DevOps / Homelab Feed

Yep, a golden image. I still like having one on hand. That's my set up, and it's hard to argue with something that 'just works' most of the time. I've used clonezilla for applying that golden image. It's free. It's also works fairly well most of the time. So this might be a clonezilla question but I haven't found anything for a clonezilla setting yet. I was already resizing the Recovery partition. Then I found out Microsoft will want a larger System partition. So on a new image, I'll make a larg

I updated my main switch connecting my homelab from an Aruba CX with 1G+10G SFP+ to a Grandstream with 1G/2.5G/10G SFP+. While the CLI takes some time to getting used to, I'm pretty happy with the GWN7822P over all. I have a second switch installed in my fuse box connecting my living room and two other rooms using the pre installed cabling. A HPE/Aruba Instant On 1830 8G in local management is used at the moment. It's powered over PoE from the Grandstream as the power outlet is already taken by

Which is great, because if there was one unsolved problem in 2026, it was finding a way to run a Linux container on a developer's laptop. Microsoft has now given us wslc . I read the architecture deep dive expecting to understand why. I now understand the architecture. submitted by /u/Haunting_Ganache_850 to r/docker [link] [comments]

Broadcom 9400-16i On a new Broadcom 9400-16i I was able to update the firmware from version 16.00 to 22.00 and efibios with success in EFI mode. I used the instructions linked above which were very helpful. When I boot to Windows 11 the HBA controller has 3 line items. The top one is Avago Adapter Crusader Storport Version 2.61.29.80 Driver date 7/21/2017. According to Broadcom’s website the ITSAS35 P24 driver version is 8/9/2022 and version 2.61.48.00. I tried updating the driver from the ITSAS

Hello there! I've been in the selfhosting game for around 1 and a half year now. I would still consider myself a novice. But I have definitely leveled up. My "problem": I currently have a Truenas Scale system up and running with the following apps installed: Immich Plex Jellyfin Tailscale Mealie More or less just Storage things (except from Tailscale). BUT I want to level up. I want to host other things that are not storage things. Mainly Home assistant for example or *arr stacks (I know they ca

I stumbled upon HAVEN a few weeks ago while looking and testing various Discord alternatives. Haven looks and feels like discord, has PTT, soundboard, listen together, bots, and is light weight with an active team of devs behind it. I submitted an issue and the devs had it turned around in a week or so. Give it a crack, if you are looking for discord alternatives I can highly recommend! Haven, a chat server you run yourself ancsemi/Haven: Self-hosted private chat: no cloud, no telemetry, no Big

I posted this here a year ago and it went badly. The criticism was mostly fair. It was a bare link, there were no tests at all, and when I was asked twice how much of it was AI-written I didn't answer. So, answering first: The code is LLM-written and I direct it. Worth being precise about what "the code" is: kinc implements no Kubernetes, it's about 2,900 lines of shell and a handful of systemd units that assemble upstream components (kubeadm, kubelet, etcd, CRI-O, crun, Antrea, Fedora). What's

Hello to everyone. I hope this is the right sub to ask this. For at least 5 years I've been using both Google Photos and OneDrive to back up my photos. While OneDrive isn't perfect, it lays out all my photos in an understandable matter on my PC. All the exif data is contained in the photos and videos itself. When I use Google Takeout to download my entire G Photos library I've noticed that the exif data is separate and all my photos are in confusing folders and such. So i Have 2 problems: Gettin

Hey all, I’ve received notice that the DigitalOcean Open Source Credits Program is sunsetting and will no longer be accepting new applications or renewals. I’ve been fortunate enough to get credits for portchecker.io for many years now, and typically I’m a month away from requiring more credits. I’m currently using their App Platform with a static front end and their $5 container for the backend. I do get alerts for CPU so was looking at bumping to the next one (it gets a lot more traffic than I

This month includes 30+ Microsoft 365 major updates across new features, enhancements, retirements, and behavior changes that admins should review. In the spotlight: Pause all Teams notifications: Teams is introducing a new option to pause all notifications for a specific period , helping users reduce interruptions and stay focused. Prompt injection protection for email: Microsoft Defender for Office 365 is adding prompt injection protection to detect and block malicious email content designed t

My machines spend their nights running long jobs (agents, builds, backups) and I wanted one browser tab showing everything they're doing: every terminal session, what's running on each box, actual GUI windows from the Mac, and the admin panels that only ever listen on localhost. Without opening a single inbound port on anything. What pushed me to build it rather than rent it: every product in this space wants the work to happen on their computer. That's a non-starter for anything touching a priv

I work with Superlinked and we are looking for competitors in the market for some benchmarking exercise. We have designated three small encoders, each on its own pool, each provisioned for a peak that shows up maybe an hour a day. When I finally measured utilization it was in the low single digits, so I have been looking specifically for servers that keep more than one model on a single card. As I work with SIE (Superlinked), we know it keeps models hot on one GPU and evicts least-recently-used

I'm working on a project in my spare time that I've dubbed Lararium(naming follows the Roman theme). It's currently in build phase. It started as a simple AI assistant to replace Googles AI features that I lost when I switched to GrapheneOS(not so much for privacy, but simplicity and minimal bloat.) I host my own LLM and try not to depend on the cloud as much. I started playing around with Muse and then Instinct, and I liked the features, but they are cloud dependent. So I decided that I would t

Post approved by mods. Hey all, I make Cliparr, you might have seen me post updates once in a while. I woke up today and cliparr.dev had a few more stars on GitHub. After checking the insights tab, I noticed some traffic from a podcast, Linux Unplugged. They had insanely awesome things to say about Cliparr and I wanted to share this segment from their episode. I would have embedded the segment directly, but only pictures are allowed in the sub. Click the link for a short version, or skip to 1:17

I'm new to kubernetes so I apologize. I'm trying to design my homelab. This is what I initially came up with. Is this an OK configuration? Looking for feedback. submitted by /u/knlklabacka to r/homelab [link] [comments]

I maybe should have asked beforehand but oh well. Basically I was looking for a decent new switch to replace our current at capacity one. Requirements are 12-24 port gigabit, some SFP+ 10G ports for uplink and my HPC server, ideally rack mount, managed to have vLANs, not extreme power consumption and decent quality so netgear was just right. Yeah and a 100 euro budget which this one fit right in. Does anyone else have it and what are your experiences? Well I bought it already but still what shou

