#infrastructure
7 entries
projects · July 2026
Cairn
A sealed bootc estate: db-signed UKI boot under keys from an offline ceremony, composefs-pinned root, TPM2 unlock bound to a signed PCR11 policy. Images promote only after booting for real in CI.
writing · April 2026
Inference on a Schedule
A nightly CI pipeline that mixes Python and a language model to keep a static site's activity data fresh. The interesting part was discovering which 10% of the work actually needed a model.
writing · March 2026
Building Bootc Images from Scratch
The upstream Fedora bootc images ship 523 packages. We built one with 255 from scratch using dnf --installroot and a Containerfile. No rpm-ostree, no treefile, no inheritance.
writing · March 2026
Kernel Modules as Multi-Stage Container Builds
A pattern for building ZFS and NVIDIA kernel modules in multi-stage container builds for bootc immutable images. No DKMS, no gcc, no kernel-devel in your production OS.
writing · March 2026
LLM-Mediated Experimentation
Giving an LLM access to a real test bench transformed a year-old debugging effort. The root cause was not what anyone thought.
writing · March 2026
On Building a Complicated Foot Gun
Deploying a home server with immutable infrastructure tooling: what the pipeline tested, what it didn't, and what broke anyway.
projects · November 2025
Immutable
FROM-scratch Fedora bootc images with source-built, MOK-signed ZFS and NVIDIA kernel modules. A homelab on an earned, verifiable supply chain.