[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqi4e84ry2dm6":3,"$fanuq43nlrv5g":54},{"slug":4,"title":5,"body":6,"summary":7,"tags":8,"author":14,"cover_url":15,"published_at":16,"seo_title":17,"seo_description":18,"reading_minutes":19,"related":20},"swapping-docker-desktop-for-apple-container","Swapping Docker Desktop for Apple's container: one VM per container on your Mac, what runs unchanged from Docker Hub, and where you still need Docker","\u003Cp>Mac developers are posting about replacing Docker Desktop with Apple's own \u003Ccode>container\u003C\u002Fcode> CLI. The tool shipped a stable 1.0 on June 9, 2026, and the current release is 1.5.0 (September 29). It runs Linux containers from ordinary OCI images, so most of what you pull from Docker Hub works, but it does so differently: every container gets its own lightweight virtual machine instead of sharing one big Linux VM.\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad5a4d06ce38bf97b744015\">\u003Cvideo src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad5a4d06ce38bf97b74401b-0-d7eb8784.mp4\" autoplay muted loop playsinline preload=\"metadata\">\u003C\u002Fvideo>\u003C\u002Ffigure>\u003Cp>This post walks through a swap you can try in about 15 minutes on an Apple silicon Mac: install, build an image, run Postgres from Docker Hub with a persistent volume, reach containers by name, and then the list of things that will send you back to Docker.\u003C\u002Fp>\u003Ch2>How it differs from Docker Desktop\u003C\u002Fh2>\u003Cp>Docker Desktop starts one Linux VM and runs all your containers inside it, separated by namespaces. Apple's \u003Ccode>container\u003C\u002Fcode> creates a small VM per container. Two consequences follow:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad59fc26ce38bf97b743ea8\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad59fc26ce38bf97b743ead-0-9d8220d6.png\" alt=\"A conceptual representation of the one-VM-per-container architecture.\" loading=\"lazy\">\u003Cfigcaption>A conceptual representation of the one-VM-per-container architecture.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\u003Cul>\u003Cli>\u003Cstrong>Isolation.\u003C\u002Fstrong> To escape a container, code has to get past a hypervisor, not only kernel namespaces. That is a real gain if you run code you did not write, such as a coding agent's output or a dependency you have not audited.\u003C\u002Fli>\u003Cli>\u003Cstrong>Each container has its own resources.\u003C\u002Fstrong> By default a container gets 1 GB of RAM and 4 CPUs; change that per container with \u003Ccode>--memory\u003C\u002Fcode> and \u003Ccode>--cpus\u003C\u002Fcode>. The image builder runs with 2 CPUs and 2048 MB by default.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>Requirements: Apple silicon and macOS 26. Intel Macs are not supported, and the maintainers say they will not address issues that cannot be reproduced on macOS 26.\u003C\u002Fp>\u003Ch2>Install and start\u003C\u002Fh2>\u003Cp>Download the installer package from the \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fapple\u002Fcontainer\u002Freleases\">releases page\u003C\u002Fa>, install it, then start the system service:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad59fc26ce38bf97b743eb2\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad59fc26ce38bf97b743eb7-0-2510cfde.png\" alt=\"Setting up the container CLI on Apple silicon hardware.\" loading=\"lazy\">\u003Cfigcaption>Setting up the container CLI on Apple silicon hardware.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">container system start\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>On first start it offers to install the recommended Linux kernel (a Kata Containers build). Answer \u003Ccode>Y\u003C\u002Fcode>. Check that everything is up:\u003C\u002Fp>\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">container \u003Cspan class=\"hljs-built_in\">ls\u003C\u002Fspan> --all\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>An empty table is the right answer. \u003Ccode>container --help\u003C\u002Fcode> lists every command; most have the Docker-style names you expect (\u003Ccode>run\u003C\u002Fcode>, \u003Ccode>build\u003C\u002Fcode>, \u003Ccode>exec\u003C\u002Fcode>, \u003Ccode>logs\u003C\u002Fcode>, \u003Ccode>stop\u003C\u002Fcode>).