpm-ostree package manager. #question what can it do/not do compared to dnf?</p>
Which creates new commits but changes are not affected until reboot.</p>
Can use rpm-ostree rollback</code> to rollback to previous commit.</p>
Sources</h2>

https://lwn.net/Articles/581811/</a></li>
https://blog.verbum.org/2014/01/21/ostree-in-action-rpm-ostree-and-switching-trees/</a></li>
https://github.com/coreos/rpm-ostree/blob/main/docs/background.md</a></li>
</ul>
Related</h2>

[[]]</li>
</ul>


partprobe
2026-08-21T00:00:00+00:00
Load partition table changes</h3>
Inform the kernel of partition table changes</p>
partprobe
</span></code></pre>
Sources</h2>

</li>
</ul>
Related</h2>

GUID Partition Table (GPT)</a></li>
</ul>


smartctl
2026-08-21T00:00:00+00:00
Monitors the Self Monitoring Analysis & Reporting Technology (SMART) built in most of ATA/SATA & SCSI/SAS hard drives.</p>
health</h3>
smartctl --health /dev/sda1
</span></code></pre>
all</h3>
health is sometimes superficial, check all:</p>
smartctl -a /dev/sda1
</span></code></pre>


Wipe software raid
2026-08-21T00:00:00+00:00
Wipe the filesystem on the raided drive, then stop raid</p>
$ wipefs -a /dev/md127
</span>
</span>$ mdadm --stop -f /dev/md127
</span></code></pre>
Finally wipe the partitions</p>
wipefs -a /dev/sda
</span>wipefs -a /dev/sdb
</span></code></pre>
Sources</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


Google Search AI Overview
2026-08-19T00:00:00+00:00
When you search in google, it also summarises the answer in it's AI overview tab. I've generally observed that it's a summary of the top links in the search. Something like you feed the data of top links into AI and generate response. Explore how this works more #question</p>
Sources</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


Certificate management using step-cli
2026-08-19T00:00:00+00:00
Source</strong>:</p>
Install step-cli</h3>
https://smallstep.com/docs/step-cli/installation/</p>
Create a new root CA, then create a new certificate and private key using step cli</h3>
$ step certificate create root-ca root-ca.crt root-ca.key --profile root-ca
</span>
</span>$ step certificate create foo foo.crt foo.key --profile leaf \
</span>            --ca root-ca.crt --ca-key root-ca.key --san 10.230.32.1 --san 10.230.32.2
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

openssl</a></li>
set-time-on-linux</a></li>
pki-certificates</a></li>
</ul>


OpenSSL Command
2026-08-19T00:00:00+00:00
Source</strong>:</p>
Inspect certificate</h3>
openssl x509 -in input.crt -noout -text
</span></code></pre>
Inspect certificate from URL</h3>
echo | openssl s_client -connect burrow.test.indexexchange.com:443 | openssl x509 -noout -text
</span></code></pre>
Remove passphrase from a private key</h3>
openssl ec -in input.key -out output.key
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

certificate-management-using-step-cli</a></li>
set-time-on-linux</a></li>
pki-certificates</a></li>
</ul>


PKI & Certificates
2026-08-19T00:00:00+00:00
Terminology</h3>

Entity</strong>: anything that exists! your computer, your code</li>
Identity</strong>: attributes which define an entity</li>
Claim</strong>: Entities can claim they've certain name, Authentication, then, is the process of asserting that claim</li>
Subscriber</strong>: Server which participates in PKI, subject of the certificate</li>
Issuer or Certificate Authority (CA)</strong>: Entity that issues certificates to subscribers.</li>
Relying Party (your browser):</strong> Entity which uses certificates</li>
</ul>
Symmetric cryptography</h3>

Uses one-way hash functions(eg HMAC), which accepts message & pre-shared secret key as input and generate signature. Client can then ensure message integrity following same steps</li>
</ul>
Asymmetric cryptography / Public key cryptography</h3>

Uses public/private keys to

either encrypt data with public key. This can then only be decrypted using private key</li>
sign some data with private key. Anyone who has public key can verify this signature</li>
</ul>
</li>
</ul>
Certificates</h3>


In simple terms: "bind names to public key"</p>
</li>

Allows computer to see who it's communicating with</p>
</li>

In other words, it's a data structure of public key and name, which is signed by issuer</em></p>
</li>

But what does it actually contain?</p>


Public key</p>
</li>

Name (Subject Alternative Name - SAN)</p>
</li>

Issued at, expires at dates</p>
</li>

Crptographic signature</p>
</p>
</li>
</ul>
</li>

SSH has it's own format of certificate</p>

when you edit ~/.ssh/authorized_keys</code> you configure a way of certificate less way of PKI to bind public key to name</li>
</ul>
</li>

X.509</p>

The kind of certificate which browsers understand and use for HTTPS or almost always used for internal PKI setup</li>
Originally built for telcos to build global telephone dir in 1980s. Still reeks of that design. Most fields are out dated, hence not required to be filled</li>
Builds on ASN (Abstract Syntax Notation) for defining types, similar to JSON</li>
Most common encoding, DER (Distinguished Encoding Rules) consists of binary data, packaged as PEM files (base64 payload sandwiched between headers)</li>
</ul>
-----BEGIN</span></span> CERTIFICATE-----</span>
</span>MIIBwzCCAWqgAwIBAgIRAIi5QRl9kz1wb+SUP20gB1kwCgYIKoZIzj0EAwIwGzEZ</span></span>
</span>MBcGA1UEAxMQTDVkIFRlc3QgUm9vdCBDQTAeFw0xODExMDYyMjA0MDNaFw0yODEx</span></span>
</span>MDMyMjA0MDNaMCMxITAfBgNVBAMTGEw1ZCBUZXN0IEludGVybWVkaWF0ZSBDQTBZ</span></span>
</span>MBMGByqGSM49AgEGCCqGSM49AwEHA0IABAST8h+JftPkPocZyuZ5CVuPUk3vUtgo</span></span>
</span>cgRbkYk7Ong7ey/fM5fJdRNdeW6SouV5h3nF9JvYKEXuoymSNjGbKomjgYYwgYMw</span></span>
</span>DgYDVR0PAQH/BAQDAgGmMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAS</span></span>
</span>BgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBRc+LHppFk8sflIpm/XKpbNMwx3</span></span>
</span>SDAfBgNVHSMEGDAWgBTirEpzC7/gexnnz7ozjWKd71lz5DAKBggqhkjOPQQDAgNH</span></span>
</span>ADBEAiAejDEfua7dud78lxWe9eYxYcM93mlUMFIzbWlOJzg+rgIgcdtU9wIKmn5q</span></span>
</span>FU3iOiRP5VyLNmrsQD3/ItjUN1f1ouY</span>=</span>
</span>-----END</span></span> CERTIFICATE-----</span>
</span></code></pre>

Sometimes certificate is wrapped fancier packaging, which can contain multiple certificates (bundle). These are part of standards called PKCS</strong></li>
</ul>
</li>
</ul>
Public Key Infrastructure (PKI)</h3>

umbrella term used for store, use, verify, revoke of certificates & keys. as vague as "database infrastructure"</li>
Web/Internet PKI

works by default with browsers and TLS</li>
</ul>
</li>
Internal PKI

Why can't we use web PKI for internal workloads as well?

to have better control on certificate attributes (like issue/expiry date)</li>
there might be rate limit or availability issues with CA</li>
</ul>
</li>
</ul>
</li>
</ul>
Root certificates</h3>

Relying parties has pre-installed list of root certificates</li>
Root certificate is self signed Mike says Mike is blah blah blah</code></li>
Root CAs are regulated via various programs (like apple root certificate, microsoft root certificate, mozilla's root certificate)</li>
OS's are shipped with it's own trust stores (these are what are used when you use curl</code> or some programming library for TLS)</li>
</ul>
Intermediate certificates</h3>

CAs can be online or offline, based on whether they provide an APIs to issue certificates</li>
Root CAs are always offline</li>
Root private key is used infrequently to sign intermediate certificates (which are easier to revoke/rotate)</li>
Intermediate certificates are validated in same steps as leaf certificate</li>
When certificate are exchanged in TLS (Web PKI), it's passed as bundle (leaf certificate, is signed by layers of intermediate cert, which is signed by root cert)</li>
When you're setting up proxy (like nginx) you need to specify this bundle instead of leaf certificate</li>
These bundles are encoded as simple line separated PEM objects (eg)</li>
</ul>
</p>

Relying parties then verify all certificates in the bundle (certificate path validation)</li>
</ul>
Certificate management</h3>
Naming</h4>

Historically, DNs was used to name the subject of certificate (subscriber</em>). This was deprecated, and DN is now optional.</li>
SAN (Subject Alternative Name) is now used for subject. 4 sort of SANs are in common use: DNS, Email address, IP address & URI</li>
SAN can have multiple names (smallstep.com</code>, www.smallstep.com</code></a>, *.smallstep.com</code> )</li>
</ul>
Generating key pairs</h4>

If using RSA, use at least 2048 bits</li>
If using ECDSA, P-256 curve is probably best (secp256kl</code> or prime256v1</code> in openssl) eg in openssl:</li>
</ul>
openssl</span></span> ecparam -</span>name</span> prime256v1 -</span>genkey</span> -</span>out</span> k.prv</span>
</span>openssl</span></span> ec -</span>in</span> es256.key -</span>pubout</span> -</span>out</span> k.pub</span>
</span></code></pre>
Issuance</h4>

Next step after name & key pair is to obtain leaf certificate from CA</li>
CA will check two things:

public key which will be part of cert, is subscriber's public key, done by Certificate signing request (CSR)</li>
name in the cert, is subscriber's name, done by Identity proofing/registration</li>
</ul>
</li>
Certificate signing request (CSR)

Like cert, contains public key, name & signature. It's self signed by subscriber's private key</li>
</ul>
</li>
Identity proofing

Kinds of certificates for Web PKI


Domain Validation (DV)</p>

DV certificates bind DNS name, issued based on proof of control over domain name</li>
Traditionally it sends a confirm email to administrative contacts list in WHOIS records</li>
ACME protocol (developed by Let's Encrypt) automates this process. It issues a challenge that subscriber must complete to prove control of domain (common challenge include serving random number at given URL(http challenge) or placing random number in DNS TXT record(dns challenge)</li>
</ul>
</li>

Organization Validation (OV), Extended Validation (EV)</p>

These build on DV they bind not just domain name but also legal entity (organization) that controls it.</li>
OV is deprecated in favour of EV</li>
EV process takes long time (days or week), can include physical application</li>
</ul>
</p>
</li>
</ul>
</li>
</ul>
</li>
</ul>
Expiry</h4>

New certificate should be replaced with the expiry cert</li>
For internal PKI, you should use shorter expiry times</li>
For internal PKI, you can automate expiry by requesting new cert (with longer expiry) by giving older cert</li>
</ul>
Revocation</h4>

There are provisions to revoke a compromised certificate, but acceptance by relying parties are not uniform</li>
To revoke you can add in Certificate Revocation List (CRLs) or Online Certificate Signing Protocol (OCSP)</li>
</ul>
Sources</h2>

https://smallstep.com/blog/everything-pki/</li>
</ul>
Related</h2>

certificate-management-using-step-cli</a></li>
openssl</a></li>
data-encoding#base64</a></li>
totp</a></li>
</ul>


Claude code Workflow
2026-08-19T00:00:00+00:00
Potential use cases</h3>

Implement features</li>
Refactor this subsystem</li>
Research this library</li>
Set up this service</li>
Write tests, run them, fix failures</li>
Compare approaches , and propose a plan</li>
Troubleshoot issues and fix them</li>
</ul>
Tips</h3>

Always use better model for planing: Opus > Sonnet.</li>
If you’re working with some data, first run do some data sanity runs (with ai) and resolve inconsistencies before proceeding with plan.</li>
</ul>
Skills/Tools</h3>

Caveman</a></li>
spec-kit</a></li>
For larger features, enable  CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS=1

1 reviewer agent</li>
1 QE agent writes tests</li>
</ul>
</li>
diffity</a></li>
</ul>
Sources</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


Containers
2026-08-19T00:00:00+00:00
Source</strong>:</p>
What?</h3>

container is a group of linux processes running isolated in separate namespace</li>
</ul>
Simple container in bash</h3>
(Only works on linux) bit.ly/containers-arent-magic</a></p>
#</span></span> download the image</span>
</span></span>wget</span></span> bit.ly/fish-container -</span>O</span> fish.tar</span>
</span>
</span>mkdir</span></span> container-root</span>;</span> cd</span></span> container-root</span>
</span>
</span>#</span></span> unpack image to directory</span>
</span></span>tar</span></span> -</span>xf</span> ../fish.tar</span>
</span>
</span>#</span></span> generate random cgroup name</span>
</span></span>cgroup_id</span>=</span>"</span>cgroup_$</span>(</span>shuf</span></span> -</span>i</span> 1000-2000 -</span>n</span> 1</span>)</span></span>"</span></span></span>
</span>
</span>#</span></span> make a cgroup & set CPU/mem limits</span>
</span></span>cgcreate</span></span> -</span>g</span> "</span>cpu,cpuacct,memory:$</span>cgroup_id</span></span>"</span></span></span>
</span>cgset</span></span> -</span>r</span> cpu.shares=512 "</span>$</span>cgroup_id</span></span>"</span></span></span>
</span>cgset</span></span> -</span>r</span> memory.limit_in_bytes=1000000000 "</span>$</span>cgroup_id</span></span>"</span></span></span>
</span>
</span>#</span></span> use the cgroup</span>
</span></span>#</span></span> make + use some namespaces</span>
</span></span>#</span></span> change root dir</span>
</span></span>#</span></span> use the right /proc</span>
</span></span>#</span></span> change hostname</span>
</span></span>#</span></span> & start fish</span>
</span></span>cgexec</span></span> -</span>g</span> "</span>cpu,cpuacct,memory:$</span>cgroup_id</span></span>"</span></span> \
</span></span></span>  unshare -</span>fmuipn</span> --</span>mount-proc</span> \
</span></span></span>  chroot "</span>$</span>PWD</span></span>"</span></span> \
</span></span></span>  /bin/sh -</span>c</span> "</span>/bin/mount -t proc proc /proc && hostname container-fun-times && /usr/bin/fish"</span></span></span>
</span></code></pre>
Image</h3>

Image is a tarball of a filesystem</li>
</ul>
</p>


Image can have multiple layers (to save common files from being downloaded again)</p>
</li>

Each layer is a directory of files</p>
</li>

Writes, when the container is run, goes to a temporary layer (which get's deleted when container is stopped, so to persist writes you need to mount a volume from outside)</p>
</li>

Overlay filesystems</p>

Linux supports a filesystem comprising of different layers, known as Overlay Filesystem</li>
How it works?</li>
</ul>
#</span></span> lowerdir list of all readonly dirs</span>
</span></span>#</span></span> upperdir list of dir where writes should go</span>
</span></span>#</span></span> workdir internal use, empty</span>
</span></span>#</span></span> /merged target merged directory</span>
</span></span>mount</span></span> -</span>t</span> overlay overlay -</span>o</span> lowerdir=/lower,upperdir=/upper,workdir=/work \
</span></span></span> /merged</span>
</span></code></pre>
</li>
</ul>
Container Registry</h3>

It's a HTTP server which serves images</li>
It lets you download only layers you need</li>
</ul>
Linux kernel features which make containers work</h3>
pivot_root</h4>

set's process's root directory to directory which contains image files</li>
chroot, which is typically used to change the root directory, is less secure, because original files are still there (you can access if you're root)</li>
containers generally use pivot_root</code> instead. with this you can unmount old filesystem, so it's impossible to access them</li>
</ul>
cgroups</h4>

One problem with traditional systems, is if you club different application in a instance, one application could end up using all resources thus throttling the other.</li>
cgroup is a group of process, all process in a container belong to same cgroup</li>
cgroup can have memory/CPU limits per group (all process in a container share those resources)</li>
If a process uses more memory then limit, it's OOM killed</li>
If a process uses more CPU then limit, it's throttled</li>
cgroups track these resources /sys/fs/cgroup</code></li>
</ul>
namespaces</h4>


Is how you isolate the containers from the host</p>
</li>

Default namespace (host) is where things run outside a container</p>
</li>

Each process can have any combination of namespaces (eg, using host network namespace but it's own mount namespaces)</p>
</li>

To list namespaces for a process (lsns -p <PID></code>) or (ls -l /proc/<PID>/ns</code> )</p>
</li>

How to create namespace</p>

Child processes inherit the namespace from it's parent</li>
Tools</li>
</ul>
#</span></span> run in new network namespace</span>
</span></span>unshare</span></span> --</span>net</span> COMMAND</span>
</span>
</span>#</span></span> list all namespaces</span>
</span></span>sudo</span></span> lsns -</span>p</span> <</span>PID></span> or ls -</span>l</span> /proc/PID/ns</span>
</span>
</span>#</span></span> run a command in PID's ns</span>
</span></span>nsenter</span></span> -</span>t</span> PID --</span>all</span> COMMAND</span>
</span></code></pre>
</li>

Different types of namespace (each ns has a man page, eg, man network_namespaces</code>)</p>
</li>
</ul>
pid</h5>

same process has different PIDs in different ns</li>
</ul>
</p>

if PID 1 gets killed, every process in the ns is killed</li>
</ul>
user</h5>

it's a security feature, where you can map root user inside container to unprivileged user in host</li>
in user namespace, UIDs are mapped to host UIDs, unmapped users are shown as nobody</code></li>
</ul>
network</h5>

created by</li>
</ul>
ip netns add <name>
</span></code></pre>

has separate virtual interfaces for containers (usually two, loopback & normal)</li>
physical network card is in host network namespace</li>
other namespaces are connected to the host via bridge</li>
containers are assigned private IPs</li>
cloud providers have systems to make containers IPs work ("elastic network interface")</li>
</ul>
capabilities</h4>

process needs to have capabilities (in addition of being root) to get work done</li>
check</li>
</ul>
man capabilities
</span></code></pre>

CAP_SYS_ADMIN</code> is like admin</li>
CAP_NET_ADMIN</code> allow changes to network settings</li>
list capabilities for a PID</li>
</ul>
getpcaps PID
</span></code></pre>

getcap</code> / setcap</code> system calls to set/get capabilities</li>
</ul>
seccomp-bpf</h4>

used to block certain system calls that process can execute (docker does this)</li>
seccomp-bpf lets you run a function before each system call</li>
this function decides if the sys call is allowed</li>
you can set a whitelist for a process</li>
</ul>
Things you can configure while starting a container</h3>

map a port inside container to the host</li>
mount directories from the host</li>
set capabilities</li>
add seccomp-bpf filters</li>
set memory & CPU limits</li>
use host network namespace</li>
</ul>
Container security</h3>
Containers are advisable only for trusted workloads. Security failure in containers happen due to following:</p>
Mis configuration</h4>