The CNCF ecosystem is pretty vast, gush out about your favourites! [ kubectl , curl , jq and yq go into 'well known' category] submitted by /u/segv to r/kubernetes [link] [comments]

I have been using openmediavault as my NAS os for a while and it has been working great. I have been using its smb/cifs or NFS share to give access to files across my home network. This network share is used as a persistence storage for my containers either run on docker or k8s nodes. (fx. glance dashboard config file, navidrome's music storage and config) But recently i needed a webdav server to do a sync for my super-productivity service. So, i have run a copyparty container on the openmediava

I want to self host my git repos. i have set up gitea and gotten https part working through cloudflare tunnels, but i cant figure out how to set up ssh. i would like to use that since when i try to push through https i need to enter my password which gets annoying. I am also not sold on gitea and might switch to just normal git repos with cgit, but i need to get ssh working for that. i live in an apartment so i dont have control over my router and such which is why i use cf tunnels. I also would

I've been spinning up my BookOrbit and I cannot get it to see the folders in my /mnt directory no matter what I do. I have tried a number of configurations for the BOOK_HOST_PATH in the docker compose file. This is what it currently looks like ${BOOKS_HOST_PATH:-/mnt/synology/BookOrbit/Books}:/mnt/synology/BookOrbit/Books I've been working my way through courses on docker and linux, but I'm just not sure why it won't find the /mnt directory. The drive is mounted on my Debian 13 VM correctly. I c

An ultra-lightweight, offline-first anime library manager for local collections. I built it because while media servers like Jellyfin or Plex are amazing for central home setups, I wanted something local-first for managing anime directly on desktop devices without requiring a running server, Docker containers, or an active internet connection. Offline-First Storage: All progress, metadata cache, and library indexes are stored locally using SQLite. No telemetry, no external accounts required. Aut

What are the best practices for storage when using docker containers. I’m running docker on Ubuntu using my NAS to store the photos for example, but the volume were the Immich database lives is directly on the servers(non-redundant) SSD. I tried putting these onto the nas using NFS I get permission’s errors. Perhaps I should try harder? :-) I’d like to have all of my Doctor containers protected by the same redundancy that my synology has a for all of my data files. Right now if I had a major SSD

I run a small mesh of devices writing to a shared receipt ledger on a 2TB exfat drive. Kept needing a way to prove the ledger had not been altered between snapshots. Wrote one. 447 KB tarball: - x86_64 (glibc) + aarch64 (static musl) - Three binaries: verify, sign, keygen - Signed 943-record sample ledger - Public key included - Zero network calls. Zero runtime deps. Exit 0 = intact, 1 = broken, 2 = usage error. Not a blockchain. Just a file with hash links that anyone can verify in one pass. Of

I have been using Mattermost for years, and I've always been an advocate of the software, as it's, IMO, a pretty good self-hosted chat software. Unfortunately, after a few disappointments at a previous company actually trying (and giving up) to buy a licence, and after their latest actions, which I could only call backstabs (paywalling previously available features, putting arbitrary limits that previously didn't exist, or recently adding nag screens to push people into either buying their licen

We're adopting github actions at work and... they look clunky, bloated and overcomplicated? I've used both Jenkins in the past and Gitlab CI/CD (and bare shell scripts in a past life). It seems to me that gitlab-ci was the pinnacle of code-driven ci/cd (despite having some sharp edges). Also, running github runners in kubernets is quite a fight. Gitlab's runner was so easy and simple to run. Am I missing something ? submitted by /u/znpy to r/devops [link] [comments]

Hello, I’ve often heard good things about the M920Q with 16GB of RAM—getting two or three of them, depending on the use case. I need to host several services, and my current mini PC is already maxed out on RAM (16GB). Thanks. submitted by /u/AnxietyIllustrious to r/selfhosted [link] [comments]

https://control-plane.io/posts/unauthed-to-rce-in-vault-and-openbao/ OpenBao engineers at ControlPlane have chained 4 vulnerabilities to show how under certain conditions, an OpenBao or Vault server can be completely compromised from an unauthenticated position. This is only the second RCE ever found in the Vault codebase. The exploit is highly plausible in real-world environments, requiring only an unauthenticated entry path and a defined Raft snapshot policy to trigger a complete server compro

I currently have my 3rd RMA on it's way back to Ubiquiti, and with that being sad I am considering moving away from them for good. Tired of the constant RMAs and having to setup my network over and over. Wanted to get some opinions of anyone who has made the switch from Ubiquiti to either opnsense or mikrotik. I know they have different UIs and there will be a learning curve to it all but if opnsense has an amazing community that helps new users learn and mikro doesn't, then I'd lean towards opn

Hello. I just set up OpenCloud with EuroOffice on my TrueNas server, using the community apps. I can upload and download files well, but the collaboration/document editing doesn't seem to work. Basically, when I open a document or a spreadsheet, EuroOffice opens the document normally and I can read, edit and save it. However, when I exit the file and the padlock icon dissapears after a few (~5) seconds, the file goes back to its original state and none of the changes I've made save. This happens

Not an expert in Kubernetes, need expert guidance inn two potential single points of failure during Kubernetes rolling updates Admin server: if the admin server unavailable, FEs cannot restart properly, even if available search does not function without the Admin server, any work around? Back-end Search: if one back-end server goes down the portion of index it hosts become inaccessible, resulting in search becoming completely unavailable.. Is this behaviour a limitation in single points of failu

I'm working on an open source mp3 player built on affordable hardware. * $50 - built on the m5 Core2 * has bluetooth, 3.5mm, and a built in speaker * supports SD cards up to 2TB * 500mAh battery, upgradeable to 2000mAh * plays mp3 and flac files * has BPM detection The project is currently a work in progress. The software is open source and available on github This is being built to work with mStream , a selfhosted music streaming server. mStream will be used to manage firmware upgrades and mana

Hello guys I made a drop-in Firebase replacement for an enterprise system I made, and now I'm working on generalising it, en route to open sourcing it. What SSO engines should I add, other than the ones already present in Firebase (Google, Facebook, GitHub, Microsoft)? I know there are many, I just want to know which ones are actually worth it and will be used. A bit about the tool for anyone interested: Without too much pre-release foreshadowing, the backend has a near-identical API reference t