\u003C\u002Fp>\u003Ch2>Build and run an image\u003C\u002Fh2>\u003Cp>This is the example from Apple's own tutorial: a Python web server that serves one HTML page. Save it as \u003Ccode>Dockerfile\u003C\u002Fcode>:\u003C\u002Fp>\u003Cpre class=\"code-block\" data-lang=\"dockerfile\">\u003Ccode class=\"hljs language-dockerfile\">\u003Cspan class=\"hljs-keyword\">FROM\u003C\u002Fspan> docker.io\u002Fpython:alpine\n\u003Cspan class=\"hljs-keyword\">WORKDIR\u003C\u002Fspan>\u003Cspan class=\"language-bash\"> \u002Fcontent\u003C\u002Fspan>\n\u003Cspan class=\"hljs-keyword\">RUN\u003C\u002Fspan>\u003Cspan class=\"language-bash\"> apk add curl\u003C\u002Fspan>\n\u003Cspan class=\"hljs-keyword\">RUN\u003C\u002Fspan>\u003Cspan class=\"language-bash\"> \u003Cspan class=\"hljs-built_in\">echo\u003C\u002Fspan> \u003Cspan class=\"hljs-string\">'<!DOCTYPE html><html><head><title>Hello<\u002Ftitle><\u002Fhead><body><h1>Hello, world!<\u002Fh1><\u002Fbody><\u002Fhtml>'\u003C\u002Fspan> > index.html\u003C\u002Fspan>\n\u003Cspan class=\"hljs-keyword\">CMD\u003C\u002Fspan>\u003Cspan class=\"language-bash\"> [\u003Cspan class=\"hljs-string\">"python3"\u003C\u002Fspan>, \u003Cspan class=\"hljs-string\">"-m"\u003C\u002Fspan>, \u003Cspan class=\"hljs-string\">"http.server"\u003C\u002Fspan>, \u003Cspan class=\"hljs-string\">"80"\u003C\u002Fspan>, \u003Cspan class=\"hljs-string\">"--bind"\u003C\u002Fspan>, \u003Cspan class=\"hljs-string\">"0.0.0.0"\u003C\u002Fspan>]\u003C\u002Fspan>\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Build it, then run it in the background:\u003C\u002Fp>\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">container build --tag web-test --file Dockerfile .\ncontainer image list\ncontainer run --name my-web-server --detach --\u003Cspan class=\"hljs-built_in\">rm\u003C\u002Fspan> web-test\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Each container gets its own IP address on a host network. \u003Ccode>container ls\u003C\u002Fcode> shows it; open that address in the browser (the tutorial's example is \u003Ccode>http:\u002F\u002F192.168.64.3\u003C\u002Fcode>). You can also publish a port to localhost the Docker way:\u003C\u002Fp>\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">container run --name web2 --detach --\u003Cspan class=\"hljs-built_in\">rm\u003C\u002Fspan> --publish 127.0.0.1:8080:80 web-test\ncurl http:\u002F\u002F127.0.0.1:8080\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>The usual inspection commands work as you would guess:\u003C\u002Fp>\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">container logs --follow my-web-server\ncontainer \u003Cspan class=\"hljs-built_in\">exec\u003C\u002Fspan> --\u003Cspan class=\"hljs-built_in\">tty\u003C\u002Fspan> --interactive my-web-server sh\ncontainer stats my-web-server\ncontainer stop my-web-server web2\u003C\u002Fcode>\u003C\u002Fpre>\u003Ch2>Postgres from Docker Hub, with a volume\u003C\u002Fh2>\u003Cp>The official Postgres image runs unchanged. Use a named volume rather than a bind mount: the project's docs say named volumes give better I\u002FO than bind mounts. Set \u003Ccode>PGDATA\u003C\u002Fcode> to a subdirectory, the standard workaround when the mounted volume root is not empty.\u003C\u002Fp>\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">container volume create pgdata\ncontainer run --name pg --detach \\\n  --\u003Cspan class=\"hljs-built_in\">env\u003C\u002Fspan> POSTGRES_PASSWORD=dev \\\n  --\u003Cspan class=\"hljs-built_in\">env\u003C\u002Fspan> PGDATA=\u002Fvar\u002Flib\u002Fpostgresql\u002Fdata\u002Fpgdata \\\n  --volume pgdata:\u002Fvar\u002Flib\u002Fpostgresql\u002Fdata \\\n  --publish 127.0.0.1:5432:5432 \\\n  --memory 2g \\\n  docker.io\u002Flibrary\u002Fpostgres:17\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Check it from inside the container:\u003C\u002Fp>\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">container \u003Cspan class=\"hljs-built_in\">exec\u003C\u002Fspan> pg psql -U postgres -c \u003Cspan class=\"hljs-string\">'select version();'\u003C\u002Fspan>\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Your app on the Mac connects to \u003Ccode>127.0.0.1:5432\u003C\u002Fcode> as before. Stop and delete the container and the data stays in the volume; \u003Ccode>container volume list\u003C\u002Fcode> shows it.\u003C\u002Fp>\u003Cp>One difference from Docker to know before you script cleanup: anonymous volumes are \u003Cstrong>not\u003C\u002Fstrong> removed when a container started with \u003Ccode>--rm\u003C\u002Fcode> exits. And \u003Ccode>container volume prune\u003C\u002Fcode> deletes unused volumes and their contents immediately, with no way back.\u003C\u002Fp>\u003Ch2>Reach containers by name\u003C\u002Fh2>\u003Cp>To let containers find each other (and let you open \u003Ccode>http:\u002F\u002Fmy-web-server.test\u003C\u002Fcode>), set a local DNS domain. Add this to \u003Ccode>~\u002F.config\u002Fcontainer\u002Fconfig.toml\u003C\u002Fcode>:\u003C\u002Fp>\n\u003Cfigure data-post-media=\"6ad59fc26ce38bf97b743ebc\">\u003Cimg src=\"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad59fc26ce38bf97b743ec1-0-18952f75.png\" alt=\"An illustration of container networking and DNS discovery.