Running as privileged containers, effectively removes all guard rails. It basically runs as root.</li>
Mounting docker socket in containers (/var/run/docker.socket</code>), allows it to create privileged containers, hence gives access to root.</li>
Writable sys and /proc/sys, these expose kernel controls</li>
Writable dir, bind mounted inside containers.</li>
Adding broad capabilities, eg CAP_SYS_ADMIN</code></li>
Joining host namespaces, eg --pid=host</code> or --net=host</code></li>
Device passthrough (for eg like gpu), can expose raw kernel interfaces.</li>
</ul>
Shared host kernel</h4>
Containers share the same kernel as host. Even if there's no misconfiguration, any kernel bug in the allowed syscalls, filesystem path or netstack behaviour can be triggered from inside the container. For eg, ioctl syscall has huge attack surface.</p>
Apart from misconfiguration and kernel bugs, bugs in container runtime also impact security.</p>
Questions</h2>

</li>
</ul>
Related</h2>

container-networking</a></li>
</ul>


Docker Multiarch Images
2026-08-19T00:00:00+00:00
Docker image is specific for os + host architecture (eg linux + arm64 or linux + amd64).</p>
 $ docker image inspect miniflux/miniflux | jq '.[] | "\(.Os)\/\(.Architecture)"'
</span>"linux/arm64"
</span></code></pre>
Same image can be built for different architectures. Running non multi arch image on incorrect platform will fail. Docker pulls correct image from registry based on os/arch set in docker engine.</p>
$ docker version
</span>  OS/Arch:          linux/arm64
</span></code></pre>
Image listing on dockerhub generally shows if it's a multiarch image (os/arch) for each tag.</p>
Image manifests files contains all individual multi arch images links. This is part of docker/OCI  registry spec.</p>
$ docker manifest inspect alpine:latest
</span>{
</span>   "schemaVersion": 2,
</span>   "mediaType": "application/vnd.oci.image.index.v1+json",
</span>   "manifests": [
</span>      {
</span>         "mediaType": "application/vnd.oci.image.manifest.v1+json",
</span>         "size": 1022,
</span>         "digest": "sha256:59855d3dceb3ae53991193bd03301e082b2a7faa56a514b03527ae0ec2ce3a95",
</span>         "platform": {
</span>            "architecture": "amd64",
</span>            "os": "linux"
</span>         }
</span>      },
</span>
</span></code></pre>
Pulling alpine:latest</code> in this case will fetch the image mainfest file, it then matches the local os/arch and pulls the corresponding image sha. Image spec contains individual layers, which are pulled next.</p>
$ docker image inspect alpine:latest
</span>
</span>        "RootFS": {
</span>            "Type": "layers",
</span>            "Layers": [
</span>                "sha256:0b83d017db6efafadf6b3f18d087d2ce1d67d8f0e927dc7254b0ad088074cd3a",
</span>                "sha256:1c2824e33c7138199cf5b48c29289ceb30179b427bf1cee68cf2f502b537ae82",
</span>                "sha256:f19172968839067b8298f671f9d192997f1e8cc7b79604b4df72793197668477"
</span>            ]
</span>        },
</span></code></pre>
Non multiarch images manifest just link a single image.</p>
Build</h3>
To build a multi arch image, you can build and push the image separately for each arch on a build farm (set of machines with different arch). Each of these image exists as a separate manifest. Finally create a common manifest file linking all previous images, and push that to registry.</p>
$ docker manifest create alpine:latest alpine:arm64-latest alpine:amd64-latest
</span>$ docker manifest push alpine:latest
</span></code></pre>
In dockerfile, if base image is multi arch, you don't need to do anything else. It should pull correct image and build your app for correct platform. If, however, base is not multi arch, you need to create and maintain separate dockerfile for each architecture.</p>
In recent docker (with buildx), you can run:</p>
$ docker build --platform linux/amd64, linux/arm64 image .
</span></code></pre>
to automate all these separate steps, i.e, building and pushing individual images and creating manifest.</p>
It requires emulation via qemu, that must be separately configured.</p>
Sources</h2>

https://www.youtube.com/watch?v=cDJrQ4IzZ_M</li>
</ul>
Questions</h2>

Explore qemu emulation and binfmt_misc #question</li>
</ul>
Related</h2>

containers#Image</a></li>
</ul>


Common git commands
2026-08-19T00:00:00+00:00
List Remotes</h3>
git remote -v
</span></code></pre>
Add remote</h3>
git remote add <name> <url>
</span></code></pre>
Show current head</h3>
Used in scripting:</p>
git rev-parse HEAD
</span></code></pre>
Visualize history as DAG</h3>
git log --all --graph --decorate
</span></code></pre>
Interactive staging</h3>
git add -p .
</span></code></pre>
Note: this doesn't consider untracked changes (new files not added yet). To add them:</p>
git add -N .
</span></code></pre>
-N</code> = --intent-to-add</code></p>
Interactive rebase</h3>
Used for squashing commits:</p>
git rebase -i origin main
</span></code></pre>
# Commands:
</span># p, pick <commit> = use commit
</span># r, reword <commit> = use commit, but edit the commit message
</span># e, edit <commit> = use commit, but stop for amending
</span># s, squash <commit> = use commit, but meld into previous commit
</span></code></pre>


Git's data model as psuedo code
2026-08-19T00:00:00+00:00
type blob = array<byte>
</span>
</span>// name of file/dir => it's contents
</span>type tree = map<string, tree | blob>
</span>
</span>// commits can have multiple parents, and top level tree
</span>type commit = struct {
</span>  parent: array<commit>
</span>  author: string
</span>  message: string
</span>  snapshot: tree
</span>}
</span>
</span>// all blob/tree/commit are unified as objs
</span>type object = blob | tree | commit
</span>
</span>// all objs are hashed and stored. key is the hash
</span>objects = map<string, object>
</span>
</span>def store(object):
</span>  id = sha1(object)
</span>  objects[id] = object
</span>
</span>def load(id):
</span>  return objects[id]
</span>
</span>// human readable name (eg, master) => objects hash
</span>references = map<string, string>
</span>
</span>def update_reference(name, id):
</span>  references[name] = id
</span>
</span>def read_reference(name):
</span>  return references[name]
</span>
</span>def load_reference(name_or_id):
</span>  if name_or_id in references:
</span>    return load(references[name_or_id])
</span>  else:
</span>    return load(name_or_id)
</span></code></pre>

All folders are tree in git</li>
All files are blobs</li>
Commit is like snapshot of all files. They can be linked with multiple parents, which forms history.</li>
All blobs/tree/commits are represented as objects</li>
All objects are represented by SHA-1 hash of it's content, so it's easy to know when files change.</li>
References then are human readable translation of hash of these objects (eg master/feature-fix-auth)</li>
HEAD</code> is a reference of latest/current commit sha in the project</li>
All git objects except references are immutable (all that you do with destructive commands like reset —hard</code> is just point to different references). Thus it's hard to lose any data in git.</li>
Git objects and references defines all the data inside git dir</li>
All git commands does is manipulate this DAG by adding objects, adding/updating references</li>
Use command: git cat-file -p <hash></code> to decode and print what git obj with hash contains</li>
Staged / Unstaged changes

When you make any change, git will show the change made, but this change is not yet tracked (ie, you can lose the changes)</li>
To track the changes with git, you've add them by git add <files></code> . This stores all these changes in index (which is like a tree and keeps track of all changes added)</li>
On commit, git uses this index to create current snapshot of project</li>
</ul>
</li>
Three ways git merge

Checkout branch b</code> from master, update a file and commit. Checkout back to master. What happens when you run git merge b</code>

Git checks two commits of refs master</code> & b</code> and sees one is a parent of other, it just updates master</code> to new commit & calls it a day</li>
</ul>
</li>
Checkout b</code> , update a file foo.txt</code>, while in a separate flow, master also updates file bar.txt</code>

Git now sees two different commits, it traces back in history to a common commit. Checks what changed in these two new commits. Since changes are in separate files. It creates a new commit, with all changes, and sets the parent as the two commits.</li>
</ul>
</li>
Update same file as in master

Follow steps similar as above, but now it sees that commits in question have conflicting changes. It seeks developer assistance in resolving it, instead of being over smart.</li>
</ul>
</li>
</ul>
</li>
</ul>
Sources</h2>

https://missing.csail.mit.edu/2026/version-control/</li>
</ul>


Merge Strategies
2026-08-19T00:00:00+00:00
If there're too many conflicts, and you just want to either accept our/their code, you can use flag -X theirs</code> or -X ours</code> with all git commands doing either merge/rebase.</p>
Currently on</th> Command</th> Strategy</th> Outcome</th></tr></thead>

master</td> git merge feature</td> -Xtheirs</strong></td> Keep changes from feature branch</td></tr>
master</td> git merge feature</td> -Xours</strong></td> keep changes from master branch</td></tr>
feature</td> git rebase master</td> -Xtheirs</strong></td> Keep changes from feature branch</td></tr>
feature</td> git rebase master</td> -Xours</strong></td> keep changes from master branch</td></tr>
</tbody></table>


Oh shit git!
2026-08-19T00:00:00+00:00
I committed but forgot to make a small change/wrong commit message</h3>
git</span></span> add .</span>
</span>git</span></span> commit --</span>amend</span> --</span>no-edit</span></span>
</span></code></pre>
Accidentally committed to master, when it should've been to new branch</h3>
git</span></span> branch new-branch</span>
</span>
</span>#</span></span> removes last commit from master</span>
</span></span>git</span></span> reset HEAD~</span></span> --</span>hard</span></span>
</span>
</span>#</span></span> this branch still contains the commit though!</span>
</span></span>git</span></span> checkout new-branch</span>
</span></code></pre>
Accidentally committed to wrong branch</h3>
git</span></span> checkout correct-branch</span>
</span>
</span>#</span></span> get the last commit to master</span>
</span></span>git</span></span> cherry-pick master</span>
</span>
</span>git</span></span> checkout master</span>
</span>git</span></span> reset HEAD~</span></span> --</span>hard</span></span>
</span>
</span></code></pre>
Undo a commit from like 5 commits ago</h3>
#</span></span> find the commit</span>
</span></span>git</span></span> log</span>
</span>
</span>git</span></span> revert <</span>hash></span>
</span></span></code></pre>
Undo my changes to a file</h3>
#</span></span> find hash before the file was changed</span>
</span></span>git</span></span> log</span>
</span>
</span>#</span></span> set's old version in index</span>
</span></span>git</span></span> checkout <</span>hash></span> -</span>- <</span>path/to/file></span>
</span></span>
</span>git</span></span> commit -</span>m</span> "</span>you can do this smartly too"</span></span></span>
</span></code></pre>
Related</h2>

</li>
</ul>


Go build
2026-08-19T00:00:00+00:00
Cross compilation</h3>
env GOOS=target-OS GOARCH=target-architecture go build package-import-path
</span></code></pre>
where target-os can be: linux, darwin, android, windows, freebsd, netbsd, openbsd, dragonfly, plan9</code>

where target-architecture can be: arm, arm64, amd64</code></p>
Static build</h3>
Using static build, go skips linking to libc/musl libraries. Instead implements it's own library calling syscall directly.</p>
CGO_ENABLED=0 go build -a -ldflags '-extldflags "-static"' .
</span></code></pre>
Go always builds binaries with versioning</h3>
If you run go build from a git repository, it versions the binary by default.</p>
$ go version -m gmail2gullak | grep vcs
</span>        build   vcs=git
</span>        build   vcs.revision=a952a27dab46dfe460bb209a9b39a1bae6b15ffd
</span>        build   vcs.time=2026-04-24T12:08:34Z
</span>        
</span>$ go version gmail2gullak
</span>gmail2gullak: go1.25.0
</span></code></pre>
This also prints which go toolchain was used to build the binary.</p>
Sources</h2>

</li>
</ul>
Questions</h2>

</li>
</ul>
Related</h2>

go-compilation-tools</a></li>
</ul>


Go compilation tools
2026-08-19T00:00:00+00:00
Source</strong>: https://www.youtube.com/watch?v=qPIB3STWXVk</p>
Flow</h3>
flowchart TD;
</span>A[*.go]--> |Compiler| B[*.a];
</span>B--> C[Linker];
</span>C--> D[Binary];
</span></code></pre>
If go files are unmodified, there's no need to compile them again. This makes rebuild faster.</p>
Compilation</h3>
flowchart TD;
</span>A[Code]--> |Lexing & Parsing| B[AST];
</span>B--> |Transformations on AST| C[SSA];
</span>C--> |Optimizations| D[Machine code];
</span></code></pre>
SSA is platform agnostic</p>
go build flags</h3>

-a</code> = force rebuild after clearing cache</li>
-v</code> = shows list of packages used in the build</li>
-x</code> = shows internal tooling invocation</li>
-n</code> = same as -x</code> but dry run options, just shows the plan what will be done</li>
-work</code> = print and keep the work dir (where all intermediate artifacts are stored)</li>
</ul>
Explore compilation internal steps</h3>
GOSSAFUNC=main go build -a # generates ssa html for going into depth 
</span></code></pre>
This is fun interactive way to check the intermediate compilation steps.</p>
Compiler flags</h3>


-gcflags="-S"</code> = shows intermediate assembly</p>

This is different from platform specifc assembly, if you want to see platform specific code:</li>
</ul>
go tool objdump -S main.main <bin_name>
</span></code></pre>
</li>

-gcflags="-N"</code> = disable compiler optimization</p>
</li>

-gcflags="-m"</code> = shows escape analysis (explains what goes in heap vs stack) -m=2</code> for verbose, useful to see how much garbage is generated</p>
</li>

-gcflags="-live"</code> = shows liveness analysis. calculate live variables at each point in program.</p>
</li>

-gcflags="-bench=bench.out"</code> = shows benchmark</p>
</li>

-gcflags="-race"</code> = race detection</p>
</li>

-gcflags="-memprofile=profile.out"</code> = shows memory profile in lifetime of build</p>

Use go tool pprof -http :7070 profile.out</code> to open in webui</li>
</ul>
</li>

-gcflags="-traceprofile=trace.out"</code>= shows execution trace</p>
</li>
</ul>
go list</h2>
Shows meta information about gocode. See docs</a> for all fields available in templating.</p>
List all go files that go in the build</h4>
go list -f {{.GoFiles}} 
</span>
</span>GOOS=windows go list -f {{.GoFiles}} # includes main_windows.go (windows specific files)
</span></code></pre>
nm tool</h2>
Shows all symbols used by the binary. Useful for figuring out dynamic libararies used etc.</p>
go tool nm <binname>
</span></code></pre>
Questions</h2>

While this does go in depth on practical tools, need more indepth understanding of compilation process #question

https://www.youtube.com/watch?v=uTMvKVma5ms&t=10s</li>
</ul>
</li>
Need to explore go runtime as well #question</li>
How does this integrate with gdb and other debuggers ? #question</li>
</ul>
Related</h2>

go-build</a></li>
</ul>


Go HTTP
2026-08-19T00:00:00+00:00
Mux</h2>
func main() {
</span>    mux := http.NewServeMux()
</span>
</span>    mux.HandleFunc("GET /posts",          listPosts)
</span>    mux.HandleFunc("POST /posts",         createPost)
</span>    mux.HandleFunc("GET /posts/{id}",     getPost)
</span>    mux.HandleFunc("PUT /posts/{id}",     updatePost)
</span>    mux.HandleFunc("DELETE /posts/{id}",  deletePost)
</span>
</span>    http.ListenAndServe(":8080", mux)
</span>}
</span></code></pre>
Path values</h3>
mux.HandleFunc("GET /users/{id}", func(w http.ResponseWriter, r *http.Request) {
</span>    id := r.PathValue("id")  // new in 1.22
</span>    fmt.Fprintf(w, "User ID: %s", id)
</span>})
</span></code></pre>
HTTP Middleware</h2>
Pattern</h3>
func exampleMiddleware(next http.Handler) http.Handler {
</span>	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
</span>		// Your middleware logic goes here...
</span>		next.ServeHTTP(w, r)
</span>	})
</span>}
</span>
</span>func fooHandler(w http.ResponseWriter, r *http.Request) {
</span>	w.Write([]byte("foo"))
</span>}
</span>
</span>func main() {
</span>	mux := http.NewServeMux()
</span>	mux.Handle("/foo", exampleMiddleware(http.HandleFunc(fooHandler)))
</span>	
</span>	log.Fatal(http.ListenAndServe(":3000", mux))
</span>}
</span></code></pre>
To add middleware for all routes, add it on http.ServeMux() (since it implements http.Handler interface).</p>
log.Fatal(http.ListenAndServe(":3000", myMiddleware(mux)))
</span></code></pre>
Chain</h3>
type chain []func(http.Handler) http.Handler
</span>
</span>func (c chain) thenFunc(h http.HandlerFunc) http.Handler {
</span>    return c.then(h)
</span>}
</span>
</span>func (c chain) then(h http.Handler) http.Handler {
</span>    for _, mw := range slices.Backward(c) {
</span>        h = mw(h)
</span>    }
</span>    return h
</span>}
</span></code></pre>
Usage:</p>
mux := http.NewServeMux()
</span>
</span>// Create a base middleware chain. 
</span>baseChain := chain{requestID, logRequest}
</span>
</span>// Extend the base chain with auth middleware for admin-only routes.
</span>adminChain := append(baseChain, authenticateUser, requireAdminUser)
</span>
</span>mux.Handle("GET /static/", spaHandler(http.FileServerFS(ui.Files)))
</span>
</span>mux.Handle("GET /", baseChain.thenFunc(home))
</span>mux.Handle("GET /article/{id}", baseChain.thenFunc(showArticle))
</span>
</span>mux.Handle("GET /admin", adminChain.thenFunc(showAdminDashboard))
</span></code></pre>
Use cases</h3>

Check if user is authenticated</li>
Check for headers like Content-Type</code></li>
Implement rate limit logic</li>
Add http headers in response</li>
Log request & response automatically using log/slog</code></li>
</ul>
Sources</h2>

https://www.alexedwards.net/blog/making-and-using-middleware</li>
https://www.alexedwards.net/blog/organize-your-go-middleware-without-dependencies</li>
</ul>
Related</h2>

handling-spa-go</a></li>
</ul>


Golang Language
2026-08-19T00:00:00+00:00
Array, Slices</h2>
Source: https://go.dev/blog/slices</p>

Array is the building block of contingous items, contains size as part of it's definition. eg var buffer [256]byte</code>. Arrays are always fixed size.</li>
Slice is a datastructure which describes a contiguous section of array: var slice []byte = buffer[100:150]</code>. Behind the scenes, it contains the pointer to array, length and capacity (maximum length to which slice can extend).</li>
</ul>
String, Rune, Character, Byte</h2>
Source: https://go.dev/blog/strings</p>

String in golang is slice of bytes</li>
String literals are always utf-8 encoded. (Go source code) eg const nihongo = "日本語"</code></li>
In unicode standard, each character is represented by "code point" eg, U+2318 represents ⌘</code> , in golang this code point is referred as rune (aliased to int32)</li>
When you range through a loop, it decodes 1 utf-8 length rune on each loop</li>
</ul>
Time</h2>