​ We've been migrating a few AKS clusters from local (certificate-based) accounts to Microsoft Entra ID authentication with Kubernetes RBAC, group-bound via RoleBindings instead of individual users. It's gone smoothly on our internal/dev cluster — sign-in works, group-based access works as expected, and day-to-day operations (deployments, scaling, log analytics ingestion) are unaffected. We're now planning to roll the same change out to Production. Along the way we've hit a few gotchas worth men

Article URL: https://www.tcl-lang.org/software/tcltk/9.1.html Comments URL: https://news.ycombinator.com/item?id=49896712 Points: 229 # Comments: 78

Meta-spotted flaw could hand attackers arbitrary code execution via a maliciously crafted file

Explore how Storm-3068 turned a compromised identity into broader cloud access and the steps organizations can take to defend their identities, pipelines, and cloud infrastructure. The post ​​Beyond source code: A path to the keys to the kingdom appeared first on Microsoft Security Blog .

Since January 2026, Microsoft has observed Russian state threat actor Star Blizzard evolve their detection evasion capabilities through large-scale phishing campaigns, the use of accounts on compromised websites, and a novel malware delivery technique, tracked by Microsoft as “RedFlick”. The post Star Blizzard refines phishing and malware delivery with the RedFlick technique appeared first on Microsoft Security Blog .

One of the things that Windows really got right is WSL2. I drive an atomic Linux distro for daily use, but wanted a way to develop with multiple different distros with that same WSL UX. NSL is my answer. It is a faithful reproduction of the developer experience, powered by a single VM that hosts one or more systemd-nspawn containers with your development instances. Host file edits and port sharing come along for the ride, just like WSL. Take a look and tell me what you think... It's yet another

Article URL: https://blog.cloudflare.com/cloudflare-certificate-authority/ Comments URL: https://news.ycombinator.com/item?id=49893144 Points: 27 # Comments: 7

Article URL: https://www.backblaze.com/blog/backblaze-drive-stats-for-q2-2026/ Comments URL: https://news.ycombinator.com/item?id=49893002 Points: 45 # Comments: 2

Following the public preview of Linux containers on WSL, Microsoft today announced the general availability of WSLC for supporting Linux containers on Windows...

A sophisticated attacker with a quantum computer can exploit a protocol design flaw to downgrade post-quantum IPsec tunnels to classical crypto. We helped the IETF develop a transcript authentication extension to prevent these attacks.

Cloudflare learns the structure of your HTTP requests and identifies deviations. You can add a positive security layer that helps reduce attack surface as AI makes it easier for attackers to generate and vary payloads.

Cloudflare has added visibility into post-quantum (PQ) encryption in TLS 1.3 directly into HTTP Analytics, Log Explorer, and Logpush. Learn how to make sure your domain is protected with PQ encryption.

We are expanding access to Cloudforce One's Threat Events Platform to every Cloudflare account and introducing Threat Signals. Threat Signals automatically parses open-source threat reporting, extracts structured indicators, and connects threat context directly to your WAF rules.

It's been a while since any new Spectre vulnerabilities have come to light but that's changing today. The embargo has now lifted on BTR, Branch Target Reuse as a new Spectre-V2 attack affecting just-in-time (JIT) compilers...

Following the FUSE improvements in Linux 7.3 for file-systems in user-space, it looks like the upcoming Linux 7.4 kernel will be ready to enable the large folios feature...

As Kubernetes adoption has grown, the conversation has shifted beyond running containers to managing increasingly complex application lifecycles. Modern platforms support stateless web services, stateful databases, batch processing, AI workloads, and platform services. At the same time, they must remain reliable during upgrades, scaling events, and infrastructure failures. Every Kubernetes user relies on SIG Apps, whether they realize it or not. Deployments, StatefulSets, DaemonSets, Jobs, and C

With the release of Kubernetes v1.37, the Pod-Level Resource Managers feature has graduated to Beta status (disabled by default)! First introduced as an Alpha feature in Kubernetes v1.36 , this enhancement builds on Pod-Level Resources by equipping Kubelet's Topology Manager, CPU Manager, and Memory Manager to use Pod-level resource declarations ( .spec.resources ) directly when making hardware placement decisions. Bringing pod-level resources to node managers Before this feature, obtaining excl

Learn about the key benefits of sandbox environments with Docker including isolation, definable controls, secrets credential handling, and more.

Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software, by far its biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying so many fixes each month.

AI/ML and complex batch workloads continue to push the boundaries of Kubernetes scheduling. Following the foundational workload-centric enhancements introduced in previous releases, Kubernetes v1.37 delivers the next major milestone in the Workload-Aware Scheduling (WAS) journey. In this release, the core Workload and PodGroup APIs—enabling gang scheduling—along with Workload-Aware Preemption (WAP) and shared DRA ResourceClaims for PodGroups, all graduate to Beta, solidifying their role in the K

Modern engineering teams instrument everything, with metrics, logs, traces, and profiles flowing from hundreds of services at once. But full-stack observability isn’t really about collecting more telemetry; it's about having a single, unified picture of how your services connect to every layer beneath them, including their dependencies, the pods and nodes they run on, and the logs, traces, and profiles that explain their behavior. But there's often a quiet problem hiding underneath all that data

Kubernetes v1.37 promotes the metrics.k8s.io API to stable ( v1 ). This API provides CPU and memory usage for nodes and Pods, and is the API behind commands such as kubectl top and resource-metrics-based autoscaling. For cluster operators and application developers, this graduation means that the API now has the stability guarantees associated with a Kubernetes stable API. The v1 API has the same resource types and fields as v1beta1 ; this is an API-version graduation, not a change to the metric

Docker's WeAreDevelopers keynote shows how Sandboxes, Kits, and Cloud Sandboxes give AI agents strong isolation and reproducible authority.

At Grafana Labs, observability is what we do. So as we started building AI agents, we naturally reached for the same instincts we bring to every system: measure it, set targets, and make reliability something you can reason about instead of hope for. That instinct led us somewhere unexpectedly useful. It turns out one of the oldest ideas in reliability engineering, the error budget, maps beautifully onto one of the newest problems in software: how do you know if an AI agent is actually any good?

Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to help defenders detect and disrupt this activity before ransomware deployment. The post Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments appeared first on Microsoft Security Blog .

Run agents on your laptop, in the cloud, and move between them with one command, all safely. Earlier this year we launched Docker Sandboxes: microVM environments where coding agents can work autonomously in a safe way.

Docker is bringing the open source Sandbox Kit Spec to the CNCF, so AI agent permissions become a neutral, vendor independent standard built on OCI.

Docker's Sandbox Kit Specification v3 packages an AI agent's network rules, credentials, and volumes as an ordinary, pinnable OCI image.

Chained Zammad flaws enabled session hijacking, code execution, and root escalation in seconds

Article URL: https://lwn.net/Articles/1097401/ Comments URL: https://news.ycombinator.com/item?id=49928121 Points: 204 # Comments: 134

Article URL: https://aweb.ai Comments URL: https://news.ycombinator.com/item?id=49927587 Points: 9 # Comments: 4

Article URL: https://github.com/Vibra-Ingenn/Janus Comments URL: https://news.ycombinator.com/item?id=49926773 Points: 43 # Comments: 4

I found that I'm not using even 1/3 of vim/vscode features anymore. That's wht I'm building rhun - a small code editor for Linux, Windows and Apple silicon Macs. It obviously has Vim mode, a terminal, Git diffs and a panel for Claude Code or Codex sessions. The editor and pixel renderer share an x86-64 assembly core. For Apple silicon, a build-time translator converts that core to AArch64, with separate platform adapters around it. The latest release can draft commit messages using a local Ollam

At WeAreDevelopers, Docker introduced Cloud Sandboxes, the open Sandbox Kit specification, and a commitment to bring Kits to the CNCF for neutral governance.

We checked out the F5 lab getting over 3x the performance from the same GPU cluster using F5 BIG-IP NEXT for Kubernetes The post Touring the F5 BIG-IP Next for Kubernetes Lab to Make AI Clusters More Efficient appeared first on ServeTheHome .

Dogwood Local Engine checks AI tool calls against user-defined temporal rules before they run

While there have been a number of Ubuntu 26.10 development benchmarks in recent weeks and more on the way, some Phoronix readers have asked about the lack of any early Fedora 45 tests given its recent beta. For good reason, it's largely boring but here are some to illustrate.

Article URL: https://blog.gitbutler.com/git-3-sha-256 Comments URL: https://news.ycombinator.com/item?id=49924179 Points: 170 # Comments: 195

Attackers were probing the mail server flaw weeks before it had a CVE to its name

Ubuntu 26.10 beta is now available for the official Ubuntu editions as well as the various community flavors...

Legacy API begins disappearing from tenants today, with no exceptions after April

With the vast array of wired and wireless networking drivers within the Linux kernel and range of protocols and other networking features, it's a big expanse of code for AI/LLM agents to analyze and critique. The Linux networking developers have acknowledged being "complete overwhelmed" by the AI/LLM-driven patch activity and bug reports as well as battling against AI slop patches. Even though Linux 7.3 stable won't be out for another three weeks, some networking fixes are already being diverted

In addition to the very nice AMDGPU IOMMU optimization for iGPUs set to debut in the Linux 7.4 kernel, over on the AMD EPYC server side for servers running SEV-SNP virtual machines is a separate, nice optimization also expected for this next kernel version...

Longtime ARM Linux maintainer Arnd Bergmann over the past year has been working to clear out a number of old ARM platforms from the mainline kernel tree. With Linux 7.3 many older 32-bit ARM platforms were deprecated and in turn hundreds of kernel drivers orphaned. Now it's on to removing that actual code, which given the amount of entangled code, is itself a challenge...

Rob Clark, who originally started working on the reverse-engineering Freedreno and MSM DRM graphics driver projects prior to even being employed by Qualcomm, presented this week at XDC 2026 Toronto around all the recent efforts they have been pursuing at Qualcomm for this upstream open-source graphics driver stack...

The Renesas SH7305 isn't a new processor and is well known for powering various Casio graphing calculators over the past decde and a half. But finally the mainline Linux kernel may end up seeing support for this 32-bit SH-4a RISC core...

Threat Actors do not always use top-notch techniques or very complex malware to perform their attacks. Sometimes, they just abuse of existing applications...

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Microsoft broke its own cloud but isn’t sure how

Paper: https://www.usenix.org/system/files/atc21-ousterhout.pdf Related: https://lwn.net/Articles/1003059/ , https://www.theregister.com/networks/2026/10/01/stanford-pro... Comments URL: https://news.ycombinator.com/item?id=49957117 Points: 46 # Comments: 12

Article URL: https://blog.jetbrains.com/ai/2026/09/building-a-rag-pipeline-for-semantic-code-search-a-developer-diary-and-field-notes/ Comments URL: https://news.ycombinator.com/item?id=49956148 Points: 33 # Comments: 7

Article URL: https://github.com/net4people/bbs/issues/672 Comments URL: https://news.ycombinator.com/item?id=49956003 Points: 29 # Comments: 0

Linus Torvalds just released Linux 7.3-rc7 as we work toward the stable Linux 7.3 kernel release in two weeks...

This week was the surprising and unfortunate decision of Siemens shutting down the OpenRadioss project as the four year old open-source project started by Altair Engineering with their prominent Radioss finite element solver. Siemens didn't just end the project but they shutdown the GitHub repository that hosted the open-source code and removed other resources that had built around it. Fortunately, there's a new community fork of OpenRadioss as OpenCourant...

Linux's Multi-Gen LRU "MGLRU" has already achieved nice performance gains for Linux in recent years by optimizing page reclaims and improves performance under memory pressure. The new MGLRU-FG patches aim to take things further...

Article URL: https://news.lavx.hu/article/openbsd-developers-reject-uutils-coreutils-port-over-licensing-and-compatibility-concerns Comments URL: https://news.ycombinator.com/item?id=49951648 Points: 31 # Comments: 41

Last month Fujitsu formally announced their MONAKA CPU as a 144 core Arm-based server processor geared for AI infrastructure. This comes after two years of seeing various Monaka patches to the GCC compiler and other open-source components. Now that MONAKA is announced, we are seeing more patches surface for the Linux kernel with this week seeing several workarounds for MONAKA CPU bugs...

