Adam Faris
@af9.us
Writing about systems and storage at https://amf3.github.io
Wow. I wonder what kind of UEFI mischief we can get into? 😃
September 1, 2026 at 6:32 PM
Wow. I wonder what kind of UEFI mischief we can get into? 😃
I finally figured out how to match veth endpoints on the host to #Docker containers on #Linux by mapping network namespaces.
Here's a gist if you need to figure out which veth device to run tcpdump against.
gist.github.com/amf3/ca6b910...
Here's a gist if you need to figure out which veth device to run tcpdump against.
gist.github.com/amf3/ca6b910...
How do I map a VETH pair to a Docker Container?
How do I map a VETH pair to a Docker Container? GitHub Gist: instantly share code, notes, and snippets.
gist.github.com
August 30, 2026 at 2:41 PM
I finally figured out how to match veth endpoints on the host to #Docker containers on #Linux by mapping network namespaces.
Here's a gist if you need to figure out which veth device to run tcpdump against.
gist.github.com/amf3/ca6b910...
Here's a gist if you need to figure out which veth device to run tcpdump against.
gist.github.com/amf3/ca6b910...
A fun find. multikernel.io has created a multi-kernel kernel. A spawn kernel off lines hardware devices (CPU, MEM, PCIE) and kexe’s a child kernel to run on the offline resources. Essentially a HW partitioner like IBM Z’s LPAR but for x86. Not sure I'll get to it, but it looks interesting.
Multikernel Technologies - Split-Kernel Architecture for Linux
Multikernel turns servers you own and VMs you rent into a private cloud: bare-metal performance, kernel-level isolation, no hypervisor, no virtualization tax.
multikernel.io
August 29, 2026 at 6:30 PM
A fun find. multikernel.io has created a multi-kernel kernel. A spawn kernel off lines hardware devices (CPU, MEM, PCIE) and kexe’s a child kernel to run on the offline resources. Essentially a HW partitioner like IBM Z’s LPAR but for x86. Not sure I'll get to it, but it looks interesting.
I was excited to try #QEMU 11.1.0 on #macOS after learning the hvf accelerator supports nested virtualization. I tested a #Multipass image on M2 silicon and initially thought the Ubuntu image didn’t have #KVM support.
It turns out you need M3 or newer Apple Silicon for nested virt. Womp-womp …
It turns out you need M3 or newer Apple Silicon for nested virt. Womp-womp …
isNestedVirtualizationSupported | Apple Developer Documentation
A Boolean value that describes whether the platform configuration supports nested virtualization.
developer.apple.com
August 26, 2026 at 11:23 AM
I was excited to try #QEMU 11.1.0 on #macOS after learning the hvf accelerator supports nested virtualization. I tested a #Multipass image on M2 silicon and initially thought the Ubuntu image didn’t have #KVM support.
It turns out you need M3 or newer Apple Silicon for nested virt. Womp-womp …
It turns out you need M3 or newer Apple Silicon for nested virt. Womp-womp …
I discovered #docker buildx can bind mount files from one build stage into another. This simplifies #distroless container image modifications when combined with Busybox.
Instead of writing a new post, I updated my existing tips and tricks with Busybox.
amf3.github.io/articles/vir...
Instead of writing a new post, I updated my existing tips and tricks with Busybox.
amf3.github.io/articles/vir...
No Shell in Your Container? No Problem
Injecting Busybox into Minimal/Distroless Containers
amf3.github.io
July 11, 2026 at 7:34 PM
I discovered #docker buildx can bind mount files from one build stage into another. This simplifies #distroless container image modifications when combined with Busybox.
Instead of writing a new post, I updated my existing tips and tricks with Busybox.
amf3.github.io/articles/vir...
Instead of writing a new post, I updated my existing tips and tricks with Busybox.
amf3.github.io/articles/vir...
I like educational posts, but this includes the challenge of "how fast could I answer"?
For just_enough minimal containers, I'd say 3-5 minutes. Long enough for me to either extract the SBOM from the container image or to click the #buildroot project link on gitlab.
github.com/amf3/just_en...