\" loading=\"lazy\">\u003Cfigcaption>An illustration of container networking and DNS discovery.\u003C\u002Ffigcaption>\u003C\u002Ffigure>\u003Cpre class=\"code-block\" data-lang=\"toml\">\u003Ccode class=\"hljs language-ini\">\u003Cspan class=\"hljs-section\">[dns]\u003C\u002Fspan>\n\u003Cspan class=\"hljs-attr\">domain\u003C\u002Fspan> = \u003Cspan class=\"hljs-string\">"test"\u003C\u002Fspan>\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Then restart the service and register the domain with macOS (this step needs \u003Ccode>sudo\u003C\u002Fcode>):\u003C\u002Fp>\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">container system stop\ncontainer system start\n\u003Cspan class=\"hljs-built_in\">sudo\u003C\u002Fspan> container system dns create \u003Cspan class=\"hljs-built_in\">test\u003C\u002Fspan>\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Containers on the default network can now reach \u003Ccode>pg.test\u003C\u002Fcode> and \u003Ccode>my-web-server.test\u003C\u002Fcode>. On custom networks (\u003Ccode>container network create foo --subnet 192.168.100.0\u002F24\u003C\u002Fcode>), the docs note that bare-hostname lookup is not supported yet; use IP addresses there.\u003C\u002Fp>\u003Ch2>A persistent dev box: container machine\u003C\u002Fh2>\u003Cp>Version 1.0 added \u003Ccode>container machine\u003C\u002Fcode>, a long-lived Linux environment rather than a throwaway container. It maps your macOS user and home directory into Linux, so a command run under \u003Ccode>~\u002Fcode\u002Fapp\u003C\u002Fcode> on the Mac runs in the same directory inside the machine.\u003C\u002Fp>\u003Cpre class=\"code-block\" data-lang=\"bash\">\u003Ccode class=\"hljs language-bash\">container machine create alpine:latest --name dev\ncontainer machine run -n dev\ncontainer machine \u003Cspan class=\"hljs-built_in\">ls\u003C\u002Fspan>\ncontainer machine stop dev\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Apple's docs are blunt about the trade-off: a machine gives up much of the isolation of a regular container, and root inside it can write anywhere in your home directory with your user's permissions. Only create machines from images you trust, and do not use one as a sandbox for agent-generated code. Use a plain container for that.\u003C\u002Fp>\u003Ch2>Where you still need Docker\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Cstrong>Compose.\u003C\u002Fstrong> There is no Compose support. A multi-service app is one \u003Ccode>docker compose up\u003C\u002Fcode> on Docker Desktop and a set of \u003Ccode>container run\u003C\u002Fcode> commands (or a shell script) here. Cloud Native Now reports that the GitHub discussion asking for it has more than 150 replies and no timeline from Apple.\u003C\u002Fli>\u003Cli>\u003Cstrong>Cold starts.\u003C\u002Fstrong> A VM per container costs start-up time. Benchmarks cited by Cloud Native Now found Docker Desktop roughly 4x faster at cold start, while Apple's tool came out about 33% ahead on memory throughput. If your test suite starts dozens of short-lived containers, measure before switching.\u003C\u002Fli>\u003Cli>\u003Cstrong>Small-file I\u002FO.\u003C\u002Fstrong> The same report says small-file I\u002FO lags because of the per-container filesystem model. Large \u003Ccode>node_modules\u003C\u002Fcode> trees on bind mounts are where you will feel it; prefer named volumes.\u003C\u002Fli>\u003Cli>\u003Cstrong>Memory is not handed back.\u003C\u002Fstrong> The resource docs say memory a container frees is not automatically returned to macOS; under pressure macOS swaps, and performance becomes limited by disk. Give each container a realistic \u003Ccode>--memory\u003C\u002Fcode> rather than a generous one.\u003C\u002Fli>\u003Cli>\u003Cstrong>Kubernetes and the Docker ecosystem.\u003C\u002Fstrong> The \u003Ccode>k8s\u003C\u002Fcode> subcommand is experimental (1.5.0 removed \u003Ccode>container k8s start\u003C\u002Fcode> for now), and tools that talk to the Docker socket, such as Testcontainers or IDE integrations, expect Docker's API.\u003C\u002Fli>\u003Cli>\u003Cstrong>Intel Macs and older macOS.\u003C\u002Fstrong> Not supported.\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>Should you switch?\u003C\u002Fh2>\u003Cp>For running a database, a cache and a service or two while you code, \u003Ccode>container\u003C\u002Fcode> does the job with the images you already use, and the per-container VM is a better boundary for untrusted code. If your daily loop depends on Compose files, the Docker socket or many short-lived containers in tests, keep Docker Desktop and try \u003Ccode>container\u003C\u002Fcode> for the isolated cases. The two can sit side by side on the same Mac while you decide.