We are nearing the cut-off of new Direct Rendering Manager (DRM) subsystem material for the upcoming Linux 7.4 cycle. AMD this week sent in another feature pull to DRM-Next that is moving over to mostly bug fixing but does contain the enablement of some new GPU intellectual property blocks for upcoming graphics hardware...

OpenSUSE developers have announced they are making ZUPT available on their Linux distribution as a solution for providing post-quantum backups. ZUPT combines backup creation, compression, integrity verification, and encryption all via this single open-source utility...

Arm sent out an initial set of patches this week working on support in the Linux kernel for TLBI Domains. This "TLBID" feature is an upcoming Arm architecture capability designed to increase performance on high core count systems...

Article URL: https://www.neowin.net/news/system76-bans-ai-generated-code-across-many-of-its-cosmic-codebases/ Comments URL: https://news.ycombinator.com/item?id=49946321 Points: 91 # Comments: 122

Exploitation attempts came from China-hosted IP, VulnCheck researcher says

https://github.com/nuta/ftl Comments URL: https://news.ycombinator.com/item?id=49944912 Points: 131 # Comments: 54

Article URL: https://github.blog/changelog/2026-10-01-new-dashboard-experience-now-the-default/ Comments URL: https://news.ycombinator.com/item?id=49942818 Points: 73 # Comments: 87

Article URL: https://blog.kagi.com/update-orion-linux-windows Comments URL: https://news.ycombinator.com/item?id=49941447 Points: 171 # Comments: 97

I am excited that storage version migration (SVM) has graduated to General Availability (GA) in Kubernetes v1.37! After a number of releases of work and testing, the built-in StorageVersionMigration API ( storagemigration.k8s.io/v1 ) and control plane controller are now fully stable and enabled by default across all v1.37 Kubernetes clusters. The problem with stale storage versions In Kubernetes, stored API resources are written using a specific storage version (schema representation). The way K

Alert routing often starts simple. A team creates a few contact points, adds some label matchers, and builds a notification policy tree that sends each alert to the right destination. But alerting configurations rarely stay simple. As an organization grows, its notification policy tree must accommodate more teams, services, and routing requirements. Changes for one team still require editing a global configuration, making ownership less clear and independent provisioning harder. Over time, even

Kubernetes v1.37 promotes the PersistentVolumeClaimUnusedSinceTime feature gate to Beta (enabled by default). With this feature, the PersistentVolumeClaim (PVC) protection controller adds an Unused condition to each PVC, telling you whether any running pod currently references it — no custom tooling or cross-referencing required. For the API definition of PVC conditions, see the PersistentVolumeClaim API reference . Read on to learn how the Unused condition works and how to use it. Why track PVC

When something breaks in production, the questions that matter most are also the toughest to answer from metrics alone: who was affected, what did they actually see, and is this worth waking someone up for? Answering those questions requires a fuller picture of the issue and its impact on your users. That’s where Digital Experience Monitoring (DEM) in Grafana Cloud comes in. By combining Frontend Observability and Synthetic Monitoring , DEM connects real user experiences with proactive testing,

Memory QoS has graduated to Beta in Kubernetes v1.37 and is now enabled by default. On Linux nodes running cgroup v2, the feature uses the memory controller to give the kernel better guidance on how to treat container memory. It was first introduced as Alpha in v1.22, and expanded in v1.36 with tiered memory reservation. This post covers what changed in v1.37, what the Beta promotion means for cluster operators, and how to configure the feature. What changed in v1.37 Memory QoS is Beta and enabl

Changed Block Tracking (CBT) support for CSI drivers shipped as Alpha in September 2025. With the March 2026 v1.0.0 release of the external-snapshot-metadata project, the feature moved to Beta . If you aren't yet familiar with changed block tracking for storage in Kubernetes, the Alpha announcement covers the motivation, the three primary components (the CSI SnapshotMetadata gRPC service, the SnapshotMetadataService CRD, and the external-snapshot-metadata sidecar), and a walkthrough of how to us

The new vuln, CVE-2026-88779, is a memory overflow bug that leads to denial of service

Article URL: https://www.githubstatus.com/incidents/3q1yb5m7ltvb Comments URL: https://news.ycombinator.com/item?id=49969961 Points: 92 # Comments: 63

Article URL: https://diff.wikimedia.org/2026/10/05/openai-rogue-agent-activities-found-on-wikimedia-projects/ Comments URL: https://news.ycombinator.com/item?id=49968105 Points: 254 # Comments: 171

AI-assisted bug hunting adds to maintainers' workload, while broad CVE rules help explain the sprawling tally

Article URL: https://itsfoss.com/news/digitalocean-open-source-credits-end/ Comments URL: https://news.ycombinator.com/item?id=49967579 Points: 39 # Comments: 4

The Linux 7.4 kernel is set to introduce support for a new AMD Zen 6 security feature...

Article URL: https://blog.lizzie.io/linux-containers-in-500-loc.html Comments URL: https://news.ycombinator.com/item?id=49965118 Points: 89 # Comments: 21

GNOME 51 is here, and Ubuntu interim releases are getting interesting again

Memory is often the first hard limit a Kubernetes cluster hits. Nodes run out of RAM long before they run out of CPU, and the new wave of agentic AI workloads makes this worse. These workloads demand large memory footprints to start up and run untrusted code, then sit idle waiting for the next prompt. That idle but resident memory is expensive, and it caps how many pods a node can hold. This is where swap helps. Kubernetes support for running nodes with swap enabled reached General Availability

With today's very high memory prices, the Linux ZRAM code for compressed block devices in RAM has seen a rework to provide greater memory savings...

The Mold high speed linker alternative to the likes of GNU Gold/LD and LLVM LLD recently has been going through a rewrite from C++ to Rust as well as having high ambitions of eventually becoming the default linker on Linux systems. Today marks the release of Mold 3.0 for this Rust-based high performance linker...

Back in May we spotted a Linux patch adding "Panther Lake R" as a rugged version of Panther Lake intended for "use in harsh environments". Since Linux 7.2 we have seen some bits of Panther Lake R driver support added while for the upcoming Linux 7.4 cycle there is additional enablement happening for this Panther Lake derivative...