For just_enough minimal containers, I'd say 3-5 minutes. Long enough for me to either extract the SBOM from the container image or to click the #buildroot project link on gitlab.
github.com/amf3/just_en...
June 29, 2026 at 9:13 PM
I like educational posts, but this includes the challenge of "how fast could I answer"?
For just_enough minimal containers, I'd say 3-5 minutes. Long enough for me to either extract the SBOM from the container image or to click the #buildroot project link on gitlab.
github.com/amf3/just_en...
For just_enough minimal containers, I'd say 3-5 minutes. Long enough for me to either extract the SBOM from the container image or to click the #buildroot project link on gitlab.
github.com/amf3/just_en...
Pi-Hole felt too heavy. I wanted a local recursive resolver that supports ad-lists, split horizon records, and reporting. The final runtime is a #distroless Unbound DNS container. The config generator can be found here: github.com/amf3/adlist_...
#selfhosted #docker
#selfhosted #docker
June 29, 2026 at 3:14 AM
Pi-Hole felt too heavy. I wanted a local recursive resolver that supports ad-lists, split horizon records, and reporting. The final runtime is a #distroless Unbound DNS container. The config generator can be found here: github.com/amf3/adlist_...
#selfhosted #docker
#selfhosted #docker
FYI: Fees for the California Parks Historian Passport pass have been waived until July 6th. www.gov.ca.gov/2026/06/17/g...
Governor Newsom announces special free pass to California’s state historic parks in honor of Juneteenth and America’s 250th anniversary | Governor of California
www.gov.ca.gov
June 20, 2026 at 1:06 AM
FYI: Fees for the California Parks Historian Passport pass have been waived until July 6th. www.gov.ca.gov/2026/06/17/g...
I didn't know that #Golang had these compile options for AVX instructions. Useful for CPUs made after 2011.
lemire.me/blog/2026/06...
lemire.me/blog/2026/06...
How much do amd64 microarchitecture levels help in Go?
Our 64-bit Intel and AMD processors have evolved over decades. When you compile a Go program for a 64-bit Intel or AMD processor, the compiler targets, by default, a nearly 20-year-old instruction set...
lemire.me
June 17, 2026 at 5:17 PM
I didn't know that #Golang had these compile options for AVX instructions. Useful for CPUs made after 2011.
lemire.me/blog/2026/06...
lemire.me/blog/2026/06...
Lessons from my software supply chain adventures.
* Control the build pipeline, control the artifact.
* Declaritive image contents are the goal. Small image sizes are a byproduct.
* Stop waiting for vendor patches. Update the base git hash & rebuild.
Resulting in a 51MB #Python flask app.
* Control the build pipeline, control the artifact.
* Declaritive image contents are the goal. Small image sizes are a byproduct.
* Stop waiting for vendor patches. Update the base git hash & rebuild.
Resulting in a 51MB #Python flask app.
June 16, 2026 at 5:08 PM
Lessons from my software supply chain adventures.
* Control the build pipeline, control the artifact.
* Declaritive image contents are the goal. Small image sizes are a byproduct.
* Stop waiting for vendor patches. Update the base git hash & rebuild.
Resulting in a 51MB #Python flask app.
* Control the build pipeline, control the artifact.
* Declaritive image contents are the goal. Small image sizes are a byproduct.
* Stop waiting for vendor patches. Update the base git hash & rebuild.
Resulting in a 51MB #Python flask app.
I just found out BusyBox can self generate all its applet links. This could be handy if you want to inject a shell into a #distroless or minimal container image.
"/bin/busybox --install -s /bin"
Screenshot is an example Dockerfile showing how this is done.
"/bin/busybox --install -s /bin"
Screenshot is an example Dockerfile showing how this is done.
June 2, 2026 at 4:43 AM
I just found out BusyBox can self generate all its applet links. This could be handy if you want to inject a shell into a #distroless or minimal container image.
"/bin/busybox --install -s /bin"
Screenshot is an example Dockerfile showing how this is done.
"/bin/busybox --install -s /bin"
Screenshot is an example Dockerfile showing how this is done.