\u003C\u002Fp>\u003Ch2>Sources\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fapple\u002Fcontainer\">apple\u002Fcontainer on GitHub\u003C\u002Fa> (README and docs: tutorial, command reference, networking, volumes, resource usage, container machine)\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fapple\u002Fcontainer\u002Freleases\">apple\u002Fcontainer releases\u003C\u002Fa>\u003C\u002Fli>\u003Cli>\u003Ca href=\"https:\u002F\u002Fcloudnativenow.com\u002Ffeatures\u002Fapple-ships-stable-1-0-of-its-native-container-tool-for-macos\u002F\">Cloud Native Now: Apple ships stable 1.0 of its native container tool for macOS\u003C\u002Fa>\u003C\u002Fli>\u003C\u002Ful>","Apple's container CLI has been stable since 1.0 in June and is at 1.5.0. A hands-on swap: install, build, run Postgres from Docker Hub, reach it by name, and the gaps (no Compose, slower cold starts, memory that is not handed back) that decide whether Docker stays.",[9,10,11,12,13],"docker","macos","containers","devtools","ai-assisted","if.codes","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad59fc06ce38bf97b743ea2-0-d7ac665e.png","2026-10-19T06:50:15.817Z","Swapping Docker Desktop for Apple's container CLI","Install Apple's container on macOS 26, run Postgres from Docker Hub with a volume, reach containers by name, and the gaps that keep Docker around.",5,[21,33,43],{"slug":22,"title":23,"type":24,"summary":25,"tags":26,"author":14,"cover_url":31,"published_at":32,"updated_at":32},"github-agentic-autofix-codeql-backlog","GitHub's agentic autofix is GA: batching 25 CodeQL alerts into one draft PR, what it bills, and how to review the fixes","blog","Agentic autofix for code-scanning alerts went GA on October 15: Copilot explores the repo, fixes, re-runs CodeQL and opens a draft PR for up to 25 alerts at once. Who can use it, how to turn it on, where the cost lands, how to pick a first batch with gh, and a review checklist.",[27,28,29,30,13],"github","codeql","security","code-review","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad48184af8e63ad10e8aaa1-0-4c6cfc5e.png","2026-10-19T00:20:22.102Z",{"slug":34,"title":35,"type":24,"summary":36,"tags":37,"author":14,"cover_url":41,"published_at":42,"updated_at":42},"claude-code-permission-rules-yes-to-all","'Yes to all' is a permission policy: writing Claude Code allow, ask and deny rules that hold up against compound commands and wildcards","Every 'Yes, and don't ask again' writes a rule. Turn that habit into a reviewed .claude\u002Fsettings.json: deny beats ask beats allow, why Bash(git * main) also allows git push, how compound commands are split, and when dontAsk or the sandbox beats bypassPermissions.",[38,39,29,40,13],"claude-code","permissions","developer-tools","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad2fd1602d67a73cf1eaa23-0-68817e09.png","2026-10-17T23:06:09.746Z",{"slug":44,"title":45,"type":24,"summary":46,"tags":47,"author":14,"cover_url":52,"published_at":53,"updated_at":53},"go-1-27-http1-connection-reuse-body-draining","710 ms to 150 ms for 100 requests: what Go 1.27's HTTP\u002F1 connection reuse fixes, and the body-draining habit to keep for older clients","Go 1.27 drains unread HTTP\u002F1 response bodies for you, so a closed-but-unread body no longer kills connection reuse. A runnable test that counts reused connections, the two patterns that broke reuse, and a capped drain helper for Go 1.26 and older.",[48,49,50,51,13],"go","http","performance","networking","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad1d8da69fb9bde4cc895fb-0-e539bbf2.png","2026-10-16T23:32:12.783Z",[55,58,60,63,66,77,88,100,110,121,133,144,156,167,178,187,197,210,224,234,245,256,267,275,286,297,306,317,327,336,345],{"slug":4,"title":5,"type":24,"summary":7,"tags":56,"author":14,"cover_url":15,"published_at":16,"reading_minutes":19,"updated_at":57},[9,10,11,12,13],"2026-10-19T06:50:15.818Z",{"slug":22,"title":23,"type":24,"summary":25,"tags":59,"author":14,"cover_url":31,"published_at":32,"reading_minutes":19,"updated_at":32},[27,28,29,30,13],{"slug":34,"title":35,"type":24,"summary":36,"tags":61,"author":14,"cover_url":41,"published_at":42,"reading_minutes":62,"updated_at":42},[38,39,29,40,13],7,{"slug":44,"title":45,"type":24,"summary":46,"tags":64,"author":14,"cover_url":52,"published_at":53,"reading_minutes":65,"updated_at":53},[48,49,50,51,13],6,{"slug":67,"title":68,"type":24,"summary":69,"tags":70,"author":14,"cover_url":74,"published_at":75,"reading_minutes":65,"updated_at":76},"claude-code-subagent-prompt-cache-ttl","Claude Code subagents get a 5-minute cache even on a subscription: when to set it to 1h, and how to check","On a subscription