Layout string in time</a>.Parse and time.Format expects this date (reference date): 01/02/2006  Jan 2 15:04:05 2006 MST</code> (Note the date should be this specific date and time for it to parse successfully). Following shows some example:</li>
</ul>
time.Parse("01/02/2006", "10/02/2024")
</span>time.Parse("02 of 01 2006", "02 of 10 2024")
</span></code></pre>
Embed files in binary</h2>

Use embed</code> package to add files to binary at compile time</li>
</ul>
Use local dependency</h2>
To use local version of the dependency, you can clone the deps in dir $DEP, then use replace directive in go mod</p>
$ go mod edit -replace github.com/google/go-cmp=$DEP</code></p>
Import local modules</h2>
Import other packages rather than main package</p>
import (
</span>  "noc-manager/pkg/models"
</span>)
</span></code></pre>
Run go mod edit -replace noc-manager=../../noc-manager</code> to add a local dependency & run go mod tidy</code></p>
Tip: Name modules as simple names rather than git urls unless you're planning on publishing them. Otherwise you might get weird issues.</p>
CommandLine</h2>

After parsing flags you can get other arguments via: flag.Args()</code> (array) or flag.Arg(i)</code> specific arg. flag.Narg</code> = number of args</li>
</ul>
Run debugger</h2>
$ go install github.com/go-delve/delve/cmd/dlv@latest
</span>
</span>// in root dir
</span>$ dlv debug
</span></code></pre>
Sql</h2>

For database sql, checkout this wiki</a></li>
</ul>
Slog</h2>
slog.Info(msg, k1, v1, k2, v2)
</span></code></pre>
Log consists of log level, message, and key value pairs (it is assumed that key will follow value in above example).</p>
Levels</h4>
Some common levels include Info, Warn, Debug, Error. But since, log levels are integers, you can define your own custom levels.</p>
Handlers</h4>
logger := slog.NewTextHandler()
</span>logger.Info(msg, user, os.Getenv(USER))
</span></code></pre>
slog supports multiple handlers, you can even write your own custom handler. Some common handlers include:</p>

slog.NewTextHandler (prints key=value in text)</li>
slog.NewJSONHandler (prints key value in json)</li>
</ul>
Out of Box, if you don't use specific handler, it uses default Logger instance.</p>

For more info, checkout docs: slog</a></li>
</ul>
ToString equivalent</h2>
type Transaction struct {
</span>  Amount          float64 `json:"amount"`
</span>  Description     string  `json:"description"`
</span>  TransactionDate string  `json:"transaction_date"`
</span>}
</span>
</span>func (t Transaction) String() string {
</span>  return fmt.Sprintf("Amount: %f, Description: %s, Date: %s", t.Amount, t.Description, t.TransactionDate)
</span>}
</span></code></pre>
Regexp</h2>
package main
</span>
</span>import (
</span>	"fmt"
</span>	"regexp"
</span>)
</span>
</span>func main() {
</span>	re := regexp.MustCompile(`Rs\.(\d+(?:\.\d+)?) has been debited`)
</span>	fmt.Printf("%q\n", re.FindStringSubmatch("Dear Customer, Rs.396.00 has been debited from account"))
</span>}
</span>
</span>["Rs.396.00 has been debited" "396.00"]
</span></code></pre>
Get error in string</h2>
s := err.Error()
</span></code></pre>
JSON or YAML omitempty or ignore</h2>
type T struct {
</span>    F int `yaml:"a,omitempty"`
</span>    B int `yaml:"-"` // this field will be ignored from rendering
</span>}
</span></code></pre>
type T struct {
</span>    F int `json:"a,omitempty"`
</span>    B int `json:"-"` // this field will be ignored from rendering
</span>}
</span></code></pre>
Json Encoder/Decoder</h2>
encodings/json</code> package has Encoder/Decoder, can be used as:</p>
err := json.NewDecoder(resp.Body).Decode(&var)
</span></code></pre>
it accepts any input which implements interfaces io.Reader or io.Writer (basically streaming data). Some core data sources which implement it are:</p>

os.File (read from file on disk)</li>
strings.Reader (allows to read string)</li>
http.Response.Body (http response)</li>
bytes.Buffer (similar to string, in memory buffer)</li>
net.Conn (allows reading from socket, tcp or udp)</li>
</ul>
Sources</h2>

</li>
</ul>
Related</h2>

</li>
</ul>


Go project layout
2026-08-19T00:00:00+00:00
Project Layout</h3>
Code is structured in golang using files, packages & modules</strong>. Each new dir indicates a new package.</p>
Only create a new package if you see demonstrable need for it. It's okay for files to be longer. Focus should be on reusability. Package should be standalone, isolated and should enforce boundaries with other code.</p>
Simple</h4>
├── main.go
</span>├── foo.go
</span>├── bar.go
</span>├── go.mod
</span>└── README.md
</span></code></pre>
Small with supporting packages</h4>
├── internal
</span>│   └── foo
</span>│       └── foo.go
</span>├── main.go
</span>├── bar.go
</span>├── go.mod
</span>└── README.md
</span></code></pre>
Large</h4>
Consists of lots of non go assets (eg templates, database migration etc). Also multiple binaries like (server, client etc).</p>
├── cmd
</span>│   └── foo
</span>│       ├── main.go
</span>│       └── bar.go
</span>├── internal
</span>│   └── baz
</span>│       └── baz.go
</span>├── go.mod
</span>├── Makefile
</span>└── README.md
</span></code></pre>
Sources</h2>

https://www.alexedwards.net/blog/11-tips-for-structuring-your-go-projects</li>
</ul>
Related</h2>

go-language</a></li>
</ul>


Fixing 404s When Serving SPA from a Go Binary
2026-08-19T00:00:00+00:00
This is a sample go code I was using to host frontend UI directly from golang:</p>
//go:embed ui/dist/*
</span>var frontendFS embed.FS
</span>
</span>func main() {
</span>	distFS, err := fs.Sub(frontendFS, "ui/dist")
</span>	if err != nil {
</span>		log.Fatal(err)
</span>	}
</span>
</span>	frontendHandler := http.FileServer(http.FS(distFS))
</span>
</span>	http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
</span>		frontendHandler.ServeHTTP(w, r)
</span>	})
</span>
</span>	log.Printf("listening on: localhost:9876")
</span>	log.Fatal(http.ListenAndServe(":9876", nil))
</span>}
</span></code></pre>
For the frontend, I was using Vue.js (I don't have much experience in frontend), which compiles everything after npm run build</code> into ui/dist</code>.</p>
We then embed ui/dist/</code> directory in go binary. And finally, we use http.FileServer</code>  to serve files from the go server, which defaults to serving ui/dist/index.html</code>.</p>
I wanted the Vue.js framework to handle /custom</code> URL path, to show a different page. I had implemented UI changes, and they were working fine when tested separately. But when accessing them via go server, I was getting 404 page not found</code>.</p>
After little bit of fiddling, I figured out it was because http.FileServer</code> was trying to serve a file called custom</code> and when it couldn't find, it returned 404.</p>
The fix was to serve index.html</code> for any path where file doesn't exist and let Vue handle the routing:</p>

</span>	  indexHTML, err := fs.ReadFile(distFS, "index.html")
</span>	  if err != nil {
</span>		  log.Fatal(err)
</span>	  }
</span>	  
</span>    // serve index.html for any path that does not exists
</span>    // and let vue handle the routing
</span>    _, err = distFS.Open(path)
</span>    if err != nil {
</span>			w.Header().Set("Content-Type", "text/html; charset=utf-8")
</span>			if _, err := w.Write(indexHTML); err != nil {
</span>				log.Printf("failed to write index.html fallback: %v", err)
</span>			}
</span>			return
</span>    }
</span>
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

go-http</a></li>
</ul>


Performance benchmark
2026-08-19T00:00:00+00:00
Source</strong>:</p>

https://it-notes.dragas.net/2025/09/19/freebsd-vs-smartos-whos-faster-for-jails-zones-bhyve/</li>
https://manpages.debian.org/testing/sysbench/sysbench.1.en.html</li>
</ul>
CPU performance</h2>
sysbench --test=cpu --cpu-max-prime=20000 run
</span></code></pre>
Memory performance</h2>
sysbench --test=memory run
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


Silicon Transistor Gallium
2026-08-19T00:00:00+00:00
Silicon, semi-conductor</h3>
Silicon is a semi conductor, something in between a conductor (like metal) or insulator (like rubber). Pure silicon doesn't conduct electricity. However, when you can add some impurities, i.e, tiny amounts of other elements, it starts conducting electricity, this is known as doping</strong>.</p>
N type (N for negative), adds tiny amount of phosphorus. This creates some free electrons.</p>
P type (P for positive), adds tiny amount of boron. This creates extra holes (positive).</p>
If you bring these together, some electrons from N type flow to holes in P type at the junction.</p>
Transistor</h3>
Transistors are switch or amplifiers. A small current from emitter to base, drives a big current from emitter to collector.</p>
</p>
</p>
How it works</h4>

When you sandwich NPN silicon together, some electrons from the N type side neutralises holes in P type at the junction, this is known as depletion region</strong>.</li>
Since, N side loses electrons, it becomes positively charged and base becomes negatively charged.</li>
Things stabilises after a bit, and no current flows through. Transistor is said to be in switched off state, even if there is potential difference ( the battery in Emitter to Collector circuit).</li>
When you apply small current or ~0.7 V between emitter and base. Extra electrons enter emitter side, this shrinks the depletion region between emitter and base.</li>
However, because of positively charged collector, most of these electrons move to collector directly, rather than moving out of base (99%). This switches on the transistor.</li>
This is helped by the fact that emitters are heavily doped (more free electrons) and base is very thin.</li>
</ul>
Silicon ceiling, gallium</h3>
Electrons exists in 2 different states:</p>

Locked in bonds that tie atom together, this is known as valence band</li>
Others are free to move around, known as conduction band</li>
</ul>
Band gap is the energy an electron requies in valence band to jump over to conduction band. For silicon, this is 1.1 electron volts (eV).</p>
With technical advancements, we can now place billions of transistor in a small chip in your iphone. This leads to increased heat, and it's becomes feasible to jump the bands. After 150° C, silicon stops being a reliable switch.</p>
In general for traditional computing, you work around this constraint, by adding cooling fans etc.</p>
But there're are cases like 5G base stations, which has to constantly transmit at 3 GHz frequencies, sometimes to 30 GHz for millimeter wave 5G. Silicon based chips struggle beyond 5 GHz, so the quality of stations degrade.</p>
Enter gallium, gallium by itself, is not a semi conductor. But, Gallium Arsenide & Gallium Nitride has some interesting electronic properties. Gallium Arsenide (GaAs) has bandgap of 3.4 eV. It can operate till a temperature of 400° C. Also it switches faster than silicon based chip. This leads to less energy waste as heat, and needs less cooling.</p>
Sources</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


Trusted Platform Module (TPM)
2026-08-19T00:00:00+00:00
TPM is a secure crypto processor on the motherboard. Used for</p>

verifying that the boot process starts from trusted combination of hardware and software</li>
storing disk encryption keys</li>
provides hardware random number generator KASLR (Kernel Address Space Layout Randomisation)</a></li>
secure generation of cryptographic keys</li>
</ul>
It creates a unforgeable hash key summary of hardware & software configuration. Sealed storage protects the private info by binding it to the platform with this hash key. This is used for DRM enforcement. drm</a></p>
UEFI can use TPM to form root of trust.</p>
Sources</h2>

</li>
</ul>
Related</h2>

booting-linux-on-x86-64</a></li>
</ul>


Common Commands
2026-08-19T00:00:00+00:00
whoami</h3>
kubectl auth whoami
</span></code></pre>
Sources</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


Booting Linux on x86_64
2026-08-19T00:00:00+00:00
When you power on a PC, a intricate handshake happens between several programs and literal CPU before you see the familiar screen.</p>
When power stabilises, CPU does a reset into a 16 bit real mode. Real mode is for backward compatibility to mimic older 8086 chip. All x86 processors (intel, amd etc) do this.</p>
CPU then jumps to reset vector at location: 0xFFFFFFF0 (special hardcode address). This is hardwired so every time a CPU resets, it always start here, like a permanent bookmark. This contains far jump to firmware on motherboard.</p>
BIOS/UEFI</h3>
Firmware is software baked into the board. Stored on read only chip on motherboard.</p>
BIOS (Basic Input Output System) is the firmware, manufacture developed primitive software, which does:</p>

health check via POST (Power On Self Test), makes sure all critical hardware is working before booting into OS</li>
If there are any problems at this stage, machine beeps</li>
Looks at the boot order, and tries to load 1st stage boot.

Any disk whose first sector (512 bytes), ends with 0x55 0xAA (magic bytes) is considered bootable (MBR).</li>
GUID Partition table (GPT for UEFI)</li>
Net booting (for PXE)</li>
</ul>
</li>
Copies that sector to memory at 0x7C00 address and jumps there.</li>
</ul>
1 sector (512 bytes) boot loader is tiny, and it only knows how to load 2nd stage boot loader.</p>
UEFI</h3>
uefi</a> is a modern firmware, overcomes the limitation of multi stage boot loading. It understand filesystems (FAT32) and can directly load bigger programs (can technically boot kernel without boot loader) without the limitation of 512 bytes. It can pass richer info to OS.</p>
UEFI also handles the steps of setup program below:</p>

Setup GDT, IDT, switch to protected mode</li>
Setup paging</li>
Switching to long mode</li>
</ul>
SME</h3>
Some AMD CPUs has encrypt RAM feature called Secure Memory Encryption.</p>
Segment & Offset</h3>
physical address = (segment << 4) + offset
</span></code></pre>
Grub</h3>
Grub boot loader understands filesystems, it loads the kernel into memory. Kernel file consists of:</p>

Small setup program, which runs in real mode (only in x86_64, non UEFI, for switching cpu from real -> protected -> long mode)</li>
Larger compressed kernel</li>
</ul>
Grub fills up setup headers like:</p>

Where kernel is placed</li>
Where command line lives</li>
Where is init rd etc</li>
</ul>
Finally it jumps to the setup program.</p>
Interrupts</h3>
Interrupts can be hardware or software for handling real time events. On interrupt, CPU pauses the work and runs then handler in Interrupt Descriptor Table (IDT). Examples include, when key is pressed etc. It can be maskable, meaning temporary blocked to prevent firing during delicate moments. And Non Maskable (NMI) which always interrupt, it can indicate serious hardware issues. If you don't have handler entry in IDT, handler lookup fails, CPU gives up (triple fault) and resets silently.</p>
CPU control registers</h3>

CR0

Turns on the protected mode</li>
</ul>
</li>
CR3

Holds the address of top of page table</li>
</ul>
</li>
CR4

Enables extended features, for larger page table.</li>
</ul>
</li>
EFER

Switch to long mode</li>
</ul>
</li>
</ul>
Setup Program</h3>
Setup program, first creates a predictable workspace:</p>

Lines up segment registers, so memory copy behave the same way every time. It also sets "direction flag" CPU bit, so copy instructions auto moves the pointer forward through memory.</li>
Creates stack, LIFO workbench, where functions store data temporarily. SS says which segment the stack uses and SP points to the top of the stack.</li>
Clears BSS (where global variables reside), C code ensures that global variable will be initialised to zero. So it sets that area to 0.</li>
Programs serial port to print early message, before graphics is setup</li>
Asks firmware for usable and reserved RAM ranges (there can be holes). On old BIOS this call is nick named e820.</li>
Finally it calls the first c function literally called main.</li>
</ul>
Protected mode</h4>
Modern linux runs in long mode: 64 bit in x86_64. But you can't go directly to that, you first transition from 32 bit real mode to 32 bit protected mode, finally to long mode.</p>
Protected mode consists of following ideas:</p>

Global Descriptor Table (GDT): list of segments with descriptions, for eg a segment starts here, covers this much and allowed to do these.</li>
Interrupt Descriptor Table (IDT), aka phone numbers for emergency, when a interrupt arrives, CPU looks up entry in IDT for handler to call.</li>
</ul>
Here's how setup program switches CPU into protected mode:</p>

Disables maskable interrupts, other than what's needed</li>
Loads the tiny GDT & IDT</li>
Sets single bit PE in control register, CR0.</li>
Does a far jump. That jump reloads code segment from GDT, and locks it into protected mode. It reloads the data & stack segments.
We're now in protected mode.</li>
</ul>
Paging</h3>
Finally we need to enable paging before we can switch to long mode.</p>
Programs use virtual address, while hardware reads and writes physical address. A page table translates virtual address into physical address, in fixed size chunks call pages. A typical page size is 4KB, earlier boot uses larger 2MB pages to layout low memory quickly.</p>
Initially, we build a small page table in 32 bit mode, called identity map, which means for this specific region, virtual address equals physical one. So we can flip on paging.</p>
Next it enables PAE bit in CR4 register so larger entries are used and builds a minimal table for lower memory. Writes the address of the top table in CR3. Paging is now ready.</p>
Finally we set LME bit in special register EFER, this switches the CPU in long mode.</p>
ELF</h3>
ELF short for Executable & Linkable Format, is both a file format and a map, which says what chunks are code, data etc and exactly where each chunk wants to live.</p>
Decompressing kernel</h3>
We now have CPU running in 64 bit long mode with paging enabled, and compressed kernel in memory.</p>
Now, 64 bit small stub code takes over. First it figures out where it's running. Early code is linked as if it starts at address 0, it computes it real base at runtime. It relocates itself if it can overlap with uncompressed kernel (with KASLR).</p>
It loads a minimal IDT:</p>

Page fault handler: Page fault happens when CPU can't find the mapping for virtual address, in identity mapped world, handler adds the mapping on the fly.</li>
NMI handler, so it doesn't crash the machine, while we're bringing things up.</li>
</ul>
C func extract_kernel</code> takes over and unpacks the kernel using algorithm it was built with (gzip, xz, zstd, lzo etc).</p>
Kernel itself like other binaries are packaged as ELF file. When bytes are out, decompressor reads the kernel's ELF headers. It copies the chunks to memory where it belongs.</p>
Next it jumps to real kernel start_kernel</code>, and big initialisations begins.</p>
KASLR (Kernel Address Space Layout Randomisation)</h4>
If attacker don't know where the kernel actually lives in memory, a lot of attacks get harder.</p>
If KASLR is enabled, decompressor choses 2 bases at random:</p>

