#homelab
6 entries
projects · July 2026
Cairn
A sealed bootc estate: db-signed UKI boot under keys from an offline ceremony, composefs-pinned root, TPM2 unlock bound to a signed PCR11 policy. Images promote only after booting for real in CI.
writing · July 2026
Service-to-Service Routing in Rootless Podman
Part one isolated the network planes. The sequel: if every service is in its own plane, how do they talk? The answer is FQDN-everywhere through one always-available local router. Getting there meant a hunt through link-local host access, an SSRF guard that rejected it, pasta's --map-guest-addr, and a careful reading of what podman upstream has actually decided. Plus an epilogue: what happened when the pattern met the whole fleet, and the upstream patch that lets the workaround retire.
writing · June 2026
Network Plane Isolation in Rootless Podman
Two podman networks alone don't segment traffic in rootless mode, and isolate=true silently fails when netavark uses its iptables backend (the default on Fedora 43 and earlier) thanks to an iptables-nft bug. The root cause, the fix, and how Fedora 44 made it disappear.
writing · March 2026
On Building a Complicated Foot Gun
Deploying a home server with immutable infrastructure tooling: what the pipeline tested, what it didn't, and what broke anyway.
writing · March 2026
Rootless Podman Pods Leak Subordinate UIDs
Rootless Podman pods leak subordinate UIDs onto the host filesystem. The pod abstraction was the constraint, and named networks fix it completely.
projects · November 2025
Immutable
FROM-scratch Fedora bootc images with source-built, MOK-signed ZFS and NVIDIA kernel modules. A homelab on an earned, verifiable supply chain.