I'm exploring self-hosted software supply chains and building appliance style containers from #buildroot generated binaries.
Today I got OCI image attestation working on an Unbound DNS container build. Seeing provenance attached from build system to container image feels like a big milestone.
Today I got OCI image attestation working on an Unbound DNS container build. Seeing provenance attached from build system to container image feels like a big milestone.
May 15, 2026 at 6:40 PM
I'm exploring self-hosted software supply chains and building appliance style containers from #buildroot generated binaries.
Today I got OCI image attestation working on an Unbound DNS container build. Seeing provenance attached from build system to container image feels like a big milestone.
Today I got OCI image attestation working on an Unbound DNS container build. Seeing provenance attached from build system to container image feels like a big milestone.
I wrote a runc wrapper that uses bpftrace to log openat system calls made by an application inside a Docker container. It turns out static analysis misses a lot.
amf3.github.io/articles/vir...
amf3.github.io/articles/vir...
Container Image Validation
Ensuring containers have what they need. Nothing more, nothing less.
amf3.github.io
May 1, 2026 at 7:23 AM
I wrote a runc wrapper that uses bpftrace to log openat system calls made by an application inside a Docker container. It turns out static analysis misses a lot.
amf3.github.io/articles/vir...
amf3.github.io/articles/vir...
Why does a Python container need a Perl interpreter?
It's not wrong but it's unexplained.
Here's a demo showing how a manifest is applied to a scratch image so every file exists with intent. No need for a base image or removal of existing packages.
amf3.github.io/articles/vir...
It's not wrong but it's unexplained.
Here's a demo showing how a manifest is applied to a scratch image so every file exists with intent. No need for a base image or removal of existing packages.
amf3.github.io/articles/vir...
Declarative Builds
Demonstrating an Opinionated Build Process for Container Images
amf3.github.io
April 18, 2026 at 6:41 AM
Why does a Python container need a Perl interpreter?
It's not wrong but it's unexplained.
Here's a demo showing how a manifest is applied to a scratch image so every file exists with intent. No need for a base image or removal of existing packages.
amf3.github.io/articles/vir...
It's not wrong but it's unexplained.
Here's a demo showing how a manifest is applied to a scratch image so every file exists with intent. No need for a base image or removal of existing packages.
amf3.github.io/articles/vir...
I finally wrote this up: amf3.github.io/articles/vir...
What I found interesting wasn't what's in the base image but how much content is present without intent.
Looking forward I'm planning for better declarative builds with a new approach in github.com/amf3/just_en...
What I found interesting wasn't what's in the base image but how much content is present without intent.
Looking forward I'm planning for better declarative builds with a new approach in github.com/amf3/just_en...
April 13, 2026 at 2:31 AM
I finally wrote this up: amf3.github.io/articles/vir...
What I found interesting wasn't what's in the base image but how much content is present without intent.
Looking forward I'm planning for better declarative builds with a new approach in github.com/amf3/just_en...
What I found interesting wasn't what's in the base image but how much content is present without intent.
Looking forward I'm planning for better declarative builds with a new approach in github.com/amf3/just_en...
I'm going to drop this here and see who notices. 👀
Yes it's related to a new article I'm writing.
No it doesn't need to be this way.
Yes it's related to a new article I'm writing.
No it doesn't need to be this way.
March 9, 2026 at 5:53 AM
I'm going to drop this here and see who notices. 👀
Yes it's related to a new article I'm writing.
No it doesn't need to be this way.
Yes it's related to a new article I'm writing.
No it doesn't need to be this way.
Nice. I just noticed the #zrepl project updated their Go dependencies in the recent 0.7.0 release. Tooling with earlier versions was getting long in the tooth. #zfs
zrepl.github.io/changelog.html
zrepl.github.io/changelog.html
Changelog — zrepl latest documentation
zrepl.github.io
February 28, 2026 at 4:46 PM
Nice. I just noticed the #zrepl project updated their Go dependencies in the recent 0.7.0 release. Tooling with earlier versions was getting long in the tooth. #zfs
zrepl.github.io/changelog.html
zrepl.github.io/changelog.html
If you're tired of the "Docker vs Podman" marketing noise, it's time to look at the OCI spec under the hood. I built an image manually with just tar and sha256sum to prove a point.
amf3.github.io/articles/vir...