Physical base</li>
Virtual base</li>
</ul>
It first builds a do not touch list, which includes:</p>

decompressor itself</li>
compressed kernel image</li>
initial ram disk</li>
boot params</li>
command line buffers</li>
also includes ranges reserved using memmap=</code> option on command line</li>
</ul>
Scans memory map received earlier from the firmware and finds the ranges where everything can fit. It draws random number using the best early entropy source. On modern CPUs, it's rand</code> instruction on hardware. trusted-platform-module</a></p>
Start Kernel</h3>

verify_cpu</code>, checks long mode support, verifies sse2, validates other cpu features. It fails here, to prevent running 64 bit kernel on 32 bit hardware.</li>
Microcode patching</a></li>
resets the early identity mapped page tables</li>
clears bss, zeros out .bss</code> section</li>
setups KASAN (Kernel Address Sanitizer)</li>
Copies bootloader data into kernel owned structs, to prevent overwriting.</li>
setup_arch()</code>

what can cpu do? Asks the chip directly using CPUID instructions. Dumps the data into boot_cpu_data struct for later lookups, for eg, do we've feature x? Helps in deciding if to use AVX512 memcpy instruction or fall back to slower one.</li>
</ul>
</li>
Cleans up the E820 memory map obtained from firmware. Feeds it into memblock, starts tracking free and reserved ranges, i.e., early memory allocator, before kmalloc or vmalloc.</li>
If earlyprintk=serial,ttyS0</code> command line flag passed, it sets up minimal serial driver.</li>
Collects info about the machine

efi_init() hooks up UEFI runtime services</li>
dmi_setup() firmware tables, describes motherboard, vendor, bios version etc</li>
init_hypervisor_platform()</code> - checks if we're on real hardware or VM. If so, which hypervisor: kvm, xen etc.</li>
</ul>
</li>
</ul>
Multi processors boot</h3>
In case of multiple processor cores, one of the processor is designated as Bootstrap Processor (BSP). It runs the firmware, reset vector, starts kernel. All other cores AP (Application Processor) start later.</p>
Microcode patching</h3>
x86 instructions are interface contract. Internally they get translated into microcode by the decoder, from read only array on CPU die. Microcode internals are proprietary stuff.</p>
Microcodes can be patched, for eg, in case of vulnerabilities like spectre, meltdown etc. You load the patch onto the RAM array first (ROM array are out of touch). When decoder decodes, it'll check the RAM array, and if entry is found, it'll use that.</p>
Patches can be done at two places:</p>

Firmware update automatically takes care of this.</li>
OS patch at early boot, primary channel for end users without updating the firmware.</li>
</ul>
Each physical core has to be patched separately. The patch is prepended to initramfs file.</p>
initramfs = [uncompressed cpio microcode blob] + [compressed cpio rootfs]
</span></code></pre>
It has to be loaded early in the boot (to prevent attacks), at the time when there's no filesystem available. It uses a neat trick of reading the patch prepended to initramfs, available from the boot loader at boot_params.hdr.ramdisk_img</code>.</p>
It can also be loaded later by:</p>
echo 1 > /sys/devices/system/cpu/microcode/reload
</span></code></pre>
but it's risky.</p>
Sources</h2>

https://www.0xkato.xyz/linux-boot/</li>
https://docs.kernel.org/arch/x86/microcode.html</li>
https://internals-for-interns.com/posts/linux-kernel-startup/</li>
</ul>
Related</h2>

wake-on-lan</a></li>
grub</a></li>
initrd</a></li>
anaconda</a></li>
</ul>


Dynamic kernel modules
2026-08-19T00:00:00+00:00
Dynamic Kernel Module Support (DKMS)</h3>
DKMS allows building kernel modules whose source reside outside the kernel source tree.</p>
It auto recompiles all DKMS modules if a new kernel version is installed.</p>
This allows drives to continue working after kernel upgrade. Also allows installation of new drivers on existing system without any need for manual compilation.</p>
Supports rpm & deb packages out of the box.</p>
Akmods (fedora)</h3>
kmod package contains precompiled modules for a kernel version. It doesn't work if the kernel version is different.</p>
Akmods allows rebuilding the modules for a different kernel.</p>
akmodsd</code> daemon starts at the init, and checks if all kmods are present and compatible. It auto rebuilds missing/incompatible kmods, and installs into the running kernel.</p>
Sources</h2>

https://rpmfusion.org/Packaging/KernelModules/Akmods</li>
https://en.wikipedia.org/wiki/Dynamic_Kernel_Module_Support</li>
</ul>
Related</h2>

package-management</a></li>
</ul>


Package Management
2026-08-19T00:00:00+00:00
Debian dpkg</h3>
Debian .deb</code> package is an ar</code> archive consisting of 2-3 nested tar archives, along with maintainer scripts (eg, preinst</code>, postinst</code>, prerm</code>, postrm</code>) which runs arbitrary shell scripts.</p>
# list inventory of packages and their version installed
</span>$ dpkg -l
</span>
</span># List file contents of a package
</span>$ dpkg -L tcpdump
</span>
</span># Reverse lookup, which package provides this file
</span>$ dpkg-query -S /usr/bin/dig
</span></code></pre>
Packaging systems can keep track of dependencies only if all softwares are installed via package management. If for eg, awscli was installed outside package management, dpkg won't know if upgrading python will break awscli.</p>
gpg keys are used to check the signature to validate if package was signed by trusted entity.</p>
Fedora rpm</h3>
# list inventory
</span>$ rpm -qa
</span>
</span>
</span># list content 
</span>$ rpm -ql tcpdump
</span>
</span># verify integrity of a package; if it was modified
</span>$ sudo rpm -V sudo
</span>$ sudo rpm -Va  # all packages
</span></code></pre>
Netbsd vulnerability for packages</h3>
$ pkg_admin -V -v fetch-pkg-vulnerabilities
</span>$ pkg_admin audit
</span></code></pre>
Alpine apk</h3>
APK is both a package manager for alpine and format of package on the disk. It's simple gzipped tarball consisting of control segment, data segment & signature.</p>
# Plain text file with list of packages installed
</span>$ cat /etc/apk/world
</span>
</span># Repository file
</span>$ cat /etc/apk/repositories
</span>
</span># DB of installed packages
</span>$ cat /lib/apk/db/installed
</span></code></pre>

</span># list installed packages
</span>$ apk list --installed
</span>
</span># Full info about a package
</span>$ apk info -a busybox
</span>
</span># Files owned by package
</span>$ apk info -L busybox
</span>
</span># Dependencies of a package
</span>$ apk info -R busybox
</span>
</span># Which package owns a file
</span>$ apk info --who-owns /bin/ls
</span></code></pre>
Sources</h2>

</li>
</ul>
Questions</h2>

</li>
</ul>
Related</h2>

dynamic-kernel-modules</a></li>
</ul>


Terminal
2026-08-19T00:00:00+00:00
Source</strong>:</p>
Terminal is a pair master and slave devices. Slave devices are like dumb clients without any intelligence just relaying what user types to the server and showing back the response.</p>
Now when you type text on the terminal, it's relayed back to master device, which gives the information to program running. There're escape sequences to display text in bold or color, cursor movement etc. When you type Ctrl-C</code> or Ctrl-Z</code> it sends a ascii signal \x03</code> and 26</code>. This is intercepted by kernel (and not userspace program like shell), and it sends SIGINT</code> signal to process group in the terminal.</p>
When the master device starts, it makes this sys call:</p>
syscall.Syscall(
</span>    syscall.SYS_IOCTL,
</span>    tty.Fd(),
</span>    syscall.TIOCSWINSZ,
</span>    uintptr(unsafe.Pointer(&resizeMessage)),
</span>)
</span></code></pre>
this calls the ioctl system call. To check terminal parameters, you can type:</p>
stty -a
</span>
</span>or
</span>
</span>tputs cols # for columns 
</span></code></pre>
when you change the window size of the terminal, kernel sends a signal SIGWINCH</code> which resets the stty cols etc. The side effect of this not being correctly set will result in overwriting of text of same line and not changing to next line on inputting long text in the terminal.</p>
Questions</h2>

</li>
</ul>
Related</h2>

shell-commands</a></li>
</ul>


Macos
2026-08-19T00:00:00+00:00
Keyboard</h3>

Settings -> Keyboard -> Key repeat rate</code> controls at what speed when pressing a key the input is sent, if you make it high, cursor will move faster when you press let's say down key etc.</li>
</ul>
Safe mode boot</h3>

To boot in safe mode, shutdown the mac</li>
Keep pressing the power button till, it loads startup option</li>
Select the drive and continue</li>
</ul>
Clear DNS cache</h3>
sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder
</span></code></pre>
Directories</h3>

~/Library/Caches</code> all system wide caches for applications</li>
~/Library/Preferences</code> plist files used for storing configuration, preferences etc.</li>
</ul>
Type degree (°) symbol</h3>
Option + Shift + 8 => °</p>
Rebuild spotlight index</h3>

For a specific dir, for eg Applications:

Setting -> Spotlight -> Search Privacy

Add and remove the directory</li>
</ul>
</li>
</ul>
</li>
For all dirs</li>
</ul>
	sudo mdutil -Eai off
</span>	sudo mdutil -Eai on
</span></code></pre>
Sources</h2>

</li>
</ul>
Questions</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


Bonds
2026-08-19T00:00:00+00:00
Bonds are debt instruments in which you borrow money from market by promising fixed interest annually, along with repayment of principle later.</p>
Sources</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


E-Mandate on cards
2026-08-19T00:00:00+00:00
Source</strong>: https://www.sc.com/in/bank-with-us/recurring-e-mandates/faqs/</p>
E-mandate is signed by users when opting for a recurring payment via card to a online website/app.</p>
There're RBI guidelines that banks and merchant has to follow.</p>
Additional Factor Authentication, generally OTP, is required:</p>

on e-mandate registration</li>
if amount is greater than 15000 rs, (no OTP on amount less than 15k)</li>
</ul>
If user doesn't authorise this, for eg, if foreign site doesn't implement it, bank fails the transaction.</p>
On bank side:</p>

bank has to give notification to users before deduction</li>
have a way to opt out of it</li>
</ul>
It is generally handled by payment gateways.</p>
Questions</h2>

How does this differ from e-mandate for SIPs NACH? #question</li>
How does this apply to UPI's autopay? #question</li>
</ul>
Related</h2>

tcs</a></li>
</ul>


Employee Provident Fund (EPF)
2026-08-19T00:00:00+00:00
EPF (Employee Provident Fund) is a mandatory</strong> government scheme for all private and government sector employees. It has two components,</p>

employee contribution, 12% of his Basic + Dearance Allowance (DA) salary</li>
employer contribution, same 12% but divided into:

EPS: 8.33% of 15000 = 1250</li>
EPF: remaining amount</li>
</ul>
</li>
</ul>
EPS is available as a pension after age of 58 years. It requires at least 10 years of service.
EPF on the other hand can be withdrawn completely in one of these scenarios:</p>

No job

After 2 months: 75% of the corpus can be withdrawn</li>
After 12 months: remaining 25%</li>
</ul>
</li>
It'll be linked with UPI, can be withdrawn like a normal bank account (what caps? #question)</li>
</ul>
There's an additional component in EPF, EDLI, this is a term insurance for employee, paid for by employer. In case of death, at maximum of 7.5L can be availed.</p>
Interest</h3>
Rate of interest hovers around 8%.</p>
UAN, PF transfer</h3>
Each user has unique UAN number linked to PAN. On changing organisation, UAN remains same, but you get new PF number. And you've to transfer your amount from old to new PF account. Ensure your Date of Exit</em> (DOE) is marked by previous employer. And that it doesn't overlap with Date of Joining</em> (DOJ) at the new organisation.</p>
Sources</h2>

https://youtu.be/y0OhXSjcbkI?si=_C8tQRymXuskPaME</li>
</ul>
Related</h2>

PF Tax</a></li>
nps</a></li>
</ul>


Income tax
2026-08-19T00:00:00+00:00
In new regime, you taxed 30% on salary > 24L, whereas in old it's salary > 10L. Apart from the usual tax slabs, surcharge is also applicable if salary is greater than 50L.</p>
Possible deductions</h3>

[only in old] Car: transport, maintainence, driver bills</li>
[only in old] Professional Tax</li>
[both] Standard deduction: 50k in old, 75k in new (available by default, requires no documentation)</li>
[in both] food/meal 200/meal</li>
[in both] gift 15k</li>
[in both] telephone bills</li>
[only in old] LTA

can be claimed for 2 journeys in 4 years gap</li>
covers self + family</li>
air, rail, bus for travel in india</li>
</ul>
</li>
[only in old] HRA

check changes recently</li>
requires relationship with landlord, aadhar, pan etc</li>
2% TDS included in rent</li>
</ul>
</li>
[both] relocation charges</li>
[both] conveyance allowance (commuting to work etc)</li>
[only in old] helper</li>
[only in old] child education upto 3k per month per child</li>
[only in old] life insurance upto 1.5k under 80c</li>
[both] NPS: upto 10% in old (additional 50k/yr), upto 14% in new</li>
[only in old] Health insurance</li>
[only in old] education loan - no limit</li>
[only in old] home loan for self - 2L limit</li>
[only in old] home loan for let out - no limit</li>
</ul>
PF Tax</h3>
If employer contribution > 7.5L annually, it'll be taxable.
If interest amount > 2.5L tax is applicable.</p>
Taxation in ESOPs and RSUs</h3>


RSUs are actual free shares available after vesting. No cost for holding. On selling it's taxed as per income slab.</p>
</li>

ESOPs gives an options for employee to buy share at fixed discounted price, requires paying exercise amount. It is taxed twice, once when it's exercised, based on difference between FMV (Fair Market Value) and exercise price. And then again on selling based on capital gains tax.</p>
</li>
</ul>
Foriegn assets disclosure</h3>
According to new IT rules, you're required to share all foriegn assets, i.e, RSUs & ESOPs for public shares, including overseas mutual/index fund. This doesn't apply pre IPO, if there's no valuation. If foriegn assets are greater than 20L and not declared, it attracts a penalty of 10L.</p>
Business</h3>
If you've business income, you can't switch tax regime once selected. Really? #question</p>
Form 26AS</h3>
It's a consolidated tax statement for all taxes which are deducted, like TDS, TCS for a PAN.</p>
Sources</h2>

</li>
</ul>
Related</h2>

tcs</a></li>
epf</a></li>
nps</a></li>
mutual-fund-taxation</a></li>
itr</a></li>
</ul>


Loan Against Securities
2026-08-19T00:00:00+00:00
You can take loan against stocks/mutual funds via Zerodha Capital, at rate of interest 11% (for loan amounts 25K to 50L).</p>
This covers most mutual funds as listed here</a>.</p>
Haircut of 55% is applicable for equity based funds. For eg, if you assets are valued at 50 L, you can take a loan of only 22.5L on the remaining 45% after removing haircut.</p>
Sources</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


Liberalised Remittance Scheme (LRS)
2026-08-19T00:00:00+00:00
By virtue of LRS scheme by RBI, a citizen of india can remit (send money) $2,50,000 (2.3 Crore) to a foreign entity per financial year.</p>
The purpose of this remittance can be:</p>

Investment, stocks or us treasury bonds</li>
Real estate investment</li>
Traveling abroad expenditure (business as well as leisure)</li>
Traveling for education</li>
Sending money to family overseas</li>
</ul>
Cost of transaction: money exchange cost (as facilitated by bank) + 18% GST on the exchange cost.</p>
TCS is applicable on this over limit of 10L.</p>
For investments</h3>
Under International Financial Services Centres Authority (IFSCA), Global Access Provider (GAP) in GIFT city act as India's global investing gateway.</p>
Sources</h2>

https://www.indmoney.com/blog/us-stocks/liberalised-remittance-scheme</li>
</ul>
Related</h2>

tcs</a></li>
income-tax</a></li>
</ul>


Mutual Fund Taxation
2026-08-19T00:00:00+00:00
Equity</h2>
Must have minimum 65% equity investment for it to be applicable for equity taxation.</p>

< 1 yr</code> - STCG - 20%</li>
> 1 yr</code> - LTCG - 12.5% - upto 1.25 Lakh exempt per annum</li>
</ul>
Non Equity</h2>
Debt, Gold ETF etc, are taxed on income slab rates.</p>
FIFO Withdrawal</h2>
In case of SIPs, oldest lots are redeemed first incase of withdrawal. Each lot is calculated separately for taxes.</p>
Sources</h2>

</li>
</ul>
Related</h2>

income-tax</a></li>
</ul>


National Pension Scheme (NPS)
2026-08-19T00:00:00+00:00
NPS is available in</p>

Tier I

Tax free 14% of Basic + DA salary, limited to 7.5L annually</li>
</ul>
</li>
Tier II

This is just a cheap mutual fund (ie lower expense ratio)</li>
</ul>
</li>
</ul>
Features</h3>

You can opt for auto scheme which changes allocation based on age, i.e, shifts assets from equity to debt etc.</li>
It has the lowest expense ratio in the industry</li>
Allows you to change Fund Manager, once a year, without any tax</li>
Allows you to change your asset allocation, once every quarter</li>
</ul>
Multi scheme</h3>
With multi scheme you can decide explicitly the funds you want to allocate. Also you can go 100% equity with this.  The only drawback is once a amount is invested in a fund, you have to stay invested for entire duration (15 years). You can change allocation for next month. But old amount cannot be rebalanced. Although, you can shift the entire amount back to auto schemes.</p>
Withdrawal</h3>
With recent changes, you can withdraw from the scheme after 15 years or at age 60, which ever is earlier.</p>

80% of the amount is available as Lump Sum</li>
For the remaining 20% you've to purchase annuity</li>
</ul>
There's also a scope of withdrawing via SWP instead of entire amount at once.</p>
You can take loan against your NPS corpus.</p>
Sources</h2>

https://youtu.be/y0OhXSjcbkI?si=_C8tQRymXuskPaME</li>
</ul>
Related</h2>

income-tax</a></li>
epf</a></li>
</ul>


Tax Collected at Source (TCS)
2026-08-19T00:00:00+00:00
Source</strong>:</p>
Tax collected at source (TCS) is applicable on transactions with foreign merchants. It is collected by bank facilitating such transaction, and it's linked back to user by PAN.</p>
You can verify how much TCS was deducted in Form 26AS, which is comprehensive tax statement. It can be claimed back while filing the Income Tax Return (ITR).</p>
TCS is exempted till limit of 10 Lakh rs annually, rotated every financial year (apr) . After that, it's collected as:</p>

5% on medical or education bills</li>
20% on other transactions</li>
</ul>
Questions</h2>

</li>
</ul>
Related</h2>

emandate-on-cards</a></li>
Form 26AS</a></li>
Foriegn assets disclosure</a></li>
lrs</a></li>
</ul>


Grafana Alloy
2026-08-19T00:00:00+00:00
HTTP static endpoint discovery</h3>
You can define static http</a> endpoint for discovery of targets.</p>
        discovery.http "va" {
</span>          url = "https://nexus3.indexexchange.com/repository/blackbox_targets/VA_targets_icmp.json"
</span>        }
</span></code></pre>
Sources</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


Container Networking
2026-08-19T00:00:00+00:00
Source</strong>: https://www.youtube.com/watch?v=6v_BDHIgOY8</p>