A new patch series sent out from Qualcomm that aims to help at least the Snapdragon X series laptops is hardware-binned trip point support. Some Qualcomm SoCs are available in different multiple thermal/package bins with different junction temperature limits but otherwise being the same silicon. The new Linux patches are working to properly convey that information around the thermal limits for a given piece of silicon...

With the upcoming Linux 7.4 kernel the necessary changes to the AMD P-State driver are set to land for properly supporting the upcoming AMD Ryzen client processors based on the Zen 6 cores...

Kubernetes brings a wealth of features that make it easy to run your production workloads securely and reliably. While aspects like scheduling, health checks and resource limits are probably at the front of your mind, one other important feature of Kubernetes is production identity — how your workload can authenticate to other systems in order to do its job. Up until now, the primary production identity mechanism built into Kubernetes has been service account JWTs (JSON Web Tokens). These are cr

A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 in restitution to victims.

Microsoft details JADEPUFFER-linked Azure reconnaissance, resource deletion, and credential access using compromised service principals, identifying the activity as associated with Storm-3168 and providing guidance for defenders. The post Storm-3168: Agentic-driven cloud attacks using compromised service principals appeared first on Microsoft Security Blog .

I'm excited to announce that native histogram support for Kubernetes metrics is graduating to Beta and is enabled by default in Kubernetes v1.37! Native histograms (previously introduced as Alpha in Kubernetes v1.36 under KEP-5808 ) bring high-resolution, low-cardinality observability to Kubernetes metrics. By adopting Prometheus Native Histograms , Kubernetes components now expose latency and duration metrics with far greater accuracy while significantly reducing telemetry storage and scraping

Kubernetes v1.37 promotes the KubeletInUserNamespace feature gate to beta. With this feature enabled, all of the node components (kubelet, CRI and OCI runtimes, CNI plugins, and kube-proxy) can run as a non-root user on the host, using a Linux user namespace . This technique is also known as rootless mode . The work started as an experiment in 2018, and was merged into Kubernetes v1.22 (2021) as an alpha feature (Kubernetes Enhancement Proposal KEP-2033 ). This feature should not be confused wit

After a decade of false starts, Swift is showing backend appeal

Article URL: https://ziglang.org/download/0.17.0/release-notes.html Comments URL: https://news.ycombinator.com/item?id=49938521 Points: 185 # Comments: 95

Asahi Linux developer Sven Peter today sent out the pull requests of the Apple SoC Device Tree changes they are ready to upstream for the Linux 7.4 merge window happening later this month. Most notable is the initial Device Tree for Apple systems using the base M4 SoC model as well as for the MacBook Neo with the A18 Pro SoC...

Streamline demonstrates how to build long-running, continuous video processing pipelines by pairing Cloudflare Workers and Durable Objects with a containerized media engine.

Sent out on Thursday was the last round of planned Intel Xe kernel driver improvements targeting the upcoming Linux 7.4 cycle. There is one big improvement that is set to benefit Intel discrete GPUs with at least Battlemage benefiting nicely...

Article URL: https://yuka.dev/blog-2026-10-02-linux-m4.html Comments URL: https://news.ycombinator.com/item?id=49933869 Points: 27 # Comments: 0

Ubuntu developer Gianpiero Carpinelli at Canonical has been working on introducing SHA3-256 and SHA3-384 support for Debian's APT packaging tool in preparing for if/when that SHA2 is broken...

Operation KillSwitch takes over leak site holding at least 110 TB of stolen data

Cloudflare AI Gateway now supports native web search API integration in partnership with Ceramic.ai, Exa, and Linkup. Developers can now inject real-time web context into model inference calls via AI Gateway, REST APIs, or Workers bindings.

Quick Tunnels now support email authentication. Add --allowed-mail to one cloudflared command, and only the addresses or domains you list can reach your local app. No Cloudflare account required on either side.

Fraudsters are increasingly using AI to bypass stateless security checks. Cloudflare's new Account Abuse Protection dashboard uses stateful analysis and edge-generated Hashed User IDs to help teams investigate and block account abuse.

We’re announcing the closed beta of a self-serve Cloudflare OHTTP Gateway. We’re also renaming our Privacy Gateway to Cloudflare OHTTP Relay to better distinguish the two products.

A year after pledging to eliminate two-tier product access, Cloudflare has expanded Logpush, multi-account governance, and higher platform limits to all accounts. Here is an update on our progress, how we dogfood these tools internally, and what is coming next.

Cloudflare Traces shows how a request moves through security rules, transformations, cache, routing, Workers, and your origin, then follows it across services running anywhere in your stack.

Cloudflare is launching eight major updates that bring logs, traces, analytics, alerts, dashboards, querying, and telemetry export into one observability platform, with simpler and more predictable pricing.

No login required, exploitation underway, and some admins are still waiting for patches

The newest systemd component being worked on and drafted for an initial pull request is systemd-appd as a new mechanism to centralizing the tracking of user's apps...

Imagination Tech was at XDC 2026 Toronto this week to talk up their ongoing work around their PowerVR Mesa Vulkan driver (and PVR upstream DRM kernel driver) with this driver continuing to improve, plans for supporting their new Volcanic GPU architecture, and other improvements...

As a follow-up to the news one month ago of Intel Nova Lake P's graphics introducing a new 64-bit GPU mode, the latest driver-side enablement has now landed for Intel's Iris Gallium3D OpenGL driver for supporting efficient 64-bit addressing...

Canonical engineer Richard Scott McNew published a status update surrounding the Rust programming language efforts in the upcoming Ubuntu 26.10 release. Sequoia PGP is being rolled out to Ubuntu Linux and in a future release may end up replacing OpenPGP...

Coreboot 26.09 released yesterday as the latest quarterly feature release to this open-source software for replacing proprietary BIOS and system firmware on a growing selection of devices...

KDE Linux developers have been experimenting with a build of their Linux distribution based on BuildStream to ship as an OS image rather than a set of Arch Linux packages. They are nearing a point soon where they will decide if they will officially ship this BuildStream-based KDE Linux image...

