PHP2Shell in Docker: Two PHP Runtimes Nobody Listed
PHP2Shell is fixed in the PHP runtime, so a Docker image needs a newer PHP such as 8.3.36, not an app update. I found PHP inside mailcow and an LMS on my host, and patched both.
Posts
Prometheus, Grafana and Loki: What to Alert On First
What a small team should alert on first with Prometheus, Grafana and Loki: page-or-ticket alerts and a heartbeat, timed in a lab where one log alert failed silently.
Linux Kernel CVE Patching: Installed Is Not Patched
Linux kernel CVE patching splits at the hypervisor. A VPS provider patches the host kernel, sometimes with a restart; you patch and reboot every kernel you run yourself, as CVE-2026-99999 showed.
Fine-Tuning vs RAG for a Self-Hosted LLM: Facts or Behaviour
Retrieve for facts, fine-tune for behaviour. In a Qwen3 demo, retrieval took a changed fact in 0.014 s while LoRA missed 3 of 8 facts, yet LoRA got a JSON contract right 10 of 10.
Postgres Schemas Behind FastAPI: Nine Namespaces, Not Walls
Nine Postgres schemas in one database held 5 connections where nine databases held 45. Map with __table_args__, set Alembic include_schemas, and expect foreign keys to cross schemas.
Vault Secret Rotation Fails in the Application, Not Vault
HashiCorp Vault secret rotation causes application downtime when a worker reads its credential once. Static roles do not overlap, and three fixes have measured costs in a Vault 2.1.2 sandbox.
n8n MCP Agent Workflow in Production: Where the Agent Stops
In an n8n MCP agent workflow, the agent drafts and n8n holds publishing. Postiz's schedulePostTool takes a type of draft, schedule or now, so the limit is a parameter n8n must pin.
Web Audio Scheduling Drift: Right in Code, Late in the Room
A Web Audio metronome on setTimeout drifts because the JavaScript timer and the audio clock are two clocks. A lookahead scheduler on currentTime fixes it, measured before and after.
Claude API OCR on Financial-Aid Letters: Check the Math, Not the Reading
LLM OCR on financial-aid letters: a strict schema, deterministic normalising, sums that must reconcile, and flags for people. Reading the page is only the first check.
ESP32 Provisioning and MQTT Reconnects: Offline Is Normal
ESP32 firmware has to treat offline as normal: Wi-Fi provisioning that does not fight the radio, capped reconnects with backoff, an MQTT outbox that expires in 30 seconds, and a local gateway.
Trivy and Snyk Gates in GitLab CI: What Should Block?
A Trivy and Snyk security gate in a GitLab CI pipeline earns its place by blocking the right merge: fixable critical and high findings stop, the rest report, and every ignore expires.
Qdrant and BGE-M3: Hybrid Search Without a Second Model
BGE-M3 produces dense and sparse vectors from one pass, so Qdrant can run hybrid search for production RAG without a second embedding model: prefetch both, fuse with RRF, filter early.
The Payload Migrate Hang: a Flag That Did Nothing
payload migrate hangs in CI when a dev-mode marker row waits on a y/N prompt no runner can answer. The documented flag does not reach that command. Deleting one row does.
face-api.js Privacy: Verify It in the Network Tab
A privacy claim worth trusting is one you can check. The Network tab on a live face-api.js app shows the model weights load once, then zero requests while the camera runs.
AWS to Self-Hosted Migration Cost Starts With Paperwork
An AWS to self-hosted migration for sensitive data moves stateless services first and databases last, after procurement and KYC. The real cost is the operations you take back in house.
Web MIDI Permission, statechange and the Stuck Note
A Web MIDI app has three states to track: permission, device and connection. When an input disconnects, release every note it started, or the note sticks after the device returns.
Self-Hosting Next.js and Payload on One VPS: What Broke
How one VPS runs Next.js and Payload behind Cloudflare and nginx: the request path, why the build needs a self-hosted runner, migrations on deploy, scheduled publishing, and what is not covered.
AGENTS.md vs CLAUDE.md: Read by Five Tools, Enforced by None
A shared AGENTS.md file gets five AI coding tools reading the same rules. It does not make them follow the rules: that still needs review guidelines and a CI gate that actually checks.
Green Deploy, Stale Page: Docker's Layer Cache, Not Next.js
A Next.js deploy passed build, migrate, health check and smoke test, yet the live site kept serving the old content. The cause was Docker's layer cache.
Why a Loading Screen Can't Wait for React to Hydrate
A React-driven loading overlay can't leave before the bundle it hides has hydrated, because that's the same cost it's meant to be covering for.
Why generateMetadata in Next.js Must Be Async
A synchronous metadata builder reading an unprimed module-scope snapshot put localhost:3000 in page titles and emptied their Person JSON-LD across ten routes.
Why backdrop-filter Breaks After a Lightning CSS Build
Lightning CSS merges duplicate backdrop-filter declarations and keeps the wrong one, deleting a glass effect and the containing block it quietly provided.