Check network</a></li>
All containers have virtual ethernet(veth</code>)interface attached</li>
veth</code> 's are created in pair's. For container networking, one part of the veth is in network namespace.</li>
bridge</code> interface is common connecting link. In a bridge, one part of it remains in host, other's are connected with multiple veth interfaces(container's). Bridge generally has a range of IP addresses (equivalent to each container's ip).</li>
Apart from above connections veth</code> & bridge</code> all other connection depend on routing</li>
</ul>
How connection works for two containers on same host?</h3>


Hint: it uses bridge</p>
</li>

All communications from containers are routed via bridge to host</p>
</li>

All host communications are routed to containers via bridge</p>
</p>
</li>
</ul>
echo</span></span> "</span>Creating the namespaces"</span></span></span>
</span>sudo</span></span> ip netns add $</span>CON1</span></span></span>
</span>sudo</span></span> ip netns add $</span>CON2</span></span></span>
</span>
</span>echo</span></span> "</span>Creating the veth pairs"</span></span></span>
</span>sudo</span></span> ip link add veth10 type veth peer name veth11</span>
</span>sudo</span></span> ip link add veth20 type veth peer name veth21</span>
</span>
</span>echo</span></span> "</span>Adding the veth pairs to the namespaces"</span></span></span>
</span>sudo</span></span> ip link set veth11 netns $</span>CON1</span></span></span>
</span>sudo</span></span> ip link set veth21 netns $</span>CON2</span></span></span>
</span>
</span>echo</span></span> "</span>Configuring the interfaces in the network namespaces with IP address"</span></span></span>
</span>sudo</span></span> ip netns exec $</span>CON1</span></span> ip addr add $</span>IP1</span></span>/24 dev veth11 </span>
</span>sudo</span></span> ip netns exec $</span>CON2</span></span> ip addr add $</span>IP2</span></span>/24 dev veth21 </span>
</span>
</span>echo</span></span> "</span>Enabling the interfaces inside the network namespaces"</span></span></span>
</span>sudo</span></span> ip netns exec $</span>CON1</span></span> ip link set dev veth11 up</span>
</span>sudo</span></span> ip netns exec $</span>CON2</span></span> ip link set dev veth21 up</span>
</span>
</span>echo</span></span> "</span>Creating the bridge"</span></span></span>
</span>sudo</span></span> ip link add name br0 type bridge</span>
</span>
</span>echo</span></span> "</span>Adding the network namespaces interfaces to the bridge"</span></span></span>
</span>sudo</span></span> ip link set dev veth10 master br0</span>
</span>sudo</span></span> ip link set dev veth20 master br0</span>
</span>
</span>echo</span></span> "</span>Assigning the IP address to the bridge"</span></span></span>
</span>sudo</span></span> ip addr add $</span>BRIDGE_IP</span></span>/24 dev br0</span>
</span>
</span>echo</span></span> "</span>Enabling the bridge"</span></span></span>
</span>sudo</span></span> ip link set dev br0 up</span>
</span>
</span>echo</span></span> "</span>Enabling the interfaces connected to the bridge"</span></span></span>
</span>sudo</span></span> ip link set dev veth10 up</span>
</span>sudo</span></span> ip link set dev veth20 up</span>
</span>
</span>echo</span></span> "</span>Setting the loopback interfaces in the network namespaces"</span></span></span>
</span>sudo</span></span> ip netns exec $</span>CON1</span></span> ip link set lo up</span>
</span>sudo</span></span> ip netns exec $</span>CON2</span></span> ip link set lo up</span>
</span>
</span>echo</span></span> "</span>Setting the default route in the network namespaces"</span></span></span>
</span>sudo</span></span> ip netns exec $</span>CON1</span></span> ip route add default via $</span>BRIDGE_IP</span></span> dev veth11</span>
</span>sudo</span></span> ip netns exec $</span>CON2</span></span> ip route add default via $</span>BRIDGE_IP</span></span> dev veth21</span>
</span></code></pre>
How connection works between two containers on different host but same subnet?</h3>

Hint: It uses static ip routes</li>
Prerequisite: Host and containers are able to communicate</li>
Bridge on a host is allocated range of IP address (subnet)</li>
If request is for bridge on other node, request is forwarded to the node</li>
</ul>
</p>
How connection works between two containers on different host on different subnet?</h3>

Case of overlay networks</li>
In this case, nodes are linked but not on same network. Could be on internet. Could be different zones, etc</li>
If other node is not next hop(i.e., different subnet), routing rules just on nodes won't work, unless applied to all routers in between.</li>
Prerequisite: Node should be able to communicate to each other</li>
Hint: Use tun</code> interface to hide a proxy, such that, data routed to tun</code> is packaged in udp packet and send to appropriate node. Same process is followed on other node & data out from tun</code> is fed to bridge</code></li>
</ul>
</p>
Questions</h2>

</li>
</ul>
Related</h2>

containers</a></li>
iptables-command</a></li>
ip-command</a></li>
</ul>


ip command
2026-08-19T00:00:00+00:00
Manually assign ip address to interface</h3>
ip addr add 10.118.16.4/26 dev eno1
</span></code></pre>
/24</code> is important, if not provided it'll default to /32</code></p>
Bring up/down a link</h3>
ip link set eno1 down
</span>ip link set eno1 up
</span></code></pre>
Show the route taken for ip</h3>
Helpful when there're multiple interfaces</p>
ip route get <ip>
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

iptables-command</a></li>
container-networking</a></li>
</ul>


iptables command
2026-08-19T00:00:00+00:00
Source</strong>:</p>
Show iptables stats</h3>
iptables -nvL [chain]
</span>or
</span>iptables --numeric --verbose --list [chain]
</span></code></pre>
Dump rules to stdout</h3>
iptables-save
</span></code></pre>
Show dropped packets by iptable rules</h3>
$ iptables -A INPUT -j LOG --log-prefix "IPT-DROP-INPUT: " --log-level 4
</span>$ journalctl -f | grep "IPT-DROP-INPUT"
</span>Apr 07 08:36:37 ops-fr-1.dcaux.indexww.com kernel: IPT-DROP-INPUT: IN=bond0 OUT= MAC=4c:d9:8f:3d:7c:f3:00:2c:c8:7a:69:bf:08:00 SRC=85.217.140.29 DST=185.80.39.238 LEN=52 TOS=0x00 PREC=0x00 TTL=54 ID=62016 PROTO=TCP SPT=41560 DPT=38472 WINDOW=65535 RES=0x00 SYN URGP=0
</span>
</span></code></pre>
Make permanent changes to iptables</h3>
On RHEL</h4>
$ vim /etc/sysconfig/iptables
</span>$ systemctl restart iptables
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

ip-command</a></li>
container-networking</a></li>
</ul>


Keepalived
2026-08-19T00:00:00+00:00
It's a linux daemon which provides high availability and load balancing for a backend group of servers. It's built on top of VRRP (Virtual Router Redundancy Protocol) and IPVS (IP Virtual Server).</p>
VRRP</h3>
The main objective of VRRP is to provide high availability</strong> of service to clients. Instead of exposing IP of a single server to users, VIP (virtual IP) is exposed which is shared by multiple servers.</p>
One of the server is elected as Master (based on priority set in configuration), and all the traffic is routed through it. Periodically, master sends heartbeat to other backup servers. In case, a heartbeat is skipped, one of the other backup server is elected as master, and starts serving the traffic via the same virtual IP. The failed server is removed from the pool. The client/user is unaware of this change, since it still connects on the same IP.</p>
IPVS</h3>
IPVS is a kernel mechanism to distribute connections to backend servers, basically a L4 load balancer</strong>. It supports scheduling based on round robin, least connections or weighted traffic to backend servers.</p>
Sources</h2>

</li>
</ul>
Related</h2>

load-balancing-algorithms</a></li>
</ul>


Load Balancing Algorithms
2026-08-19T00:00:00+00:00
Things you care about in load balancing, least packets drops, and low latency.</p>
Request Queues on servers</h2>
Different servers work differently, they start listening on port. Some create a fixed set of workers (process) at bootstrap, others create new process/threads per request. They can implement request queues where packets arrive, and workers pick it from. Packet is dropped if queue is full. This increases per request latency, as packets have to wait in queue before they can be processed.</p>
In golang, a new go routine is created for every request. In this case, server is limited by resources rather than queue length.</p>
Centralised algorithms</h2>
Round Robin</h3>
Most common default. Requests are routed to backend servers in uniform round robin fashion.</p>
Drawbacks: In real world, all backend servers are not equally powerful</strong> and all request are not equally expensive</strong>, namely request & server variance.</p>
Weighted Round Robin (WRR)</h3>
Humans tag each server with specific weight, and requests are served based on that weight. This handles server variance</strong>, but not request. This has better latency.</p>
Drawbacks: It's hard to come up with single digit number. It requires extensive benchmarking of servers. Adding human to the loop for every weight change can be a recipe for disaster. It doesn't account for request variance.</p>
Dynamic Weighted Round Robin</h3>
Variant of WRR, it calculates the weights dynamically based on server metrics like latency. Since LB sits between client and server, it can track request latency from server. Weight is calculated dynamically based on that.</p>
Works only on centralized load balancer</strong>.</p>
Least Connection</h3>
LB sits between client and server, knows server statistics like active connections, latency per server. In least connection, it prioritises servers with least active connections. Simple to calculate/maintain and quite effective. This handles both server & request variance</strong>. Hence it's a great default for most workloads.</p>
Requests are only dropped, when all of backend servers are overloaded. However it has slightly higher latency compared to WRR.</p>
Works only on centralized load balancer</strong>. In distributed load balancers, no single LB has full info of how many active connections are open on backend.</p>
Peak Exponentially Weighted Moving Average (PEWMA)</h3>
Mix of Least connection & Dynamic Weighted RR. Tries to optimise for lower latency & better overload.</p>
Drawbacks of centralised load balancing</h3>

Single point of failures</li>
Scaling is only vertical, and can be very costly</li>
</ul>
Distributed algorithms</h2>
DNS Round Robin</h3>
No load balancer required. Endpoint resolves differently for each client. Works well in large system with homogenous requests.</p>
Drawbacks: No health checks, backends cannot go down. Clients can override TTL and cache results for much longer.</p>
Power of two random choices</h3>
Perfect distributed load balancing requires sharing current server loads with all load balancers. Overhead of constantly sharing this info is high. If this info is cached and synced periodically, it leads to herding of connections on a quiet backend for much longer, then cool down. So servers move from quiet -> busy -> quiet etc.</p>
In best of 2, you pick two backends randomly. Then, pick the one with low load. This works effectively even with cached info.</p>
Sources</h2>

https://samwho.dev/load-balancing/</li>
https://brooker.co.za/blog/2012/01/17/two-random.html</li>
</ul>
Related</h2>

keepalived</a></li>
</ul>


Tcpdump
2026-08-19T00:00:00+00:00
Source</strong>:</p>
List interfaces</h3>
tcpdump -D
</span></code></pre>
Expression</h3>

Check man pcap-filter</code> for tcpdump expression syntax and fields</li>
</ul>
Capture file</h3>
tcpdump -w capture.pcap -i any host google.com
</span></code></pre>
Capture DHCP packets</h3>
tcpdump -i any -vv -n port 67 or port 68
</span></code></pre>
Capture packets from specific mac address</h3>
tcpdump -i bond0.101 -n -vvv -e ether host 2c:ea:7f:89:d5:95
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

dhcpd</a></li>
</ul>


Wake On Lan (WOL)
2026-08-19T00:00:00+00:00
Wake on LAN (WOL) is a protocol that enables you to wake up a computer/server remotely by a sending a ethernet packet.</p>
This has to be enabled in BIOS. Find where this is on our asrock minipc #question.
For this, the NIC card has to constantly listen to all broadcast messages for magic packet.</p>
Since this works on hardware layer, it works regardless of OS etc. Only ethernet supports this feature.</p>
Works on a server in standby mode, ie, OS shut down normally with power supply still connected. Goes into ACPI S5 state, and it still receives standby power to listen on ethernet.</p>
Magic packet</h3>
Magic packet is broadcasted on UDP ports 0, 7, 9 etc. Magic packet consists of 6 bytes of 0xFF followed target MAC address to wake up (repeated 16 times). This is because NIC receives stream of bytes without start and end. And checking for this pattern allows it to reliably and efficiently identify the MAC address.</p>
Limitations</h3>
Packet has to originate from the network the server is in.  Doesn't really matter on what layer the packet is received, data link or ip, all the NIC hardware cares for is magic packet.</p>
Sources</h2>

</li>
</ul>
Related</h2>

booting-linux-on-x86-64</a></li>
</ul>


Anaconda
2026-08-19T00:00:00+00:00
Source</strong>: https://anaconda-installer.readthedocs.io/en/latest/user-guide/boot-options.html</p>
Anaconda is the OS installer for RHEL based systems.</p>
SSH to server for troubleshooting</h3>
(This only works if kernel arg: inst.sshd</code> was set while live booting OS)</p>
ssh root@server-ip
</span>
</span>tmux attach
</span>
</span>check ks logs: /var/run/install/ks.cfg
</span></code></pre>
Retry anaconda installer from failed server</h3>
anaconda --kickstart /path/to/ks.cfg
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

cobbler</a></li>
dhcpd</a></li>
initrd</a></li>
booting-linux-on-x86-64</a></li>
</ul>


Cobbler
2026-08-19T00:00:00+00:00
Source</strong>:</p>
Cobbler is a tool used for provisioning bare metal servers.</p>
Add cobbler system</h3>
cobbler system add --name="k8s1ny-w-19.indexww.com" --hostname="k8s1ny-w-19.indexww.com" --profile="K8S-CP-R9" --interface=p1p1 --ip-address=10.129.0.22 --mac=64:9D:99:B2:2F:C8 --static=1 --netmask=255.255.255.0 --gateway=10.129.0.250 --name-servers="192.40.39.191 1.1.1.1"  --name-servers-search="indexexchange.com casalemedia.com indexww.com"
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

anaconda</a></li>
initrd</a></li>
dhcpd</a></li>
idrac-racadm</a></li>
</ul>


DHCPD
2026-08-19T00:00:00+00:00
Source</strong>:</p>
Leases</h3>

leases are stored at path: /var/lib/dhcpd/dhcpd.leases</code></li>
</ul>
Configuration</h3>
DHCPD (isc-dhcpd) sample configuration:</p>
ddns-update-style interim;
</span>
</span>allow booting;
</span>allow bootp;
</span>
</span>ignore client-updates;
</span>set vendorclass = option vendor-class-identifier;
</span>
</span>option system-arch code 93 = unsigned integer 16;
</span>
</span>subnet 10.203.32.64 netmask 255.255.255.192 {
</span>     option routers             10.203.32.126;
</span>     option domain-name-servers 10.199.1.240;
</span>     option subnet-mask         255.255.255.192;
</span>     range dynamic-bootp        10.203.32.65 10.203.32.100 ;
</span>     default-lease-time         1800;
</span>     max-lease-time             3600;
</span>     next-server                $next_server_v4;
</span>     class "pxeclients" {
</span>          match if substring (option vendor-class-identifier, 0, 9) = "PXEClient";
</span>
</span>          # Legacy
</span>          if option system-arch = 00:00 {
</span>              filename "grub/grub.0";
</span>          }
</span>          # UEFI-32-2
</span>          if option system-arch = 00:02 {
</span>              # Not supported, no 32 bit UEFI grub executable
</span>              filename "unsupported";
</span>          }
</span>          # UEFI-64-1
</span>          else if option system-arch = 00:07 {
</span>              filename "grub/grubx64.efi";
</span>          }
</span>          # UEFI-64-2
</span>          else if option system-arch = 00:08 {
</span>              filename "grub/grubx64.efi";
</span>          }
</span>          # UEFI-64-3
</span>          else if option system-arch = 00:09 {
</span>              filename "grub/grubx64.efi";
</span>          }
</span>          # armv7   (aka arm 32 bit)
</span>          else if option system-arch = 00:0a {
</span>              filename "grub/armv7.efi";
</span>          }
</span>          # aarch64 (aka arm 64 bit)
</span>          else if option system-arch = 00:0b {
</span>              filename "grub/grubaa64.efi";
</span>          }
</span>          else
</span>          {
</span>              # This will be used when Bootmode is set to Legacy Bios
</span>              filename "pxelinux.0";
</span>          }
</span>     }
</span>}
</span>
</span></code></pre>
Troubleshooting</h3>
DHCPD config consists of subnet definitions it looks out for. If a packet arrives from one of these subnets, it responds with DORA flow.
It only listens on interfaces for which subnets are defined in configuration. If there's no subnet definition for interfaces, it fails to come up.</p>
If you don't see a packet arriving, ensure you've interface subnet added along with target subnet.</p>
Questions</h2>

</li>
</ul>
Related</h2>

cobbler</a></li>
anaconda</a></li>
Capture DHCP packets</a></li>
</ul>


Grub
2026-08-19T00:00:00+00:00
Update kernel options via grub</h3>

Edit file /etc/default/grub</code> with necessary change</li>
Finally run grub2-mkconfig -o /boot/grub2/grub.cfg</code> (on rhel, centos) or update-grub</code> on debian, ubuntu

if it doesn't work try adding option --update-bls-cmdline</code> to grub2-mkconfig</li>
for efi the path could be different:</li>
</ul>
</li>
</ul>
Sources</h2>

</li>
</ul>
Questions</h2>

</li>
</ul>
Related</h2>

initrd</a></li>
booting-linux-on-x86-64</a></li>
</ul>


IDrac Racadm
2026-08-19T00:00:00+00:00
iDRAC is a separate BMC chip, on dell, which integrates on the motherboard, and provides users to control a server remotely. You could build a similar feature with piKVM, diy</a>:</p>