Article URL: https://www.deepseek.com/en/harness/ Comments URL: https://news.ycombinator.com/item?id=49929489 Points: 63 # Comments: 24

Hey guys, I have a Linux server in my home running jellyfin (with tailscale). I never had any issue with it, but recently tried to set it up in my grandmother's house as she is ill and watching movies she used to love hopefully helps her distract her mind of the pain. My issue is that my server is old and weak and it doesn't have enough capacity to transcode the videos well. I got a firestick and found out that it doesn't even let me install jellyfin (nor tailscale for that matter). What are my

So I am looking at home servers because 1. I don't trust apps now and 2. I'm sick of subs for everything. So I've got the pc stuff sorted, but what I don't get is how to host my own movies/series, and how I host music etc. Is there apps and a correct way of doing it, or is there an easy way? submitted by /u/Alarmed-Lock-5776 to r/homelab [link] [comments]

https://preview.redd.it/xh90vl8clbth1.jpg?width=768&format=pjpg&auto=webp&s=7897a57e815775851d7c1e141d05b6ce189e2bb5 https://preview.redd.it/9byofm8clbth1.jpg?width=768&format=pjpg&auto=webp&s=e26f8e398abfa4c00d83b507edb8309d51cace85 Thought I’d share my homelab as its grown quite a bit over the last few years. Started off with a NAS and a couple of VM’s and somehow ended up with this 😂 Most of it is retired enterprise kit that I’ve picked up, reused or saved from becoming e-waste. Its probably

I just wanted to pop in and thank the community for your inspiration and help. This is my home server set up currently. It serves all of my needs. Immich, Emby, qBittorrent/qui, *Arrs, and Audiobookshelf. Running Ubuntu 26.04 LTS. submitted by /u/Xielle to r/selfhosted [link] [comments]

Some of you told me that the three servers I was originally looking at were pretty bad, so I went back to eBay and searched again. I found this Dell PowerEdge R610 for €90 + €20 shipping: - 1U rack server - Intel Xeon E5530 (4C/8T, 2.4 GHz) - 24 GB ECC DDR3 RAM - PERC RAID controller - iDRAC 6 - 2× hot-swap PSUs - 2.5" front bays - Caddies/blanks according to the photos - Used/refurbished, tested and working - Business seller My budget is now €100 max for the server itself (shipping can be a lit

I’m thinking about creating an auth layer using my domain and a low cost VPS that will whitelist any ip address I authenticate from for x hours so that I can cast Jellyfin to a tv on the same WiFi/IP without needing to set up tailscale. I expect the front end of the domain would open a tunnel for said IP so that I wouldn’t have to forward any ports. Is this a dumb idea? How difficult would it be for an attacker to 1. Detect an ip is whitelisted on my server and 2. Spoof an IP? My goal is to enab

Helllooo everyone! I figured I would join all the other posts and show what I run. My homelab is a bit of a mix of running services for my family and a testing ground for learning new technology. My entire homelab is Proxmox as the hypervisor, debian VMs to run Docker and Komodo. Forgejo (git) deploys my containers on Komodo. Docker labels control Traefik and exposure. Jupiter My main server, pretty much what I would consider "production" in my house. I pretty much throw everything on this wheth

I have come very far in getting this relic setup but have run into a odd issue. I cannot for the life of me get the server to recognize/not fail loading these drives. Keep failing and refer to then as seagates. Not sure what i am doing wrong or what updates i need to install to the bios to get it to recognize/load them to add to VD. Only thing i have researched and found is to update the PERC controller but no idea how to do that. Any help would be insanely appreciated! You all rock in advance!

Still in the process of setting everything up (which may take some time based on my schedule) but I've got the hardware pretty much set. Top down: Giada F103D running OPNsence (not currently in use and bypassed for now). Networking for the rack that handles the rack itself as well as networking for my house. 12th gen Dell 3000, i5 12500T, 24GB DDR4, running Windows. Two 7th Gen Dell 3050, i5 7600t, 8GB DDR4, one currently running ZimaOS as a file server and the other is sitting idle for now wait

I recently purchased a Network / AV Rack from an individual for a kind of different project. I plan to put 2 PC’s, a NAS, a UPS and a DAC, along with some hard drives in the enclosed rack. The odd thing is there is absolute nothing to identify the rack manufacturer anywhere. I realize I could use parts from another company but it came with 5 - 2U vented shelves that I wish to use, if they are sturdy enough. But, not knowing the manufacturer & model, I do know know what their weight limits are. I

I have a Dell T320 Poweredge server that I’m using to run Jellyfin. It has 32gb of DDR3 ram and an E5-2470v2 processor. Apparently you can use a GPU to allow the server to run higher quality video. How powerful of a GPU do I need to encode 4K (or at minimum 1080p) video? Most in-depth reviews discuss a GPU in terms of either work or gaming, but few of them specifically discuss video encoding alone. Does anyone have any recommendations for GPUs that can do simple encoding for my setup? Thank you!

Hi! I recently got my hands on a reasonably cheap fibre channel LTO 6 drive made by HP. I have a small home server running ESXi and OpenMediaVault on top of that with 20TB of storage... around 8TB of which I need to back up. I am now looking for a piece of software that will ease my backup adventures. The data that I need to back up are mostly videos, pictures and some documents. I want them backed up with the assumption that nothing of this will change. If I have a folder with pictures from 202

I'm trying to buy an old PC to make my first home server. I'm looking for an OptiPlex or something similar, and I've found this HP ProDesk 400 G6 : i5-8500, 16gb of ram and a 256 Go SSD. I'll add a 12To HDD to it. Oh, and it's a micro tower. My question is : is it enough to run my server with Debian as an OS, CasaOS, Jellyfin, Immich, and overall NAS? It's at 120€ and I feel it'll sell fast. Is it a good price? Thanks! Edit : typo submitted by /u/nono-shap to r/homelab [link] [comments]

Everything started with an old laptop... And then it snowballed into this masterpiece! The 3D model is the KWS v.2 Rack Using my old MSI gf63 8rd laptop as my main Docker host and an Optiplex 7010 with a 12500T for my game servers Also the DAS at the bottom for my Jellyfin media submitted by /u/ThatWasEsyGG to r/homelab [link] [comments]

