Don’t Panic Over Docker’s Exec Artifacts
A monitor flagged runc --process /tmp/runc-process as suspicious. It's Docker's transient exec artifact — here's why I patched the detector, not the runtime.
Tag Linux
rkhunter Flagged Four Hidden Paths. All Four Were Mine
rkhunter called four paths on my VPS suspicious. Every one was something I put there myself — and the whitelist in /etc/rkhunter.conf is where they belong.
fail2ban Bans That Quietly Do Nothing on Docker Ports
A fail2ban jail reported bans while the wp-login brute force continued, because Docker-published ports traverse FORWARD, not INPUT. The fix is DOCKER-USER.
SSH Brute-Force to Crypto Miner: Hardening a VPS the Hard Way
An unresponsive VPS turned out to be a crypto miner dropped through a brute-forced SSH login. The hardening steps that fixed it, with before/after numbers.
Run LLMs Locally: Ollama, llama.cpp, and What You Need
You don't need the cloud to run a language model. Here's how to run open-weight LLMs on your own hardware — Ollama, llama.cpp, and the trade-offs.