Connect the video cable.</li>
Integrate circuit to motherboard power supply</li>
</ul>
With serial over lan, you can get serial console remotely for troubleshooting purposes.</p>
Alias</h3>
alias myracadm="racadm -r 10.118.16.27 -u root -p calvin --nocertwarn"
</span></code></pre>
Check sel logs</h3>
/opt/ix/ops-bin/rracadm.sh -v bh2-prod-data-1407.ix1.indexww.com getsel -o
</span></code></pre>
Check cpu reset</h3>
/opt/ix/ops-bin/rracadm.sh bh2-prod-data-674.ix1.indexww.com lclog view -n 10 -k CPU
</span></code></pre>
Set first boot to pxe</h3>
racadm -r 10.118.16.3 -u root -p calvin set idrac.serverboot.firstbootdevice PXE
</span></code></pre>
pxe device</h3>
./racadm get BIOS.PxeDev1Settings.PxeDev1Interface
</span>
</span>./racadm set BIOS.PxeDev1Settings.PxeDev1Interface <interface name, something like NIC.Slot.1-1>
</span></code></pre>
Powercycle</h3>
racadm -r 10.118.16.3 -u root -p calvin serveraction powercycle
</span></code></pre>
Jobqueue</h3>
myracadm jobqueue create BIOS.Setup.1-1 -r pwrcycle
</span></code></pre>
racreset</h3>
racadm racreset soft
</span></code></pre>
Pre-requisites for ssh, ipmi or webconsole</h3>
racadm set idrac.ipmilan.enable Enabled
</span>racadm  set idrac.ssh.enable Enabled
</span>racadm set iDRAC.WebServer.HostHeaderCheck Disabled
</span></code></pre>
Via ssh</h3>
ssh root@idrac_ip
</span>ssh -o KexAlgorithms=curve25519-sha256 root@idrac_ip
</span>console com2
</span></code></pre>
ctrl + \ to exit
ctrl + f12 = to access boot menu (not verified yet)</p>
System info</h3>
racadm getsysinfo
</span></code></pre>
Virtual media</h3>
Check Attach virtual media</a></p>
Requires license. Although you can get trail enterprise license from dell website. Trial license can only be loaded once per server. After expiry you cannot add any other trial license.</p>
Connect</p>
myracadm remoteimage -c -l http://10.40.16.10:8080/bootc-almalinux-10.2-bootc-generic-iso-x86_64/bootc-almalinux-10.2-bootc-generic-iso-x86_64.iso
</span></code></pre>
Set first boot device to Virtual CD:</p>
racadm set iDRAC.ServerBoot.FirstBootDevice VCD-DVD
</span></code></pre>
Check status:</p>
myracadm remoteimage -s
</span></code></pre>
Disconnect:</p>
myracadm remoteimage -d
</span></code></pre>
Connectivity from BMC</h3>
racadm ping 10.40.16.10
</span>racadm traceroute 10.40.16.10
</span></code></pre>
Sources</h2>

</li>
</ul>
Questions</h2>

</li>
</ul>
Related</h2>

cobbler</a></li>
dhcpd</a></li>
redfish</a></li>
</ul>


Initrd
2026-08-19T00:00:00+00:00
Extract</h2>
xzcat initrd.img | cpio -id
</span>
</span>-i extract
</span>-d create dirs
</span></code></pre>
Check content</h2>
# show content of initramfs of current kernel
</span>lsinitrd
</span>
</span># show content of specific initramfs file
</span>lsinitrd path/to/initramfs.img
</span></code></pre>
Sources</h2>

</li>
</ul>
Questions</h2>

</li>
</ul>
Related</h2>

cobbler</a></li>
anaconda</a></li>
inspect-vm-filesystem</a></li>
dd</a></li>
grub</a></li>
booting-linux-on-x86-64</a></li>
</ul>


Redfish
2026-08-19T00:00:00+00:00
Attach virtual media</h3>
You can attach an ISO to virtual media (like CDROM) on the server via redfish virtual media API. Generally requires license. BMC will download & present it as virtual CD ROM to the host OS/bios.</p>
UEFI HTTP boot</h3>
Uses reliable TCP connection, instead of UDP (TFTP). Thus enables scalability & performance using http load balancer. Still requires functional DNS, DHCP, http servers. Just uses HTTP over TFTP.</p>
Sources</h2>

</li>
</ul>
Related</h2>

idrac-racadm</a></li>
</ul>


Check progress of restic backup
2026-08-19T00:00:00+00:00
Source</strong>: https://restic.readthedocs.io/en/latest/manual_rest.html</p>
If you're running restic in a non interactive setup (like in cron/systemd timer etc), there are two ways to show current backup progress:</p>

set env RESTIC_PROGRESS_FPS</code>  to 1 for printing progress every second,  1/60 = 0.016667</code> for every min</li>
invoking SIGUSR1</code> signal to running restic process should shows current progress in stdout logs</li>
</ul>
kill -SIGUSR1 $(pgrep restic)
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


Data encoding
2026-08-19T00:00:00+00:00
base32</h2>
base32 encodes binary data into set of ASCII chars, 26 letters (A-Z) & 2-7 numerals.</p>
It takes 5 bit of input and converts it into a char. Since data is generally represented in 8-bits byte, it processes a 5 byte input chunk (40 bit) and generates a 8 chars of output. Padding '=' is added at the end if input is not a multiple of 5. Padding is extra, and data can be decoded (although with errors) without it.</p>
Use cases</h3>

TOTP</li>
case insensitive systems like dns, filesystem etc</li>
</ul>
base64</h2>
base64 encodes binary data into 64 ASCII chars:</p>

A-Z</li>
a-z</li>
0-9</li>


/ (2 special chars)</li>
</ul>
</li>
= (padding at the end)</li>
</ul>
Processes a 6 bit input to one char. Takes 3 bytes (24 bit) to produce 4 chars. If input is not a multiple of 3 bytes, padding is added at the end.</p>
Use cases</h3>

converts binary data into representable text

email attachments</li>
image css in html</li>
</ul>
</li>
</ul>
URL encoding</h2>
URL encoding replaces unsafe chars with % followed by 2 digit hex value. Almost all chars are unsafe except few.</p>
Sources</h2>

</li>
</ul>
Related</h2>

</li>
</ul>


Digitial Rights Management (DRM)
2026-08-19T00:00:00+00:00
DRM takes control of the digital content from the users to a software program. It helps prevent unauthorised sharing or modification of IP. Used by services like Netflix, PrimeVideo etc.</p>
Some popular DRM systems include, also known as, Content Decryption Module (CDM):</p>

Widevine (Google) - included with all browsers</li>
Fair Play (Apple) - Safari, iOS - perhaps why the player is different</li>
Playready (MS)</li>
</ul>
Typical flow involves, a movie or stream is encrypted. When you hit play, device requests the decryption key. The request includes, user credentials, device info (used for selecting decryption layer) and DRM type (widevine etc). Companies package content in multiple DRMs and serve the right one based on what the browser supports. If everything checks out, it sends a decryption key. Video is only decrypted in real time.</p>
W3C Encrypted Media Extensions (EME) spec is the browser API which all browsers implement. They might use different CDM underneath (For eg apple uses Fair play, chrome/android - widevine etc).</p>
L1 - Hardware level security</h3>
Decryption & processing happens entirely with TEE (Trusted Execution Environment). Requires device support. For eg, netflix allows playing 4k only on devices which support L1.</p>
L2 - Mix of hardware and software</h3>
Uses some features of hardware and software. Limited to 1080p.</p>
L3 - Software only</h3>
Decryption happens in memory (RAM). Handled at OS/Browser level. Susceptible to theft from RAM by compromised kernel or privildged process. Limited to 480p to 720p resolution for the same reason. All decrypted videos have a invisible watermark, with user info, useful to find the culprit if a video is copied and leaked.</p>
Sources</h2>

</li>
</ul>
Related</h2>

trusted-platform-module</a></li>
</ul>


Openid Connect (OIDC)
2026-08-19T00:00:00+00:00
Source</strong>: https://dexidp.io/docs/openid-connect/</p>
Oauth2</h3>
Popular single sign on workflow, for eg with google:</p>

You login to application via google</li>
It is redirected to google login form</li>
You authenticate to google using your google creds</li>
You're redirected back to application with token, and are now authenticated to the application</li>
</ul>
ID Tokens</h3>
Tokens provided in oauth2 are generally opaque to client and provider specific. OIDC standardises the flow including the tokens as Json Web Token (JWT). Token consists of well known fields: header, payload and signature (of the first two fields).</p>
[
</span>   # header
</span>  {
</span>    "alg": "RS256",
</span>    "kid": "9151f75528677cd0c33a635340053dfd77f8d13f"
</span>  },
</span>  # payload
</span>  {
</span>    "iss": "https://ixdev.mschoudhary.site/",
</span>    "sub": "CgcxODQxMTIzEgZnaXRodWI",
</span>    "aud": "kubernetes",
</span>    "exp": 1775038239,
</span>    "iat": 1774951839,
</span>    "jti": "37d5ef0e-ba82-4824-9c1c-58c06bf5fca9",
</span>    "nonce": "gfInD0FryxFUqfzmdFRd8JKfe9j2U8XPWkxQMLEyFmI",
</span>    "auth_time": 1774951838,
</span>    "at_hash": "Kax3OY7scPt7souT8r1KSg",
</span>    "c_hash": "bF1DxR19BltzjxvUjELSUg",
</span>    "email": "ms.choudhary2000@gmail.com",
</span>    "email_verified": true,
</span>    "name": "Mohit Choudhary",
</span>    "preferred_username": "ms-choudhary"
</span>  }
</span>  
</span>  #signature
</span>  ....
</span>]
</span></code></pre>

iss - the oidc server who issued this token</li>
sub - unique end user id</li>
aud - client for which this token was issued for</li>
</ul>
While authenticating clients can request extra scopes (all supported scopes are listed in discovery endpoint), and server provides the same as additional claims (email, profile etc) in the token.</p>
Discovery</h3>
All OIDC implement a well known discovery url: /.well-known/openid-configuration</code>, which shows all configurations of OIDC server.</p>
Other endpoints:</p>

authorization_endpoint</code> used for authenticating</li>
jwks_uri</code> provides public keys of the server, used to verify the signature.</li>
claims_supported</code></li>
scope_supported</code></li>
</ul>
Flow</h3>

Connect to authorization_endpoint</code> (in wellknown configuration endpoint)</li>
Authenticate with the identity provider (like google, github, jumpcloud etc)</li>
You're redirected back to the redirect_url configured in IDP.</li>
</ul>
Tokens</h3>
In response, you get three tokens:</p>

ID token</strong>, this is the identity token used to authenticate the user. (Like government id in concert, you show this just once)</li>
Access token</strong>, this is the token used to interact with the apis. (Like wrist band in concert). This is has minimal fields.</li>
Refresh token</strong> (optional), token used to refresh all of these tokens if they expire etc.</li>
</ul>
Refresh Token</h4>
Generally in OIDC, you don't get refresh token by default. You've to request an additional scope offline_access</code> when making the first request, thereby you authorising the client app to refresh tokens on your behalf. IDP should support this scope.</p>
You can exchange a refresh token with new valid tokens. For security reasons, any refresh token can only be used once, it returns all new tokens (id, access & refresh).</p>
This facilitates functionalities, like relogin after 24 hours of inactivity. For eg, if client is active, it can refresh tokens automatically. However, if client is inactive and refresh token expires, you've to reauthenticate again.</p>
Scopes & Claims</h3>
Scope</strong> is what you request when you initiate the flow.
For eg, I'm interested in these category of information.
Claims</strong> is what you receive</p>
Scope unlocks claims. Some standard scopes and claims:</p>

openid => sub, iss, aud, exp, iat</li>
email => email, email_verified</li>
profile => name, given_name, family_name etc</li>
groups => groups</li>
</ul>
All supported scopes are listed in discovery endpoint. You can implement custom scopes as well, and introduce custom claims, specific to your app.</p>
Questions</h2>

</li>
</ul>
Related</h2>

Decoding JWT using jq</a></li>
query-ldap-schema</a></li>
</ul>


Query LDAP schema
2026-08-19T00:00:00+00:00
Source</strong>: https://dexidp.io/docs/connectors/ldap/#getting-started</p>
Generally when you're configuring LDAP authentication for an application, you've to discover/map certain fields to application configuration. Following tools are helpful in that.</p>
Install ldapsearch</h3>
dnf install openldap-clients
</span><or>
</span>apt-get install ldap-utils
</span></code></pre>
User/group schema mapping</h3>
If directory is small, you can dump all entries by:</p>
ldapsearch -x -H ldap://ldap.example.org -b 'dc=example,dc=org'
</span></code></pre>
First find user entry</p>
dn: uid=jdoe,cn=users,cn=compat,dc=example,dc=org
</span>cn: Jane Doe
</span>objectClass: posixAccount
</span>objectClass: ipaOverrideTarget
</span>objectClass: top
</span>gidNumber: 200015
</span>gecos: Jane Doe
</span>uidNumber: 200015
</span>loginShell: /bin/bash
</span>homeDirectory: /home/jdoe
</span>mail: jane.doe@example.com
</span>uid: janedoe
</span></code></pre>
Which can be mapped like:</p>
userSearch:
</span>  # The directory directly above the user entry.
</span>  baseDN: cn=users,cn=compat,dc=example,dc=org
</span>  filter: "(objectClass=posixAccount)"
</span>
</span>  # Expect user to enter "janedoe" when logging in.
</span>  username: uid
</span>
</span>  # Use the full DN as an ID.
</span>  idAttr: DN
</span>
</span>  # When an email address is not available, use another value unique to the user, like uid.
</span>  emailAttr: mail
</span>  nameAttr: gecos
</span></code></pre>
Then find group entry:</p>
dn: cn=developers,cn=groups,cn=compat,dc=example,dc=org
</span>memberUid: janedoe
</span>memberUid: johndoe
</span>gidNumber: 200115
</span>objectClass: posixGroup
</span>objectClass: ipaOverrideTarget
</span>objectClass: top
</span>cn: developers
</span></code></pre>
Group search must match a user attribute to group attribute. For eg, user's uid is matched to group's memberUid.</p>
groupSearch:
</span>  # The directory directly above the group entry.
</span>  baseDN: cn=groups,cn=compat,dc=example,dc=org
</span>  filter: "(objectClass=posixGroup)"
</span>
</span>  # The group search needs to match the "uid" attribute on
</span>  # the user with the "memberUid" attribute on the group.
</span>  userMatchers:
</span>  - userAttr: uid
</span>    groupAttr: memberUid
</span>
</span>  # Unique name of the group.
</span>  nameAttr: cn
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

oidc</a></li>
</ul>


TOTP
2026-08-19T00:00:00+00:00
TOTP is Time based One Time Password.</p>
Server generates a base32 secret (without padding '='), and shares to client via QR. QR code encodes a link of format: otpauth://totp/github:john@example.com?secret=xyz&issuer=github&algo=sha1</code>. Client stores the secret.</p>
The other thing shared between server & client is time. 30s interval window is selected, so it's easy for user to add the code, and it nullifies millisecond and microsecond differences between client and server's clock.</p>
currTimeInS := currentTimestamp in unix secs
</span>counter := currTimeInS/30 
</span>
</span>code := hash.Sha1(secret, counter) // generates a 20-byte hash
</span>
</span>opt := truncateTo6Digits(code)
</span>
</span>// dynamic truncate
</span>Last hex for eg 0x5a => integer, eg 10 => get 4 bytes from offset => integer => truncate
</span></code></pre>
Client and server performs the same computation over 30s intervals, and should match for success.</p>
Sources</h2>

https://www.youtube.com/watch?v=HFu3CUtrOQ8</li>
</ul>
Related</h2>

base32</a></li>
pki-certificates</a></li>
</ul>


jq command
2026-08-19T00:00:00+00:00
Decoding JWT using jq</h3>
JWT token can be decoded using jq:</p>
jwt-decode () {
</span>        jq -R 'split(".") |.[0:2] | map(@base64d) | map(fromjson)' <<< $1
</span>}
</span></code></pre>

--raw-input/-R</code> = don't parse input as json instead pass as string</li>
map(x), map_values(x)
For any filter x, map(x) will run that filter for each element of the input array, and return the outputs in a new array.</li>
@base64d</code> = base64 decode</li>
Convert to/from JSON
The  tojson  and  fromjson builtins dump values as JSON texts or parse JSON texts into values, respectively.</li>
</ul>
Print fields as string</h3>
 $ docker image inspect miniflux/miniflux | jq '.[] | "\(.Os)\/\(.Architecture)"'
</span>"linux/arm64"
</span></code></pre>

has string in quotes</li>
escape special chars</li>
</ul>
Sources</h2>

</li>
</ul>
Questions</h2>

</li>
</ul>
Related</h2>

oidc</a></li>
</ul>


Set time on linux
2026-08-19T00:00:00+00:00
Source</strong>:</p>
Set systemwide timezone on linux</h3>
/etc/localtime</code> symlinks to timezone file in /usr/share/zoneinfo. Changing the link to different timezone changes the systemwide timezone info.</p>
msc@debian:~$ ls -l /etc/localtime
</span>lrwxrwxrwx 1 root root 32 Nov 15 10:39 /etc/localtime -> /usr/share/zoneinfo/Asia/Kolkata
</span></code></pre>
Set system time on linux</h3>
date -s 'Sat Nov 23 15:12:58 IST 2024'
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


Shell Commands
2026-08-19T00:00:00+00:00
Source</strong>:</p>
Reverse a file</h3>
tac
</span>or
</span>tail -r
</span></code></pre>
Show file with linenumber</h3>
cat -n filename
</span>
</span>less -N filename or type -N in less window
</span>
</span>vim file => :set number
</span></code></pre>
Match/unmatch patterns from file</h3>

Find entries which are present in all but missing in processed to left_over (does not require sorting):</li>
</ul>
grep -vxFf processed all > left_over
</span>
</span>-v = invert search
</span>-x = match whole lines
</span>-F = treat patterns literally (no regex)
</span></code></pre>
How to create multiple incremented nos directory</h3>
mkdir -p pre{00..14}
</span>
</span>mkdir -p pre{00,12,13}
</span></code></pre>
Keyboard Shortcuts</h3>
CTRL-A</code> = go to the begining of the line

CTRL-E</code> = go to the end of the line

CTRL-U</code> = delete everything till begining

CTRL-K</code> = delete everyting till end</p>
Job control</h3>

disown - removes the job from list of running jobs, so it doesn't get killed when you exit the terminal, ensure it doesn't write into terminal window</strong></li>
</ul>
some_long_command > /tmp/log 2>&1
</span>CTRL-Z
</span>bg
</span>disown %1
</span></code></pre>

nohup command</code> - same as above</li>
</ul>
Readlink</h3>
Get path to actual file to which a symlink points</p>
readlink -f path
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

terminal</a></li>
vim</a></li>
</ul>


Vim
2026-08-19T00:00:00+00:00
Source</strong>:</p>
No paste</h3>
To ignore indenting while pasting text in vim</p>
:set paste
</span>:set nopaste
</span></code></pre>
Open at line number</h3>
vim +13 /root/.ssh/known_hosts
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

Show file with linenumber</a></li>
</ul>


Slack
2026-08-19T00:00:00+00:00
Slack is a maze of endpoints, and I always get confused, how to configure a new app or change some aspect of existing custom apps. There're so many pages titled "Your apps configuration", I've lost my way many a time, hence, this documentation.</p>
Manage custom slack apps</h3>
Manage your custom slack apps at URL: https://api.slack.com/apps/</p>
Post to a channel</h3>

Create a new slack app at above endpoint</li>
Add oauth scopes chat:write</code> for posting new messages to channel</li>
Generate bot token, export that as env SLACK_TOKEN</code></li>
C0AUQ88NCAZ</code> is channel id</li>
</ul>
func postSlackMessage(message string) error {
</span>	token := envOrFatal("SLACK_TOKEN")
</span>	client := slack.New(token)
</span>	_, _, err := client.PostMessage("C0AUQ88NCAZ", slack.MsgOptionText(message, false))
</span>	if err != nil {
</span>		return err
</span>	}
</span>	return nil
</span>}
</span>
</span>func envOrFatal(key string) string {
</span>	v := os.Getenv(key)
</span>	if v == "" {
</span>		log.Fatal("missing %s", key)
</span>	}
</span>	return v
</span>}
</span></code></pre>
Sources</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


SSH
2026-08-19T00:00:00+00:00
Forward tunnel</h3>
</p>
Service is running on remote server</strong>, and you're connecting to localhost on the client.</p>
ssh -L [bindaddress:]port:host:hostport target
</span>eg
</span>ssh -L 8000:localhost:8000 ixdev
</span></code></pre>
host is resolved on the target server. In this case, any request on port 8000 on the client is forwarded to localhost:8000 on ixdev.</p>
ssh -L 8000:randomhost:8000 ixdev
</span></code></pre>
In this case, any request on port 8000 on the client is forwarded to randomhost (resolved on ixdev) via ixdev.</p>
How this works?</h4>

When you run the ssh forward port-forward command, a tcp socket is open on client side for the port 8000. Nothing happens on the remote side yet.</li>
When a new request comes for localhost:8000, it's multiplexed on the ssh encrypted tcp connection via different channel number. (eg, channel 1 etc)</li>
On the remote side, sshd receives handles the packets from channel 1, and forwards them to localhost:8000.</li>
To the remote service (running on port 8000), it appears as if packet has arrived from localhost. To client service, it appears as if it's interacting with a local service. And tunnel is invisible to both.</li>
</ul>
Reverse Tunnel</h3>

Service is running on local client</strong>, and you're connecting to localhost on the vm.</p>
ssh -R [bindaddress:]port:host:hostport target
</span>
</span>ssh -R 8000:localhost:8000 ixdev
</span></code></pre>
Any request on port 8000 on remote VM is forwarded via secure channel to localhost:8000 running on local client. host is resolved on the local client.</p>
How this works?</h4>

A tcp socket on port 8000 is open on the remote side.</li>
Whenever any packets comes locally to 8000, it's multiplexed via secure channel to client side.</li>
On the client side, it proxies the packet to service running on localhost:8000</li>
</ul>
Remote Connection Hung</h3>

If your connection to remote server is hung and you can't do anything: Enter</code> ~</code> .</code> This forces the client to close the connection.

