This fixes: restic ‘repository is already locked’ after a killed backup
A killed restic run leaves a lock that blocks every backup. How to confirm no live process holds it, clear the stale lock safely, and prevent overlap with flock.
Delivery & Build
Why I Switched From nvm to fnm for Node Version Management
A hands-on move from the bash-based nvm to the Rust-based fnm: faster terminals, automatic per-project Node switching with –use-on-cd, and the corepack notes.
Don’t forget to write the freeze exception policy before you need to use it
The Christmas change freeze is easy to declare; the exception almost nobody writes down. Before 24 December 2026, put the break-glass rule on one page — who authorises, what qualifies, and what gets recorded.
This Fixes: I Deleted the Wrong Branch — Recovering It From the Reflog
You deleted the wrong branch with git branch -D. Here is how to recover it from the reflog, or with git fsck, before garbage collection removes the commits.
Running Rootless Docker on Ubuntu 24.04: Containers Without Handing Over root
The default Docker daemon runs as root and the docker group is effectively root. Here is how to run rootless Docker on Ubuntu 24.04, and where not to.
Writing Your First Real systemd Service Unit for a Long-Running App
A production-grade systemd service unit for a long-running app on Ubuntu 24.04: restart policy, a dedicated service user, and the sandboxing directives that cost nothing to add.
Scanning Container Images With Trivy in CI
Wire Trivy into GitHub Actions so the pipeline fails on fixable HIGH and CRITICAL CVEs, ignores the unfixable noise, caches the DB and annotates the PR.
Automating Let’s Encrypt Renewals With Certbot and systemd Timers
Unattended TLS renewal done properly: a certbot systemd timer, a deploy hook that reloads nginx only on real renewal, a dry-run to prove it, and expiry monitoring.
Why Did My Trivy Scan Report 400 CVEs I Can’t Fix
A Trivy scan reporting 400 CVEs is unactionable and trains the team to ignore the scanner. Here is how to filter to what you can fix and kill the noise at its root: the base image.
Kubernetes Liveness, Readiness and Startup Probes
Misconfigured Kubernetes probes cause the outages they were meant to prevent. Configure all three deliberately: readiness to gate traffic, liveness to restart the wedged, startup to protect slow boots.