your main Claude Code conversation gets a one-hour prompt cache, but subagents, workflows and compaction stay at five minutes. The settings that change it, the precedence order, when the pricier 1h write pays off, and how to verify the TTL you got.",[38,71,72,73,13],"prompt-caching","subagents","llm-costs","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ad0968473d443ad8fa7adbe-0-f2f3fe8c.png","2026-10-15T22:21:15.624Z","2026-10-15T22:21:15.625Z",{"slug":78,"title":79,"type":24,"summary":80,"tags":81,"author":14,"cover_url":85,"published_at":86,"reading_minutes":19,"updated_at":87},"postgres-slow-vps-benchmark-the-disk-first","Postgres feels slow on your VPS? Benchmark the disk before you touch postgresql.conf","ClickHouse measured the same Postgres box at 16,030 TPS on local NVMe and 1,734 TPS on a baseline gp3 volume, with most of the gap spent waiting on storage. A 15-minute fio and pg_test_fsync check tells you which side of that table your VPS is on.",[82,83,50,84,13],"postgres","self-hosting","databases","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acdb5d473d443ad8fa7555c-0-dd05a138.png","2026-10-13T05:44:15.759Z","2026-10-13T05:44:15.76Z",{"slug":89,"title":90,"type":24,"summary":91,"tags":92,"author":14,"cover_url":96,"published_at":97,"reading_minutes":98,"updated_at":99},"quoted-tilde-in-path-check","A quoted ~ in your PATH runs whatever sits in .\u002F~\u002F: a one-line check for dotfiles, servers and CI images","export PATH=\"$PATH:~\u002F.local\u002Fbin\" never expands the tilde. Interactive bash hides it, but sh, zsh, env and Python search a folder literally named ~ under the current directory. The check, the fix, and where to grep.",[93,94,29,95,13],"linux","shell","devops","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acd3f0073d443ad8fa743bf-0-c8db0f5d.png","2026-10-12T23:53:16.705Z",4,"2026-10-12T23:53:16.706Z",{"slug":101,"title":102,"type":24,"summary":103,"tags":104,"author":14,"cover_url":107,"published_at":108,"reading_minutes":65,"updated_at":109},"docker-published-ports-bypass-ufw-vps-hardening","Docker publishes ports straight past UFW: hardening a fresh VPS without the firewall rule that does nothing","ufw deny 8080 does not stop a Docker container published on 8080. Docker's own docs explain why. A 15-minute fresh-VPS walkthrough: key-only SSH, ufw, then the two fixes that actually close a container port, and a scan from outside to prove it.",[9,29,105,106,13],"vps","firewall","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6acb12dddbaf8c2bc523d0bb-0-21ee3023.png","2026-10-11T05:42:15.363Z","2026-10-11T05:42:15.364Z",{"slug":111,"title":112,"type":24,"summary":113,"tags":114,"author":14,"cover_url":118,"published_at":119,"reading_minutes":65,"updated_at":120},"deno-deploy-shutdown-exit-guide","Deno Deploy shuts down in six months: moving a small app to Cloudflare Workers, self-hosted Deno in Docker, or Node","Deno is joining Cloudflare: Deploy has six months left and the runtime gets a year of fixes. Write your app as one fetch handler and you can run it on Workers, in a Deno container or on Node. Code for all three, plus what does not carry over.",[115,116,117,9,13],"deno","cloudflare-workers","migration","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac9c181dbaf8c2bc523a0fd-0-caa268de.png","2026-10-10T05:47:19.665Z","2026-10-10T05:47:19.666Z",{"slug":122,"title":123,"type":24,"summary":124,"tags":125,"author":14,"cover_url":130,"published_at":131,"reading_minutes":62,"updated_at":132},"durable-object-alarm-loop-guards","The Durable Object alarm that cost $10,000: guarding setAlarm() loops with backoff, idempotency and a kill switch","Durable Object alarms are at-least-once, retried, and usually rescheduled from inside the handler, which makes a billing loop easy to write. Four guards in TypeScript, a kill switch, and a Vitest test that proves the loop stops.",[126,127,128,129,13],"cloudflare","durable-objects","typescript","cost-control","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac8709b392a85804f209fb3-0-9143ed0c.png","2026-10-09T06:09:10.127Z","2026-10-09T06:09:10.128Z",{"slug":134,"title":135,"type":24,"summary":136,"tags":137,"author":14,"cover_url":142,"published_at":143,"reading_minutes":65,"updated_at":143},"cctld-hijack-counterfeit-certs-caa-accounturi-ct-watch","Counterfeit certs via hijacked ccTLDs: CAA with accounturi and a CT watch for your domains in 15 minutes","Attackers took over the .gh, .sl and .as registries and got 12 valid certificates for Google domains. CAA would not have stopped the hijack. Here is the CAA record that limits the damage afterwards, and a CT watch script that tells you within a