Foreman
guest@6admin.io:~$ ls ~/tags/foreman
One Blocking Pin, Four CVEs: The Band-Aid That Wins Is the One That Disappears
How a security audit on a Dockerized Foreman stack turned into merged contributions in Foreman core, Dynflow and Jenkins.
wimcast: building Windows images on Linux, without Windows
A PyPI-published tool that turns Windows ISOs into a Foreman-ready WIM tree, unprivileged on Linux: no Windows host, no root, no mount(2), no FUSE, no ADK. Drop-in replacement for the PowerShell pipeline it retired, with a content-addressed cache and a pinned wimboot.
The cloned hostgroup that refused to save
A cloned Foreman hostgroup throws a 500 on every edit. The trail leads to a field that gains a base64 layer with each clone and in passing to a Windows administrator password stored reversibly in the database and copied into the audit logs.
A persistent volume is not durable data
After a hard power loss, PowerDNS's MySQL comes back empty. The host records are gone, nobody noticed and the only reason the story ends well is that the source of truth had survived.
The boot chain, from GRUB to UKI
Why Canonical is trimming signed GRUB for 26.10, why GRUB-encrypted /boot was a false friend and what the modern answer to the Evil Maid attack actually looks like.
Secure Boot and PXE: the chicken, the egg and four ways out
Booting blank Windows machines over PXE with Secure Boot on, without turning it off: the UEFI chain of trust, why snponly over ipxe and four real ways out of the enrollment paradox.
Docker Swarm to Kubernetes: why I abandoned Swarm
Swarm works well for small deployments. But no rootless, no CSI, no autoscaling and a MACVLAN pinned to a single node: the four walls that forced the migration.
Recompiling your kernel: bespoke kernels for your own infra
The deepest form of hardening by subtraction: compile your own kernel, strip at build time the subsystems you never use, ship it as a .deb in your own repo with pinning and manage it at scale with Katello. The thrill and its price: a test pipeline on real hardware and canaries.