This doesn't work on nested ssh connections!</li>
</ul>
</li>
</ul>
Questions</h2>

Explore how connection is established and a terminal is spawn in ssh. #question</li>
</ul>
Related</h2>

sshfs</a></li>
</ul>


dd command
2026-08-19T00:00:00+00:00
Source</strong>:</p>


if 'if=' not present it reads from stdin</p>
</li>

if 'of=' not present it writes to stdout</p>
</li>

bs = block size, default 512 bytes, change to 1 byte if you want to write single byte</p>
</li>

count = no. of block size bytes to write for eg if bs=1, count=4 will write 4 bytes</p>
</li>

seek = write</strong> at seek position to block size * number</p>
</li>

skip = skip block size * number while reading</strong></p>
</li>
</ul>
$ printf '🐱' | dd of=/dev/xvd1 
</span>$ dd if=/dev/xvd1 count=1 2> /dev/null | hexdump -C
</span>
</span>$ printf "$(dd if=/dev/xvd1 bs=1 count=4 2> /dev/null)\n"
</span>
</span>$ printf '🐱' | dd of=/dev/xvd1 bs=1 seek=4
</span>
</span>$ printf "$(dd if=/dev/xvd1 bs=1 count=8 2> /dev/null)\n"
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

sshfs</a></li>
inspect-vm-filesystem</a></li>
containers</a></li>
initrd</a></li>
</ul>


Explore remote drive via SSHFS
2026-08-19T00:00:00+00:00
Source</strong>: https://man7.org/linux/man-pages/man1/sshfs.1.html</p>
Lately I wanted to explore the external hard drive connected to my homelab mini pc for some photos I wanted to upload to immich.  Instead of manually unplugging and replugging the drive to my mac, I decided to use sshfs.</p>
From the manpage,</p>

SSHFS allows you to mount a remote filesystem using SSH (more precisely, the SFTP subsystem). Most SSH servers support and enable this SFTP access by default, so SSHFS is very simple to use - there's nothing to do on the server-side.</p>
</blockquote>
It is based on FUSE filesystem.</p>
Installation</h2>
Debian/Ubuntu</h3>
apt install sshfs
</span></code></pre>
MacOS</h3>
Install Macfuse and sshfs from macfuse</a> site. It'll prompt to allow a system extension in system settings. Also a restart is required.</p>
Usage</h2>
sshfs homelab:/var/homelab ~/Documents/mnt
</span></code></pre>
Loads /var/homelab</code> remote dir to ~/Documents/mnt</code>.</p>
You can then explore the files in finder. Finally to unmount:</p>
umount ~/Documents/mnt
</span></code></pre>
Questions</h2>

Explore fuse fs #question</li>
This reduces the iops on the backup drive, and you've to remount it again #question</li>
</ul>
Related</h2>

dd</a></li>
ssh</a></li>
</ul>


The Google File System
2026-08-19T00:00:00+00:00
Source</strong>: Paper by Sanjay Ghemawat, Howard Gobioff, and Shun-Tak Leung Google</a></p>
Google File System (GFS) is a distributed file system developed at google. Other than conventional goals of any distributed system : performance, scalability, reliability & availability, its design was driven chiefly by key observations of existing workloads and usage patterns at google.</p>
Assumptions</h2>

It is build mostly for commodity hardware, were failure is norm rather than exception. With hundreds of machines and thousands of disks, disk failure and data corruption happens on a daily basis. System should be tolerant towards such failures.</li>
Bigger multi GB files are more common than smaller ones.</li>
Files are written mostly in append only fashion. Random writes are rare. Small random writes are supported by system, but it doesn't have to be efficient.</li>
Files are read in large streaming in order rather than small random reads.</li>
For performance, we need to allow multiple clients concurrently appending to the same file.</li>
Overall data bandwidth is more important than latency. Processing data in bulk at high rate is more important than response time for each write.</li>
Since all clients of GFS are internal to google, design was heavily biased by internal infrastructure and based on the assumption that client libraries could be developed in sync with FS APIs.</li>
</ul>
Interface</h2>
GFS doesn't implement standard POSIX API for file system. Although it provides a familiar interface, files are organized hierarchically in directories. Standard operations allowed on the files are: create, delete, open, close, read, write & record append. Record append allows multiple concurrent clients to append data atomically to same file, that is, either the write is completely written in the file or not. Low cost snapshotting of a file or directory is supported.</p>
Architecture</h2>
GFS mainly consists of three components: single master, multiple chunkservers and multiple clients.</p>
Files are divided into uniform sized chunks of 64 MB size, identified by immutable chunk handle. Master stores metadata, namely, files in namespace, mapping of files to chunks, and it's location on chunk servers. Chunkservers stores the chunks locally as linux file. Chunks are replicated per region in file namespace on different chunkservers, with default replication of 3. Master periodically exchanges heart beats with chunkservers and re-replicates chunks incase of chunkserver failures. Clients implement FS API and interacts with master and chunkserver. Client fetches metadata from master, and caches it locally. It reaches out to chunkserver directly for all data communication.</p>
GFS does not implement POSIX API, so there's no need for integration with linux v-node. Chunks are stored locally as linux files and OS buffer cache suffices the caching needs. No additional data caches are maintained either on client or chunkserver.</p>
Client caches the metadata information for short interval, till expiry or file gets reopened. Since chunksize is fixed, client calculates chunk index based on filename and offset. Master sends chunk handle & locations of all replicas which contain the chunk. For reads, client reaches out to closed replica. For performance reasons, client can request information about multiple chunks in the same request. Master generally sends information about subsequent chunks in the same response.</p>
Chunks are stored as 64 MB size plain linux file, which is larger than traditional file system. To make efficient use of disk, it's space is allocated lazily (lazy space allocation), ie, space is not allocated on disk if there's no data. There are many advantages of using a big chunk size - there's less interaction with master, persistent TCP connection with chunkserver, instead of frequently connecting new chunkservers, size of metadata on master is small, and clients themselves can cache multi TB file metadata in memory easily.</p>
One major disadvantage of using big block is, if there is a small file (size less than chunksize), it could face contention if multiple clients request the same file. In general, this is not the common, since files generally span multiple chunks, and client streams data from multiple servers. A way to mitigate could be to increase replication of such files, so request could span to different chunkservers and distribute load.</p>
There is single master, which stores all it's metadata in memory. Metadata stored by master includes:</p>

Mutations to file namespace</li>
Mapping of files to chunks</li>
Mapping of chunks to location of chunk replicas
The first two are persisted to disk as operational log (WAL). Last one is not persisted to disk, but fetched on startup and everytime a chunkserver rejoins. The reason for this is, a chunkserver has sole ownership over which chunks it has locally. Chunks could get corrupted or disks could fail, and keeping this info in sync with master is futile.</li>
</ul>
Storing metadata in memory allows master to do quick scans for various needs. And also serialize critical operations.</p>
Limitation is that file system is limited by how much data can be stored in RAM. In reality, data stored is effectively compressed, only 64B is stored per 64MB chunk. And it's not a serious limitation. And RAM can be increased very easily if required.</p>
For fault tolerance, master's operational logs are replicated on remote server as well. And each request is successfully only if log was written on all the servers.  In case of master failures, we can easily promote any of these servers as master, since they have the same data. To minimize the startup time, logs are checkpointed in background, so that on restart, it just have to read logs from last checkpoint. Checkpoints are B+ tree, which can be directly mapped to memory.</p>
Guarantees</h2>
Consistent</strong>: a file region is said to be consistent if all client read the same data from all replicas
Defined</strong>: a file region is said to be defined if after mutation, the file is consistent and has the mutation performed entirely</p>
Guarantees provided by GFS:</p>

Writes by single client are defined</li>
Concurrent writes by multiple clients are consistent (same data on all replicas), but can be undefined (writes by other clients can be interleaved in between)</li>
Failed writes make the region inconsistent (different replicas may store different data). Leads to data duplication.</li>
</ul>
All replicas must write the record at same offset for the operation to be success.</p>
The onus on recovering from failed write is on client. Client can retry again, but the data may get duplicated. On reads, client has to account for:</p>

extra space, padding</li>
duplicate records (if write fails)</li>
</ul>
Each record written contains checksum, so client can recover from such failures.</p>
Leases</h2>
For writes, master grants a lease (expiry 60s) to one of the replica (primary), the serial order of writes to be applied is decided by primary replica. The expiry of lease is 60s, but replica can extend it indefinitely by piggybacking on heartbeat call. Master can revoke lease before it expires, for eg, when doing snapshotting to ensure no writes happen.</p>
Sequence Diagram</h2>

Client requests master for replicas (including lease owner) of a chunk. If no lease owner found, master grants lease to a replica.</li>
Client caches the metadata provided for a short interval</li>
Client pushes data to nearest replica, which in turn pushes data to next closest replica and so on.</li>
Once all replicas acks that data is received, client sends write request to primary. Request identifies data written earlier. Primary assigns serial order all writes (can be from multiple clients), it applies mutations in that order.</li>
Primary requests secondaries to apply mutation in same serial order</li>
Secondaries responds write completed.</li>
Primary replies to client, Any error encountered is propagated to client, and means write has failed. Client can retry the failed mutation again.</li>
If mutation will overstep the current chunks boundary, primary pads the current chunk with space. It instructs the secondaries to do the same. And returns client to retry again with new chunk.</li>
</ul>
Data flow</h2>
Data and control requests are separated, as the goal is to fully utilize the available bandwidth. Machines have full duplex, allowing them to send and receive at the same time at rate without any throttling. TCP pipelining is used, to start sending immediately the data is received instead of waiting for whole record to be received.</p>
Snapshot</h2>
GFS provides ability to take a quick snapshot of a file or directory. Uses the copy on write technique. When a snapshot is requested:</p>

Master revokes all leases for the chunks, to prevent any further writes</li>
Duplicates the metadata, pointing to the same chunks</li>
Master intercepts any writes on the region performs clone operation. It instructs the replicas to clone C to C' locally. Since data is copied locally rather than over network, this is highly performant.</li>
Any changes are handled in usual fashion</li>
</ul>
Master Operations</h2>
Unlike traditional FS, GFS does not maintain per dir data structure. It maintains a global lookup table, mapping a path to metadata. Read write locks per path node are used to serialize operations. For eg, if reading /d1/d2.../dn/leaf</code>, it acquires, read locks on d1 to dn and write lock on leaf. Read lock prevents node deletion, renaming or snapshoting. This way master can be highly concurrent and work on multiple requests simulatenously. To prevent deadlocks, locks are acquired in same order in ns tree & lexicographical at same level.</p>
Replica Placement</h2>
For new replicas, chunkservers which has below average disk space are chosen. This equalizes disk utilization for the whole cluster. Servers are distributed over mutiple racks, to account for power and switch failures on a rack. On chunk server failures, master rereplicates the chunks on new servers, instructs them to clone from primary. Master does periodic rebalancing to keep cluster in good shape.</p>
Garbage Collection</h2>
When a file or dir, is deleted:</p>

master logs the operation</li>
file is renamed to a hidden file with deletion timestamp</li>
during regular scan, it removes metadata for hidden files older than 3 days</li>
On every heartbeat, chunkserver, replies the chunks it has. Master replies chunks that are free to be deleted.</li>
</ul>
Each chunk has a version number. The highest version is considered up to date. All other stale replicas are gc'd.</p>
High Availability</h2>
Master logs are replicated on remote servers for each request. Due to checkpointing, master can be restarted within seconds. If machine/disk failure happen, a new master can be started on one of the remote servers.</p>
Data Integrity</h2>
Each 64 KB block in chunk is checksummed. If chunkserver detects corruption, it doesn't propagate the corrupted data, and reports error.</p>
Questions</h2>

</li>
</ul>
Related</h2>

linux-file-io-buffering</a></li>
</ul>


Configuring systemd-resolved for DNS
2026-08-19T00:00:00+00:00
Source</strong>:</p>

Install</li>
</ul>
apt install systemd-resolved
</span></code></pre>

Global options /etc/systemd/resolved.conf</code></li>
</ul>
DNS=1.1.1.1 100.100.100.100
</span>Domains=taildace6.ts.net
</span>DNSStubListener=no
</span></code></pre>

Symlink /run/systemd/resolve/stub-resolv.conf</code> to /etc/resolv.conf</code></li>
</ul>
ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf
</span></code></pre>

Restart systemd-resolved</li>
</ul>
systemctl restart systemd-resolved
</span></code></pre>
Questions</h2>

What's the difference between different types of dns configuration tools in linux? #question

https://tailscale.com/blog/sisyphean-dns-client-linux</li>
</ul>
</li>
What are the implications of setting dns config via systemd? #question

https://man7.org/linux/man-pages/man8/systemd-resolved.service.8.html</li>
</ul>
</li>
</ul>
Related</h2>

[[]]</li>
</ul>


For each and count meta argument
2026-08-19T00:00:00+00:00
Ideally each block maps to one infrastructure component. There're two ways to create map multipe by just one block.</p>
count</code></p>
resource "aws_instance" "server" {
</span>  count = 4 # create four similar EC2 instances
</span>
</span>  ami           = "ami-a1b2c3d4"
</span>  instance_type = "t2.micro"
</span>
</span>  tags = {
</span>    Name = "Server ${count.index}"
</span>  }
</span>}
</span></code></pre>
for_each</code> - accepts a map, list or set</p>
resource "azurerm_resource_group" "rg" {
</span>  for_each = tomap({
</span>    a_group       = "eastus"
</span>    another_group = "westus2"
</span>  })
</span>  name     = each.key
</span>  location = each.value
</span>}
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


Networking Modes in UTM
2026-08-19T00:00:00+00:00
You can run apple virtualization VMs in two networking modes on UTM:</p>

Bridged networking

This adds the VM on the same network as your mac, although this works, there're few problems:

if you're connected to wifi, mac bridge might silently drop ARP packets leading to lossed connectivity intermittently.</li>
You're now dependent on the wifi, if you disconnect wifi, you mysteriously lose connectivity</li>
</ul>
</li>
</ul>
</li>
Shared networking

despite what this name suggest, you cannot reach VM1 to VM2</li>
adding forwarding config on mac doesn't work</li>
and this is how this is supposed to be, refs:

https://github.com/utmapp/UTM/issues/4448</li>
https://github.com/utmapp/UTM/issues/6975</li>
</ul>
</li>
</ul>
</li>
</ul>
Questions</h2>

This needs more details to trust the information listed. #question</li>
</ul>
Related</h2>

How connection works for two containers on same host?</a></li>
</ul>


Taking VM snapshots in UTM
2026-08-19T00:00:00+00:00
Source</strong>:</p>
Snapshots</h3>
You can locate the UTM data disk for a VM: ~/Library/Containers/com.utmapp.UTM/Data/Documents/Linux.utm/Data</code>, which is generally a qcow2 image.</p>
Take a snapshot with compression:</p>
qemu-img snapshot F89035CE-DEF9-49D7-97F8-7EC0C2F3F9D9.qcow2 -c snapshot1
</span>
</span>qemu-img snapshot F89035CE-DEF9-49D7-97F8-7EC0C2F3F9D9.qcow2 -l
</span></code></pre>
To revert back the disk:</p>
qemu-img snapshot F89035CE-DEF9-49D7-97F8-7EC0C2F3F9D9.qcow2 -a snapshot1
</span></code></pre>
Questions</h2>

</li>
</ul>
Related</h2>

inspect-vm-filesystem</a></li>
</ul>


Inspect VM filesystem
2026-08-19T00:00:00+00:00
Source</strong>: https://linux.die.net/man/1/guestfish</p>
To inspect files inside VM disk (qcow2, img or other kinds), install guestfish:</p>
apt install libguestfs-tools
</span></code></pre>
guestfish 
</span>> add-ro debian.qcow2
</span>> run
</span>> help mount-ro
</span></code></pre>
Type help gives you what you should do next. You can copy files to host via copy-out /file/in/qcow2 /host/dir/</code></p>
Questions</h2>

There's a way to install os by using qcow2 image (without running the installer). How does that work? #question</li>
</ul>
Related</h2>

dd</a></li>
taking-vm-snapshots-in-utm</a></li>
</ul>


qemu-guest-agent
2026-08-19T00:00:00+00:00
qemu-guest-agent runs inside VM, and basically is a communication channel between host and guest. It enables things like:</p>

Set guests system time</li>
Get information from the guests</li>
Read/write file</li>
Sync/freeze filesystems</li>
Suspend guests</li>
</ul>
It uses a virtio-serial channel, ie, a virtual serial port exposed to guest as a character device, this by passes the normal network stack entirely. On hosts side this is exposed as unix domain socket.</p>
qemu-guest-agent configuration sample</h3>
[general]
</span>daemonize = 0
</span>pidfile = /var/run/qemu-ga.pid
</span>verbose = 0
</span>method = virtio-serial
</span>path = /dev/virtio-ports/org.qemu.guest_agent.0
</span>statedir = /var/run
</span></code></pre>
Sources</h2>