day.",[138,139,140,141,13],"tls","caa","certificate-transparency","dns","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac75337392a85804f207d25-0-12f538ac.png","2026-10-08T22:47:12.408Z",{"slug":145,"title":146,"type":24,"summary":147,"tags":148,"author":14,"cover_url":153,"published_at":154,"reading_minutes":65,"updated_at":155},"embeddinggemma-2-qdrant-truncation-recall","EmbeddingGemma 2 in Qdrant: one 740M model for text, images and audio, and what truncating 768 to 128 dims costs your recall","Google's open multimodal embedder runs locally and truncates from 768 to 128 dims. Index one Qdrant collection at three sizes from a single encode pass, then measure recall@10 on your own queries instead of trusting a benchmark.",[149,150,151,152,13],"embeddings","qdrant","rag","open-models","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac5cceedf0d655df505306e-0-d17d0fef.png","2026-10-07T07:21:20.071Z","2026-10-07T07:21:20.072Z",{"slug":157,"title":158,"type":24,"summary":159,"tags":160,"author":14,"cover_url":164,"published_at":165,"reading_minutes":19,"updated_at":166},"cloudflare-access-strict-service-token-auth-migration","Strict service token auth in Cloudflare Access: moving your scripts and CI over before it bites","Cloudflare Access now has a strict mode for service tokens: 401\u002F403 instead of a 302 to the login page, only Service Auth policies count, and no CF_Authorization cookie. New orgs get it forced on from 5 October. A 15-minute check and switch for existing orgs.",[126,161,162,163,13],"zero-trust","ci-cd","authentication","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac4a8860956594c947bd197-0-f768b25b.png","2026-10-06T08:30:13.154Z","2026-10-06T08:30:13.155Z",{"slug":168,"title":169,"type":24,"summary":170,"tags":171,"author":14,"cover_url":175,"published_at":176,"reading_minutes":65,"updated_at":177},"cloudflare-traces-trace-rules-debug-one-customer","Why was that request blocked? Tracing one customer at 100% with Cloudflare Traces and Trace Rules","Cloudflare Traces (open beta) shows a request's path through WAF rules, transforms, cache, Workers and origin as one trace. A recipe: low baseline sampling, a 100% Trace Rule for one host or debug header, traceparent to your origin, OTLP export to your own collector, and what December pricing means.",[126,172,173,174,13],"observability","opentelemetry","tracing","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac338052cb6b40613ac2b7c-0-2294d114.png","2026-10-05T06:22:19.055Z","2026-10-05T06:22:19.056Z",{"slug":179,"title":180,"type":24,"summary":181,"tags":182,"author":14,"cover_url":185,"published_at":186,"reading_minutes":19,"updated_at":186},"copyescape-cve-2026-17106-patch-docker-cp","CopyEscape (CVE-2026-17106): patch docker cp, and stop copying out of running containers","A race in docker cp lets a malicious container write files anywhere the copying process can write on the host. That matters for CI runners and AI-agent sandboxes that copy results out. Check your versions, patch, and change copy-out jobs to stop the container first.",[9,29,183,184,13],"cve","ci","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac218ebfd770659725abe68-0-eee7c8f7.png","2026-10-04T23:51:14.689Z",{"slug":188,"title":189,"type":24,"summary":190,"tags":191,"author":14,"cover_url":194,"published_at":195,"reading_minutes":98,"updated_at":196},"protected-quick-tunnels-vs-tailscale-funnel","Share localhost with three named people: Cloudflare's Protected Quick Tunnels vs Tailscale Funnel","cloudflared 2026.9.3 adds --allowed-mail: your quick tunnel now sits behind an email one-time PIN, checked against an allow-list on your own machine, free and without a Cloudflare account. The commands, what it protects, and when Tailscale Serve or Funnel is the better fit.",[126,192,193,29,13],"tailscale","tunnels","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6ac218d8fd770659725abe3a-0-40f8cb2e.png","2026-10-04T23:19:14.764Z","2026-10-04T23:19:14.765Z",{"slug":198,"title":199,"type":24,"summary":200,"tags":201,"author":14,"cover_url":207,"published_at":208,"reading_minutes":65,"updated_at":209},"si-domains-super-intelligence-data",".si after 'Super Intelligence': did one UN speech move a ccTLD?","Trump renamed AI 'super intelligence' at the UN on 22 September 2026 and Slovenia's .si went from about 190,000 names to almost 276,000 in a month. Registry numbers, prices, and 87 WHOIS checks: the obvious AI names were gone years ago; the compounds went in days.",[202,203,204,205,206,13],"domains","si","tld","data","ai","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abaaee53e21d5cbd14d442d-0-d6243bc5.png","2026-10-04T22:36:14.598Z","2026-10-04T22:36:14.599Z",{"slug":211,"title":212,"type":24,"summary":213,"tags":214,"author":14,"cover_url":220,"published_at":221,"reading_minutes":222,"updated_at":223},"palantir-agent-stack-python","Steal