Hii, im thinking to change my beestation 4tb due to the slow machine to load picture and video to my iPhone. Im so done with this beestastion... After brainstorming with chatgpt and looking secondhand hardware locally i got this spec: Cpu: intel12500 Motherboard: gigabyte h610k Ram 16gb ddr5 Ssd 256gb for boot 2hhd 12gb Exos Psu 500watt 1.So my question is this hardware good enough or any contradiction? 2.Do i need to change the Ram for dedicated server PC? Need ECC? 3.If i want to use Jellyfin

Hello guys. I'm planning to purchase an old laptop to practice, learn and host some non long-term services (on Linux) which I don't expect to be a heavy workload. I found this Thinkpad laptop for around 49 USD, is it recommended or should I wait for a better one? Installed RAM: 4.00 GB (DDR3) Processor: Intel(R) Celeron(R) CPU N2930 @ 1.83GHz (1.83 GHz) Graphics Card: 64 MB (Intel(R) HD Graphics) Storage: 112 GB SSD ADATA SU650 Thanks for your help! submitted by /u/OddSweet5915 to r/homelab [lin

I wanted to know how people like onedr0p, bjw-s and buroa organize their home-ops repos, so I went through them. A few patterns stood out: 1. Almost everyone uses the same skeleton home-ops ├── bootstrap # one-time setup before Flux takes over ├── kubernetes │ ├── apps # one folder per namespace, then per app │ ├── components # reusable Kustomize components │ └── flux # Flux's own config ├── talos # node machine configs └── .renovaterc.json5 A lot of this comes from onedr0p's cluster-template, s

Most self-hosting lists are sorted by app category, which is great for deciding what to run. I kept wanting the other thing: how do people like onedr0p, bjw-s and buroa actually structure the repo, and where in their tree do secrets, storage and Renovate live? So I mapped it. Each section of the list is a layer of a typical home-ops repo. Here's what one layer looks like: 04 Secrets ( .sops.yaml ) Tools: SOPS, age, External Secrets Operator In the wild: szinn's and xunholy's .sops.yaml , onedr0p

Hi guys, I'm running a small VXL Q2 thin client with an Intel N3350 CPU and dual Gigabit NICs, powered by Debian and Incus . I bought this machine from a nice guy for just $25, and it has turned out to be a great little homelab server. It runs pfSense along with two LXCs hosting WireGuard, Gotify, Tinyauth, and a few other services. I haven't shut down this machine since last month, and honestly, keeping it running continuously feels like an achievement. I'm attaching its uptime and power consum

My jank home lab! I am running 25tb of space Intel i7 7700 16 Gig ram.. I would love to run a AI but sadly... not GPU... submitted by /u/Impress-Worldly to r/homelab [link] [comments]

I'm building a compact server around the ASRock Rack W880D4U and want to connect an LSI 9400-16i HBA through the MCIO1 port using MCIO to PCIe adapters (linked below). According to the manual, MCIO1 shares lanes with SLOT6 (x16) through a PS7101 PCIe redriver mux. A BIOS setting should split SLOT6 into two exclusive x8 links, one for SLOT6 and one for MCIO1. Problem is nothing connected to MCIO1 is detected, either in the BIOS or in Ubuntu Server. So far I've tried the following: Changing the BI

submitted by /u/haachim to r/homelab [link] [comments]

I have few servers, storage and bla bla If I want to do a gaming server what config should I do ? What I was thinking was : dell r730xd (256gb ram, 14x8tb sas ssd (raidz2), 6x4tb sata (raidz2), 4x2tb nvme) hot sto for running gaming server A hp dl380 gen 9 (256gb ram, 24x 1.2tb hdd) cold sto For a gaming server I know iops are the key for a fast server. I my suggestion is that vm are running on thoses nvme (and others nvme), the game file on 8tb ssd, when it’s been a week not used it’s going int

If not, guess I’ll be the first for these elitedesk. submitted by /u/Protolinux217 to r/homelab [link] [comments]

Repo: https://github.com/libredb/libredb-studio Demo: https://app.libredb.org Youtube : https://www.youtube.com/watch?v=rWANKEDszs4 Deploy it next to your database with Docker or Helm and open it in the browser. No SSH tunnels, no desktop client on every laptop. Postgres, MySQL, Oracle, SQL Server, MongoDB, Redis, ClickHouse, DuckDB, Cassandra and more. MIT licensed, SSO and the AI assistant included. submitted by /u/cevheribozoglan to r/selfhosted [link] [comments]

Hey everyone! At the moment I have a i7-9700k, 64GB of ram, running truenas. It has all my services on it, stuff like arrstack, tailscale, plex, and a few game servers that are currently inactive. I also have another rig with a Intel Xeon D-2141I and 256Gb of ECC ram that I managed to score for a steal. The thing is, my xeon rig is just sitting idle and basically doing nothing right now. I had proxmox on it at some point but even then I didnt install much on it since I'm still super new to this

First photo is where this thing lived when it started: a Dell 1U on a wooden table, monitor balanced on the lid, cables running past the shower door. I'd like to say there was a plan... Second photo is now. **What's in there** - Dual-socket Dell r610 1U, 128GB ECC, ZFS mirrors, Proxmox. Does all the real work. - An older Dell r710 2U that stays powered off six days a week and wakes up over IPMI only to take backups. - A small form factor desktop running the firewall on bare metal. - 8-port manag

I am looking for a Dashboard that has all major info in one spot. I would of course do work from the actual VM Dashboard. I am leaning towards Homarr but I dont see where you can view your VMs logs. does it offer that? do any Dashboards offer that? submitted by /u/Low_Money_633 to r/homelab [link] [comments]

Hp elitedesk g5 705s btw submitted by /u/Protolinux217 to r/homelab [link] [comments]

Hello everyone! A few months ago I got into homelabbing, build up my first small homeserver with an old laptop and Debian, and now somehow got hold of an NetApp NAF 1701 system (for details see below). I'm quite clueless on how I should proceed. I have the feeling starting up the NetApp system with another OS would be a bit too much for me right now, as I also do not have a rack or anything. What's the best I can do with it? I would love to build a bigger homelab with a NAS, more RAM (currently

Thoughts - it seems like the VM names should be app agnostic in this case because they're just hosting docker. But at the same time, I don't know if naming them compute001, compute002 and so on would be a good idea. One idea I had was to work in the VLAN they'll be on. I'm curious to hear how you do it. submitted by /u/MostBasic3425 to r/homelab [link] [comments]