</li>
</ul>
Related</h2>

[[]]</li>
</ul>


How to read a paper
2026-08-19T00:00:00+00:00
Source</strong>: Paper: How to read a paper</a></p>
Why you should read research papers</h2>

To keep up to date with latest developments in your field</li>
Generally a great learning, enhances your system design skills, and help you become more creative problem solver</li>
Do a literature survey of new field you're interested in</li>
</ul>
Three pass approach</h2>
Instead of reading a research paper end to end, consider reading it in passes to grasp the most out of it.</p>
First Pass</h3>

Generally takes 5-10 mins</li>
Gives a high level overview of what it's about and helps you decide if it's really worth your time</li>
First, carefully read abstract & introduction</li>
Read section & sub-section headings, glance at figures, ignore everything else</li>
Read conclusion</li>
</ul>
Second pass</h3>

Should take about an hour or so</li>
Read much more carefully this time, highlighting what you think are the main points. Also free free to add comments/notes in the margin.</li>
You can chose to ignore the proofs</li>
After this, you should be able to summarize what the paper is about</li>
</ul>
Second and half pass</h3>

Re-read your highlights from previous step, take hand written notes of what you think are the main points</li>
</ul>
Third pass</h3>

(Use your notes rather than paper itself)</li>
Virtually reimplement the paper, that is, making same assumptions as author try to recreate the work</li>
Identify and challenge each assumption in every statement</li>
</ul>
Literature survey</h2>
Some tips on finding important papers in a field:</p>

Start with public search engines (google research or arxiv), based on key-words find 3-5 recent papers</li>
From the references, find shared citations & repeated authors, these are key research papers & researchers in the area</li>
Go to the researchers website, find the conferences where they published their work</li>
Go to conferences website, it should contain list of important papers</li>
Iterate</li>
</ul>
Questions</h2>

</li>
</ul>
Related</h2>

how-to-take-smart-notes</a></li>
tips-on-technical-writing</a></li>
</ul>


How to take smart notes
2026-08-19T00:00:00+00:00
Source</strong>: Book: How to take smart notes - Sönke Ahrens</a></p>
Always keep a slip of paper, or your trusted pocket notebook, and a pen with you whenever you're either</p>

Reading an article, book etc</li>
In a meeting</li>
Working on a project</li>
Etc
And take a note of any worthwhile idea you come across. On the back of that note, write the reference details (for eg, page x in book, or article etc).</li>
</ul>
Notes should be taken in a handwritten form, in your own words. Target brevity, just jot down few keywords that'll help you reconstruct it later on when you add permanent notes. Hand writing notes help here, since you're limited by the speed. Copying or highlighting text digitally is less effective, since you take the text out of the context, and it might not strengthen your understanding the way handwriting does.</p>
Next go through your handwritten notes, preferably daily, before you start losing context and start forgetting it. And convert them into permanent notes with full details and necessary context, so that when you comeback to it in future ignorant of what it is, you can still understand them. Note that your note is written from your point of view. People with different interest read same text with different views and focus on different things. That's fine and exactly how it should be.</p>
Your note should discuss one idea/thing at a time. Keep the note concise so it ideally fits on a single screen.</p>
Reflect on the note, and try to find connections with your other existing notes in your notebook. Think about questions and problems to which this note contributes. Ask things which are not stated. Try to find contradictions. Your notebook isn't an archival system where you just dump things and forget, instead make it your thinking. Do you really understand the thing at hand? Try to explain it in your own words. Look for things you can't explain. That's your feedback, work on that. Also connect it with your other notes. Have a dialogue with your notebook. Your focus should be on understanding.</p>
For adding keywords/tags, instead of picking it from the text, use a topic your working on or interested in. It should reflect the circumstances will you stumble on this note.</p>
Add links, on the note to other relevant notes, also on other notes linking back to this one. These interlinks is how you should discover information/connections.</p>
Add a index entry if needed, which acts as entrypoint to your notes about a topic. You shouldn't add every note to index, instead just 3-4 notes. And then you discover other information through interlinks.</p>
Questions</h2>

</li>
</ul>
Related</h2>

how-to-read-paper</a></li>
tips-on-technical-writing</a></li>
</ul>


Some tips on technical writing
2026-08-19T00:00:00+00:00
Source</strong>: https://www.netmeister.org/book/principles-of-system-administration.pdf</p>
Writing is communication. And in tech field, it is one of the crucial skills to master. If you want to share your ideas to wider audience, you need to write blogs, write proposals for conferences, and publish technical papers.</p>
There are two fundamental questions that needs to be asked, before you start writing:</p>

Who your audience will be</li>
What you wish to communicate (What is your objective)</li>
</ul>
Other things (like structure and content) generally follow these decisions.</p>
Know your audience</h2>
Technical writing is in some sense similar to software engineering, just like you need to understand the who the users for your product will be, you need to know your audience will be.</p>
Most of the times the audience is our future selves. Where documentation written today serves as a point of reference in future.</p>
It's always better to state the assumptions made before hand. And not place any assumption on reader's prior knowledge.</p>
Online Documentation</h2>
Most of the stuff we write is meant to be read online in a web browser. There are certain tendencies in web readers, they generally tend to:</p>

skim through the content</li>
extract the important parts</li>
ignore the rest</li>
</ul>
In such cases, you should jump to heart of matter quickly. Keep the sentences short. And use lots of smaller paragraphs rather than a lengthy blocks, generally it doesn't put a lot of cognitive load on the reader. Make good use of sections with appropriate headings, bullet points etc.</p>
Resist the temptation to use illustrations, they should be used as supplements rather than for information. If you are struggling to explain the concept in simpler understandable terms, maybe you do not understand it properly.</p>
If you find it complex to explain something, follow a similar approach to programming and break it into multiple smaller parts. And try to explain each of them individually.</p>
Some in general tips,</p>

if you're documenting command invocation, it's good idea to include actual command and it's output rather than fictiously fabricated one.</li>
if you're writing a FAQ style document, include questions which your reader might want to ask, rather than what you think they might ask.</li>
for project README, it's good to include:

Short summary of what the tool does</li>
Installation steps</li>
Example invocations with expected output</li>
</ul>
</li>
</ul>
Questions</h2>

</li>
</ul>
Related</h2>

how-to-read-paper</a></li>
how-to-take-smart-notes</a></li>
</ul>

Mohit Choudhary - Notes

Gmail Tricks

Dot trick</h3> You can have any number of dots in the email address, for cases, where plus is blocked.</p> m.s.choud.hary@gmail.com </span></code></pre>

Global Internet Routing

Autonomous Systems</h3> At high level, AS, is a bunch of networks grouped together. It could have multiple internal networks with independent IP address space.</p> An AS can control a set of IP address.</p>

IP Allocation

Address Assignment</h3> /8 = RIR</li> /16, /17, /18, /19 = LIR, ISPs, Large business</li> /20 = Small ISPs, Large business</li> /24 = LAN</li> </ul>

Link Local Address

Traceroute/ MTR

Perform AS number lookup</h3> mtr --aslookup yahoo.com </span></code></pre>

Whois

Custom server</h3> $ whois -h whois.cymru.com 142.250.182.46 </span>AS | IP | AS Name </span>15169 | 142.250.182.46 | GOOGLE - Google LLC, US </span></code></pre>

Best Practices

Use Right Model</h3> Sonnet - good with coding</li> Opus - use for complex architectural decisions, and planning</li> </ul> Hooks - run specific command at steps in claude code.</p>

CLAUDE.md, Auto memory

Prompts

Implement</h4>

Without todo</h5> implement it all. do not stop until all tasks and phases are completed. do not add unnecessary comments or jsdocs, do not use any or unknown types. continuously run typecheck to make sure you’re not introducing new issues.</p> </blockquote>

Skills

Subagents

Why</h3> Preserve context</li> Control costs by routing to cheaper models</li> </ul> Advisor tool</h3> Set /advisor</code>, which lower models can consult for architectural and other complex decisions.</p>

Advisor tool</h3> Set /advisor</code>, which lower models can consult for architectural and other complex decisions.</p>

Nginx

Keeping up in tech

Learning pipeline</h3> Explore blogs, articles, talks for finding new stuff</li>

Time management</h3> Exploring, planning & doing each require different mindset. It's better to schedule a separate time for each of these.</p>

Sources</h2> https://codecapsule.com/2021/01/05/how-to-keep-your-tech-skills-sharp-in-a-leadership-role/</li> </ul> Related</h2> </li> </ul>

Related</h2> </li> </ul>

Income Tax Return (ITR)

Income Tax Return (ITR)</h2>

Important Dates</h3> Feb 15. Few months before FY end. Provide investment proof of investment declaration.</li> April 1. Investment declaration. Standard. 1.5 lacs in 80C. Medical Insurance in 80D.</li>

Sources</h2> </li> </ul> Related</h2> income-tax</a></li> </ul>

Related</h2> income-tax</a></li> </ul>

IPv6

Address scopes</h3>

Global Address</h4> Globally unique and routed by the internet.</p>

Subnets

Man pages

Config

Find device name by disk id

Sources</h2> </li> </ul> Related</h2> linux-dev-naming</a></li> </ul>

Related</h2> linux-dev-naming</a></li> </ul>

Linux File IO Buffering

Sources</h2> </li> </ul> Related</h2> gfs</a></li> </ul>

Related</h2> gfs</a></li> </ul>

/proc filesystem

Important files</h3>

Sources</h2> </li> </ul> Related</h2> </li> </ul>

Related</h2> </li> </ul>

Building a datacenter

Pre requisites</h2>

Network</h3> After power, network is 2nd most critical resource. You need a tier 1 ISP and peering with internet exchanges (IX) for low latency. internet-routing</a></p>

Sources</h2> https://blog.railway.com/p/data-center-build-part-one</li> </ul> Related</h2> </li> </ul>

Related</h2> </li> </ul>

Agentic Engineering

Sources</h2> </li> </ul> Related</h2> claude-code-workflow</a></li> </ul>

Related</h2> claude-code-workflow</a></li> </ul>

Java

Thread dump SIGQUIT (kill -3)</h3> Request thread dump on a running java server. Does not terminate the server, useful for troubleshooting issues:</p> kill -3 <pid> </span></code></pre>

Cluster API

ClusterClass</h3> Allows managing multiple cluster objects.</p>

Machine Deployment</h4> Similar to pod deployment, creates machine set, which creates machines.</p>

Machine Pool</h4> Infrastructure specific group of machines</p>

Machine Set</h4> Similar to pod replica set.</p>

Machine Healthcheck</h4> Automatically initiate remediation for missing/unhealthy nodes, by replacing them.</p>

Infrastructure Provider</h3> Component responsible for provisioning compute machines required by cluster or machines.</p>

Bootstrap Provider</h3> Turn the server into kubernetes node using machine/node role specific init (using cloud-init) known as BootstrapData. BootStrapData is used by infrastructure provider to bootstrap machine into node.</p>

KubeAdmControlPlane</h4> Manage set of machines as control plane nodes using kubeadm.</p>

Launchd

List services</h3> launchctl list </span></code></pre> Stop service</h3> launchctl bootout system/<name> </span></code></pre> Start service</h3> launchctl bootstrap system/<name> </span></code></pre>

Stop service</h3> launchctl bootout system/<name> </span></code></pre> Start service</h3> launchctl bootstrap system/<name> </span></code></pre>

Start service</h3> launchctl bootstrap system/<name> </span></code></pre>

Setup socat proxy to remote host

Sources</h2> </li> </ul> Related</h2> network-load-balancing</a></li> </ul>

Related</h2> network-load-balancing</a></li> </ul>

sqlite3

Read and apply sql file</h3> sqlite3 file.db </span>> .read path/migration.sql </span></code></pre>

fstrim

ostree

Sources</h2> https://lwn.net/Articles/581811/</a></li> https://blog.verbum.org/2014/01/21/ostree-in-action-rpm-ostree-and-switching-trees/</a></li> https://github.com/coreos/rpm-ostree/blob/main/docs/background.md</a></li> </ul> Related</h2> [[]]</li> </ul>

Dot trick</h3>
You can have any number of dots in the email address, for cases, where plus is blocked.</p>
`m.s.choud.hary@gmail.com </span></code></pre>`

Autonomous Systems</h3>
At high level, AS, is a bunch of networks grouped together. It could have multiple internal networks with independent IP address space.</p>
An AS can control a set of IP address.</p>
Autonomous Systems Number (ASN) is assigned by IANA along with ip-allocation</a>.</p>

Address Assignment</h3>

/8 = RIR</li>
/16, /17, /18, /19 = LIR, ISPs, Large business</li>
/20 = Small ISPs, Large business</li>
/24 = LAN</li> </ul>

Perform AS number lookup</h3>
`mtr --aslookup yahoo.com </span></code></pre>`

Custom server</h3>
`$ whois -h whois.cymru.com 142.250.182.46 </span>AS | IP | AS Name </span>15169 | 142.250.182.46 | GOOGLE - Google LLC, US </span></code></pre>`

Use Right Model</h3>

Sonnet - good with coding</li>
Opus - use for complex architectural decisions, and planning</li> </ul>
Hooks - run specific command at steps in claude code.</p>

Without todo</h5>

implement it all. do not stop until all tasks and phases are completed. do not add unnecessary comments or jsdocs, do not use any or unknown types. continuously run typecheck to make sure you’re not introducing new issues.</p> </blockquote>

Why</h3>

Preserve context</li>
Control costs by routing to cheaper models</li> </ul>
Advisor tool</h3>
Set `/advisor</code>, which lower models can consult for architectural and other complex decisions.</p>`

Advisor tool</h3>
Set `/advisor</code>, which lower models can consult for architectural and other complex decisions.</p>`

Time management</h3>
Exploring, planning & doing each require different mindset. It's better to schedule a separate time for each of these.</p>

Sources</h2>

https://codecapsule.com/2021/01/05/how-to-keep-your-tech-skills-sharp-in-a-leadership-role/</li> </ul>
Related</h2>

</li> </ul>

Related</h2>

</li> </ul>

Sources</h2>

</li> </ul>
Related</h2>

income-tax</a></li> </ul>

Related</h2>

income-tax</a></li> </ul>

Global Address</h4>
Globally unique and routed by the internet.</p>

Sources</h2>

</li> </ul>
Related</h2>

linux-dev-naming</a></li> </ul>

Related</h2>

linux-dev-naming</a></li> </ul>

`Sources</h2></li> </ul> Related</h2> gfs</a></li> </ul>`

Related</h2>

gfs</a></li> </ul>

Sources</h2>

</li> </ul>
Related</h2>

</li> </ul>

Related</h2>

</li> </ul>

Network</h3>
After power, network is 2nd most critical resource. You need a tier 1 ISP and peering with internet exchanges (IX) for low latency. internet-routing</a></p>

Sources</h2>

https://blog.railway.com/p/data-center-build-part-one</li> </ul>
Related</h2>

</li> </ul>

Related</h2>

</li> </ul>

Sources</h2>

</li> </ul>
Related</h2>

claude-code-workflow</a></li> </ul>

Related</h2>

claude-code-workflow</a></li> </ul>

Thread dump SIGQUIT (kill -3)</h3>
Request thread dump on a running java server. Does not terminate the server, useful for troubleshooting issues:</p>
`kill -3 <pid> </span></code></pre>`

ClusterClass</h3>
Allows managing multiple cluster objects.</p>

Machine Deployment</h4>
Similar to pod deployment, creates machine set, which creates machines.</p>

Machine Pool</h4>
Infrastructure specific group of machines</p>

Machine Set</h4>
Similar to pod replica set.</p>

Machine Healthcheck</h4>
Automatically initiate remediation for missing/unhealthy nodes, by replacing them.</p>

Infrastructure Provider</h3>
Component responsible for provisioning compute machines required by cluster or machines.</p>

Bootstrap Provider</h3>
Turn the server into kubernetes node using machine/node role specific init (using cloud-init) known as BootstrapData. BootStrapData is used by infrastructure provider to bootstrap machine into node.</p>

KubeAdmControlPlane</h4>
Manage set of machines as control plane nodes using kubeadm.</p>

List services</h3>
`launchctl list </span></code></pre> Stop service</h3> launchctl bootout system/<name> </span></code></pre> Start service</h3> launchctl bootstrap system/<name> </span></code></pre>`

Stop service</h3>
`launchctl bootout system/<name> </span></code></pre> Start service</h3> launchctl bootstrap system/<name> </span></code></pre>`

Start service</h3>
`launchctl bootstrap system/<name> </span></code></pre>`

Sources</h2>

</li> </ul>
Related</h2>

network-load-balancing</a></li> </ul>

Related</h2>

network-load-balancing</a></li> </ul>

Read and apply sql file</h3>
`sqlite3 file.db </span>> .read path/migration.sql </span></code></pre>`

`Sources</h2>https://lwn.net/Articles/581811/</a></li> https://blog.verbum.org/2014/01/21/ostree-in-action-rpm-ostree-and-switching-trees/</a></li> https://github.com/coreos/rpm-ostree/blob/main/docs/background.md</a></li> </ul> Related</h2> [[]]</li> </ul>`

Related</h2>

[[]]</li> </ul>

Load partition table changes</h3>
Inform the kernel of partition table changes</p>
`partprobe </span></code></pre>Sources</h2> </li> </ul> Related</h2> GUID Partition Table (GPT)</a></li> </ul>`

Sources</h2>

</li> </ul>
Related</h2>

GUID Partition Table (GPT)</a></li> </ul>

Related</h2>

GUID Partition Table (GPT)</a></li> </ul>

health</h3>
`smartctl --health /dev/sda1 </span></code></pre> all</h3> health is sometimes superficial, check all:</p> smartctl -a /dev/sda1 </span></code></pre>`

all</h3>
health is sometimes superficial, check all:</p>
`smartctl -a /dev/sda1 </span></code></pre>`

Sources</h2>

</li> </ul>
Related</h2>

[[]]</li> </ul>

Related</h2>

[[]]</li> </ul>

Sources</h2>

</li> </ul>
Related</h2>

[[]]</li> </ul>

Related</h2>

[[]]</li> </ul>

Questions</h2>

</li> </ul>
Related</h2>

openssl</a></li>
set-time-on-linux</a></li>
pki-certificates</a></li> </ul>

Related</h2>

openssl</a></li>
set-time-on-linux</a></li>
pki-certificates</a></li> </ul>

Remove passphrase from a private key</h3>
`openssl ec -in input.key -out output.key </span></code></pre>Questions</h2> </li> </ul> Related</h2> certificate-management-using-step-cli</a></li> set-time-on-linux</a></li> pki-certificates</a></li> </ul>`

Questions</h2>

</li> </ul>
Related</h2>

certificate-management-using-step-cli</a></li>
set-time-on-linux</a></li>
pki-certificates</a></li> </ul>

Related</h2>

certificate-management-using-step-cli</a></li>
set-time-on-linux</a></li>
pki-certificates</a></li> </ul>