Even with systemd‑resolved becoming the default in most modern distros, that old /etc/hosts file is still the fastest way to pin a name to an IP on a single box or a tiny LAN. I’ve seen people drop the file entirely, thinking DNS is always the answer, and then run into a maze of “host not found” errors. The culprit? systemd‑resolved quietly skipping some /etc/hosts entries—especially the ones that look like subdomains of a local domain.
Rootless Podman runs containers as an unprivileged user. That’s great for security, but it also means the container’s view of the host filesystem is filtered through the user‑namespace mapping. When you try to bind‑mount a host path that the container’s UID/GID can’t access, the mount silently fails and the container reports a permission‑denied error. The problem is not the mount itself; it’s the mismatch between the host’s ownership/SELinux context and the container’s user namespace.
[Read More]After a kernel upgrade, Ubuntu 24.04 can sometimes drop straight into emergency mode if the initramfs can’t mount the root filesystem. The prompt usually looks like:
Emergency mode
You are in emergency mode. The root filesystem is mounted read‑only.
Below is a practical walk‑through of the most common culprits and how to bring the root back online without compromising security.
root= parameter points at a UUID that no longer exists (think LVM snapshot churn or a fresh partition).The emergency shell gives you a minimal environment with the root filesystem mounted read‑only, which is perfect for debugging without risking further damage.
[Read More]The /srv/web directory is usually the spot where you keep static assets, CMS themes, or a shared workspace for a handful of developers. In most setups the files are owned by root or a dedicated web user, but the team still needs to edit or upload content without juggling ownerships. That’s where Access Control Lists (ACLs) come in handy: they let you grant a specific group write rights while keeping the original ownership hierarchy intact.
[Read More]Rootless Podman runs containers as an unprivileged user, so a bind‑mount that works for root often fails with “Permission denied.” That error is usually a mismatch between the host directory’s ownership/permissions and the container’s user namespace. Below is a quick checklist that gets the mounts working again while keeping the isolation tight.
| Cause | Why it happens | Typical symptom |
|---|---|---|
| File ownership | The host directory is owned by root or another UID that the container’s user can’t read/write. | mount: permission denied or open /data/file: Permission denied inside the container. |
| SELinux/AppArmor context | The host directory’s security context blocks the container’s process. | Same “Permission denied” even when file permissions look right. |
| User‑namespace mapping | Podman maps container UID 0 to a non‑zero host UID. If the host directory is owned by root, the mapped UID has no rights. | Error appears only when --userns=keep-id is omitted. |
| Mount options | Using :Z/:z incorrectly or omitting them when SELinux is enabled. |
SELinux denies the mount, causing the error. |
Match ownership
[Read More]After a kernel upgrade the initramfs is rebuilt automatically.
If a module slips through the cracks or a hook gets mis‑configured, the
machine will drop into emergency mode with a terse prompt:
Emergency mode – root account password required
You’re not stuck forever; the problem is almost always a missing or
mis‑mounted filesystem, a bad fstab, or a broken initramfs that can’t
mount the root partition. Below is a practical walk‑through that keeps
your data safe and pays attention to security.
dhclient is the classic DHCP client on most distributions.
When a network interface comes up, it writes a line for every lease
request, renewal, and release. On a busy server or in a homelab with
multiple interfaces, those lines can fill the journal within minutes,
making journalctl -b noisy and slowing down log‑based monitoring.
Systemd’s syslog.d directory lets you filter messages before they
reach the journal. A single rule is enough to silence all dhclient
output:
Running an SSH service usually lets you try both password and key authentication. Most of the time key‑only is the safer bet, but you might want to enforce it only for a handful of high‑privilege accounts—developers, sysadmins, or anyone who needs to keep a tight grip on the machine. OpenSSH’s Match directive makes that a breeze without touching the global defaults.
Open the daemon configuration:
[Read More]A running DHCP server can generate thousands of “client request” and “lease granted” messages every hour. On busy networks this inflates /var/log/syslog to 10 k lines a day, making it hard to spot genuine errors and bloating disk usage. The service must stay online, so the goal is to silence the noise without turning the daemon off.
Disabling dhcpd or dhcp-server removes the spam but also removes the ability to hand out IPs. In a homelab or small office you may have a separate DHCP server (e.g., a router) that you can stop, but in many setups the Linux box is the sole DHCP provider. The logs are useful for troubleshooting mis‑configurations, but the volume is excessive.
If you’re sharing a directory between a handful of people, the first thing most folks do is chmod 777. I’ve seen that go wrong when a rogue script deletes everything. ACLs let you fine‑tune permissions per user or group while keeping the directory’s ownership sane.
Below is a step‑by‑step guide that shows how to enable ACLs, set up a shared folder, and maintain it securely on a modern Linux system (kernel 6.x, systemd 250+). The examples use setfacl and getfacl, the standard ACL utilities that ship with most distributions.