#OCI #Containers #DevOps #Hacking #Docker #Podman
amf3.github.io/articles/vir...
#OCI #Containers #DevOps #Hacking #Docker #Podman
Open Container Image Format
From Local TAR file to Open Container Image
amf3.github.io
February 24, 2026 at 8:16 AM
If you're tired of the "Docker vs Podman" marketing noise, it's time to look at the OCI spec under the hood. I built an image manually with just tar and sha256sum to prove a point.
amf3.github.io/articles/vir...
#OCI #Containers #DevOps #Hacking #Docker #Podman
amf3.github.io/articles/vir...
#OCI #Containers #DevOps #Hacking #Docker #Podman
Apparently running “apt autoremove” on Ubuntu 25.10 can remove netplan. Without netplan, networking does not survive the reboot, so fun times. At least I still remember how to bring up an interface manually.
February 7, 2026 at 4:04 AM
Apparently running “apt autoremove” on Ubuntu 25.10 can remove netplan. Without netplan, networking does not survive the reboot, so fun times. At least I still remember how to bring up an interface manually.
To make CoreDNS recursively resolve addresses I need to link and compile against libunbound?
coredns.io/manual/setup...
Then why not run unbound? I must be missing something.
coredns.io/manual/setup...
Then why not run unbound? I must be missing something.
CoreDNS: DNS and Service Discovery
Setups Here you can find a bunch of configurations for CoreDNS. All setups are done assuming you are not the root user and hence can’t start listening on port 53. We will use port 1053 instead, using ...
coredns.io
February 4, 2026 at 5:12 AM
To make CoreDNS recursively resolve addresses I need to link and compile against libunbound?
coredns.io/manual/setup...
Then why not run unbound? I must be missing something.
coredns.io/manual/setup...
Then why not run unbound? I must be missing something.
I just discovered a-Shell for IOS. It’s like reliving the coLinux on WindowsXP days. I can write markdown in Textastic and use a-Shell to push markdown changes to git repos or even running code. 🤯
holzschu.github.io/a-Shell_iOS/
holzschu.github.io/a-Shell_iOS/
a-Shell
A text-based user interface for a screen-based platform
holzschu.github.io
February 3, 2026 at 4:17 PM
I just discovered a-Shell for IOS. It’s like reliving the coLinux on WindowsXP days. I can write markdown in Textastic and use a-Shell to push markdown changes to git repos or even running code. 🤯
holzschu.github.io/a-Shell_iOS/
holzschu.github.io/a-Shell_iOS/
I finally found the feature that has me wanting to switch from Make to Just. Just has command line argument support.
just.systems/man/en/setti...
just.systems/man/en/setti...
Setting Variables from the Command Line - Just Programmer's Manual
just.systems
February 1, 2026 at 8:11 PM
I finally found the feature that has me wanting to switch from Make to Just. Just has command line argument support.
just.systems/man/en/setti...
just.systems/man/en/setti...
Huh. #podman has a rest API with coarse grained access like #docker. If I can read the Podman socket I can dump secrets within the container.
I know the API is disabled by default, but enabling it seems to have similar risk as rootless Docker. I never stop being amazed by marketing.
I know the API is disabled by default, but enabling it seems to have similar risk as rootless Docker. I never stop being amazed by marketing.
January 24, 2026 at 6:09 PM
I was checking backlinks and realized I ended up on Hacker News. news.ycombinator.com/item?id=4656...
I mean it's not front page content but baby steps right? 😃
I mean it's not front page content but baby steps right? 😃
Docker Socket Myths | Hacker News
news.ycombinator.com
January 19, 2026 at 5:03 AM
I was checking backlinks and realized I ended up on Hacker News. news.ycombinator.com/item?id=4656...
I mean it's not front page content but baby steps right? 😃
I mean it's not front page content but baby steps right? 😃