Palantir's agent stack: typed tools, one LLM gateway, swappable models","An X thread boils Palantir's AIP docs down to four agent patterns. We check each one against the docs, then build them in one stdlib-only Python file: typed business-object tools, a gateway that masks PII, caches and retries, a model set in config, and schedule\u002Fevent\u002FAPI triggers.",[215,216,217,218,219,13],"ai-agents","llm","python","architecture","palantir","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abd88f9c951ea7137fa3872-0-48eb7eee.png","2026-10-01T23:05:10.531Z",10,"2026-10-01T23:05:10.532Z",{"slug":225,"title":226,"type":24,"summary":227,"tags":228,"author":14,"cover_url":230,"published_at":231,"reading_minutes":232,"updated_at":233},"claude-code-effort-levels","Effort levels in Claude Code: when max effort pays off and when it just burns tokens","Anthropic's effort deep dive (Terminal-Bench 3.0 plus three builds) shows higher effort mostly buys verification and edge-case testing, not smarter code. A rule of thumb per task type, the commands to set effort, and a script to measure cost vs pass rate on your own repo.",[38,229,216,40,13],"ai-coding","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abd88edc951ea7137fa3804-0-2716005a.png","2026-10-01T22:32:14.139Z",9,"2026-10-02T04:44:58.001Z",{"slug":235,"title":236,"type":24,"summary":237,"tags":238,"author":14,"cover_url":241,"published_at":242,"reading_minutes":243,"updated_at":244},"agentic-inbox-cloudflare-setup","Self-host an AI email agent on Cloudflare Workers: agentic-inbox set up and costed","Cloudflare's open-source agentic-inbox runs a full email client on Workers, with one SQLite Durable Object per mailbox and a Kimi K2.5 agent that drafts replies. Covers the post-deploy steps people miss (Access, sending, routing, mailbox first) and the cost.",[126,239,215,240,83,13],"workers","email","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abd88dac951ea7137fa378b-0-5b0ec96d.png","2026-10-01T08:17:18.646Z",8,"2026-10-05T05:56:11.919Z",{"slug":246,"title":247,"type":24,"summary":248,"tags":249,"author":14,"cover_url":253,"published_at":254,"reading_minutes":243,"updated_at":255},"audit-ai-agent-public-traces","Nearly a million leaked links: auditing what your AI agents leave on the public web","OpenAI's agent swarm left almost a million public shortener URLs holding credentials. Here's a tested shell + gitleaks audit to find the shortlinks, pastes and webhooks your own agents created, scan them for secrets and close the channels.",[29,250,251,252,216,13],"agents","secrets","gitleaks","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abaad873e21d5cbd14d4397-0-0f4f51f7.png","2026-10-01T07:43:19.642Z","2026-10-01T08:44:43.041Z",{"slug":257,"title":258,"type":24,"summary":259,"tags":260,"author":14,"cover_url":264,"published_at":265,"reading_minutes":243,"updated_at":266},"mikrotrick-check-patch-mikrotik","MikroTrick: check and patch your MikroTik in 15 minutes","Two chained RouterOS bugs give anyone who can reach SSH full admin, no password needed, and attacks started before the patch. Find exposed SSH, check the version, grep for the published IoCs, patch and move management behind WireGuard.",[29,261,262,263,83,13],"mikrotik","routeros","ssh","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abcd9c0838b650cb96b3d10-0-6cd107e0.png","2026-10-01T07:02:15.03Z","2026-10-01T08:44:41.391Z",{"slug":268,"title":269,"type":24,"summary":270,"tags":271,"author":14,"cover_url":272,"published_at":273,"reading_minutes":243,"updated_at":274},"agent-sandbox-dns-egress-lockdown","Your agent sandbox leaks through DNS: lock down egress in 15 minutes","An OpenAI model escaped its sandbox by tunnelling questions through DNS. Here is a tested Docker Compose setup for coding agents: a DNS allowlist, a logging egress proxy and a kill switch that actually fires.",[29,9,250,141,83,13],"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abaaca13e21d5cbd14d4306-0-cb93fe1b.png","2026-10-01T03:00:15.943Z","2026-10-01T08:44:43.165Z",{"slug":276,"title":277,"type":24,"summary":278,"tags":279,"author":14,"cover_url":283,"published_at":284,"reading_minutes":62,"updated_at":285},"who-blocks-ai-crawlers-robots-txt","Who blocks AI crawlers? robots.txt vs the network edge, with numbers","I scanned robots.txt on the top 300 sites: 33 of 138 block GPTBot, 14 block training but allow AI search. What each AI bot directive controls, why robots.txt is only a request, and a copy-paste policy plus nginx rule for small SaaS sites.",[206,280,281,126,282,13],"robots-txt","seo","saas","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abcd9c1838b650cb96b3d1b-0-11f94198.png","2026-09-30T21:00:20.673Z","2026-10-01T20:47:34.092Z",{"slug":287,"title":288,"type":24,"summary":289,"tags":290,"author":14,"cover_url":294,"published_at":295,"reading_minutes":98,"updated_at":296},"bullet-time-with-first-last-frame-video","Bullet time with first\u002Flast-frame video: orbiting a frozen moment from three stills","A freeze-frame camera orbit built from generated stills: one action shot, two camera-move angles, two first\u002Flast-frame clips between them, stitched and ping-ponged. The pipeline, the seams, and where the model re-imagines the water.",[206,291,292,293],"comfyui","video-generation","flowdsl","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abae46c45201648bfd477a7-0-6f4d036e.png","2026-09-28T22:42:41Z","2026-09-28T22:42:41.6Z",{"slug":298,"title":299,"type":24,"summary":300,"tags":301,"author":14,"cover_url":303,"published_at":304,"reading_minutes":62,"updated_at":305},"an-ai-media-pipeline-that-shows-its-work","An AI media pipeline that shows its work: ComfyUI presets, FlowDSL routing and the misses","How the images on my sites are generated: four ComfyUI presets behind one Go module, job rows as state, FlowDSL flows for routing, per-post media in the admin — and the bugs and model misses I hit shipping it. This post's own images were made the same way.",[206,293,291,302],"image-generation","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6aba8ba317ceba3543925be4-0-2f6b8a5c.png","2026-09-28T15:57:50Z","2026-10-01T20:47:34.327Z",{"slug":307,"title":308,"type":24,"summary":309,"tags":310,"author":14,"cover_url":313,"published_at":314,"reading_minutes":315,"updated_at":316},"openai-embeddings-python-mongodb","Transforming Text into Vectors: OpenAI Embeddings in Python","Learn how to generate text embeddings with the OpenAI API in Python to power semantic search, recommendations, and more. Includes practical examples with MongoDB integration and cost analysis.",[311,206,217,312],"openai","mongodb","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c2d-0-2e60b732.png","2024-11-23T00:00:00Z",3,"2026-09-28T22:31:01.385Z",{"slug":318,"title":319,"type":24,"summary":320,"tags":321,"author":14,"cover_url":323,"published_at":324,"reading_minutes":325,"updated_at":326},"check-pricing-availability-ing-domains","Last Chance to Grab Short .ING Domains: The Extended List Part II","Welcome back to the second part of our exciting exploration into the .ING domain zone! This time, I've expanded our horizons to bring you an even larger selection of .ING domain names. List of over 24,000 domain names inside.",[202,322],"business","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c38-0-c55f4c8d.png","2023-12-14T00:00:00Z",1,"2026-09-28T22:31:01.453Z",{"slug":328,"title":329,"type":24,"summary":330,"tags":331,"author":14,"cover_url":332,"published_at":333,"reading_minutes":334,"updated_at":335},"impressive-ing-domains","Unveiling the Impressive .ING Domains","Discover the vast potential of the new .ING domain zone in my latest blog post! I've used AI and a Python script to unearth a treasure trove of available domain names. From budget-friendly picks to exclusive premium domains, there's something for every ambition. Plus, a special list of unique, lesser-known domains awaits.",[202,322],"https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c43-0-03be24b7.png","2023-12-11T00:00:00Z",2,"2026-09-28T22:31:01.527Z",{"slug":337,"title":338,"type":24,"summary":339,"tags":340,"author":14,"cover_url":342,"published_at":343,"reading_minutes":315,"updated_at":344},"secured-web-server-in-5-minutes","Fortify Web Server Security in 5 Minutes with Tailscale","Tailscale revolutionizes secure networking with its user-friendly approach, effortlessly connecting devices across diverse networks.",[106,192,341],"webserver","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c4e-0-eae6f62d.png","2023-11-03T00:00:00Z","2026-09-28T22:31:01.597Z",{"slug":346,"title":347,"type":24,"summary":348,"tags":349,"author":14,"cover_url":352,"published_at":353,"reading_minutes":65,"updated_at":354},"lets-encrypt-free-ssl","How to Secure Your Website with Free SSL Certificates for a Lifetime","Let’s Encrypt certificates have revolutionized internet security by providing free, automated, and widely trusted SSL\u002FTLS certificates. The non-profit Certificate Authority (CA) has significantly contributed to a more secure web environment by simplifying the process of securing websites with HTTPS.",[350,351,341],"ssl","https","https:\u002F\u002Fmedia.stufio.com\u002Fmedia\u002Fifcodes\u002Fmediagen\u002F6a\u002F6abad0fa45201648bfd46c59-0-bf2a9a0a.png","2023-11-01T00:00:00Z","2026-09-28T22:39:13.555Z"]