sysadmin

sysadmin

This article contains the most relevant commands and examples to administrate a linux system and networking

installation

I mainly use ubuntu and apt

packages

apt list installed packages

apt list --installed

cleanup packages

sudo apt update
sudo apt clean
sudo apt autoclean
sudo apt autoremove
pip cache purge

disk space

Clean disk space

journalctl --disk-usage
sudo journalctl --vacuum-size=200M  # clean up old entries
sudo truncate -s 0 /var/log/syslog 

Check syslog

# Check recent entries
tail -n 50 /var/log/syslog   # or /var/log/messages on RHEL/CentOS
# Look for repeating patterns (replace with actual hostname/service)
grep -c "your-hostname" /var/log/syslog
grep -i "error\|warn\|debug\|fail" /var/log/syslog | tail -n 20
# Check file size & age
ls -lh /var/log/syslog*
stat /var/log/syslog

# Debian/Ubuntu (rsyslogd)
cat /etc/logrotate.d/rsyslogd
# Check if rotation is actually running
systemctl status logrotate.timer   # or cron service

# Check if it's running & its status
systemctl status <service-name>
# Temporarily stop it to halt logging
sudo systemctl stop <service-name>
# Check kernel messages (if dmesg is spamming)
dmesg | tail -n 50

# Safe truncation (releases disk space immediately)
sudo truncate -s 0 /var/log/syslog
# Or rotate manually & compress
sudo logrotate -f /etc/logrotate.d/rsyslogd   # force rotation

sudo systemctl restart rsyslogd   # or syslog-ng, depending on your distro

sudo snap list --all | awk '/disabled/{print $1, $3}' |
    while read snapname revision; do
        sudo snap remove "$snapname" --revision="$revision"
    done

npm

pnpm has better options than npm because it reuses many installation libraries

sudo apt install npm
sudo npm install -g pnpm

to check what packages we installed

npm list -g

/usr/local/lib
└── eslint@10.4.1

npm ls -g 

/usr/local/lib
└── eslint@10.4.1

pnpm

I prefer pnpm which shares node_modules directories

pnpm config set store-dir ~/.pnpm-store
#cat "store-dir=~/.pnpm-store\nshamefully-hoist=true\nglobal-dir=~/.config/node_modules\ncache-dir=~/.cache/pnpm\ncolor=auto\nloglevel=info" > ~/.npmrc
pnpm config get store-dir

uninstall

Remove package

dropbox stop
dropbox status  # Should report "not running"
rm -rf ~/.dropbox-dist
rm -rf /var/lib/dropbox
rm -rf ~/.dropbox*
sudo apt-get remove nautilus-dropbox
sudo apt-get remove dropbox
rm /etc/apt/source.d/dropbox

fix broken

Fix broken not working

sudo dpkg --force-all --configure -a
sudo dpkg --purge --force-depends libnettle6 
sudo apt --fix-broken install
sudo apt-get -f install
sudo apt update & sudo apt upgrade

sysadmin linux

sys info

lsb_release -a
uname -a

Distributor ID:	Ubuntu
Description:	Ubuntu 26.04 LTS
Release:	26.04
Codename:	resolute
Linux manitro 7.0.0-29-generic #29-Ubuntu SMP PREEMPT_DYNAMIC Fri Jul 17 20:52:35 UTC 2026 x86_64 GNU/Linux

conky

To monitor system performances ref.

Write a .conkyrc where we display system info. Elegant, transparent, discrete with a sci-fi look. I need to know CPU, GPU, NPU, RAM, VRAM, temperature, fans, disk space

sudo apt install conky-all lm-sensors 

A running example

use_xft yes
xftfont HandelGotD:size=9
xftalpha 0.5
update_interval 4.0
total_run_times 0
own_window yes
own_window_type normal
own_window_transparent yes
own_window_hints undecorated,below,sticky,skip_taskbar,skip_pager
double_buffer yes
minimum_size 200 5
maximum_width 220
draw_shades no
draw_outline no
draw_borders no
draw_graph_borders yes
default_color grey
default_shade_color red
default_outline_color green
alignment top_right
gap_x 12
gap_y 48
no_buffers yes
uppercase no
cpu_avg_samples 2
override_utf8_locale yes
 
TEXT
 
${alignc 35}${font Trebuchet MS:size=26} $nodename ${font}
 
Uptime $alignr $uptime
Load $alignr $loadavg
 
eth0 $alignr ${addr eth0}
 
Inbound (${totaldown eth0}) $alignr ${downspeed eth0} kb/s
${downspeedgraph eth0}
Outbound (${totalup eth0}) $alignr ${upspeed eth0} kb/s
${upspeedgraph eth0}
 
CPU ${acpitemp}°C $alignr {cpu cpu0}%
${cpubar cpu0}
${cpubar cpu1}
${cpubar cpu2}
${cpubar cpu3}    
 
MEM $alignc $mem / $memmax $alignr $memperc%
$membar
 
/ $alignc ${fs_used /} / ${fs_size /} $alignr ${fs_free_perc /}%
${fs_bar /}
 
/home $alignc ${fs_used /home} / ${fs_size /home} $alignr ${fs_free_perc /home}%
${fs_bar /home}
 
Top Processes ${hr 2}
 
NAME $alignr PID    CPU
${top name 1} $alignr ${top pid 1} ${top cpu 1}
${top name 2} $alignr ${top pid 2} ${top cpu 2}
${top name 3} $alignr ${top pid 3} ${top cpu 3}
${top name 4} $alignr ${top pid 4} ${top cpu 4}
${top name 5} $alignr ${top pid 5} ${top cpu 5}
${top name 6} $alignr ${top pid 6} ${top cpu 6}
${top name 7} $alignr ${top pid 7} ${top cpu 7}

locale

Many packages suffer with locale different from en_US.UTF-8

locale  # check for UTF-8
sudo apt update && sudo apt install locales
sudo locale-gen en_US en_US.UTF-8
sudo update-locale LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8
export LANG=en_US.UTF-8
locale  # verify settings

terminal

tmux

processes

lsof -i :8888 | awk 'NR==1 || $9 ~ /PID/' | grep -v "^$" | awk '{print $1}' | xargs -r kill -9

services

pstree | head -5

systemd-+-ModemManager---3*[{ModemManager}]
        |-NetworkManager---3*[{NetworkManager}]
        |-accounts-daemon---3*[{accounts-daemon}]
        |-avahi-daemon---avahi-daemon
        |-bluetoothd

systemctl --type=service --state=running

start/stop/disable

sudo service lemond status
sudo systemctl disable lemond

current window manager

printf 'Desktop: %s\nSession: %s\n' "$XDG_CURRENT_DESKTOP" "$GDMSESSION(tiling for example[[https://extensions.gnome.org/#sort=relevance][web browser addon][GeForce 940MX(rev a2<<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF
sudo apt update
sudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo systemctl status docker
sudo systemctl start docker
sudo groupadd docker
sudo usermod -aG docker $USER
newgrp docker

sudo apt-get update
sudo apt-get install -y --no-install-recommends  ca-certificates  curl  gnupg2
curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | sudo gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg \
  && curl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | \
    sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' | \
    sudo tee /etc/apt/sources.list.d/nvidia-container-toolkit.list
sudo apt-get update

process on port

ss -tlnp | grep 13305

LISTEN 0      4096         0.0.0.0:13305      0.0.0.0:*                                          
LISTEN 0      4096            [::]:13305         [::]:*                                          

# View running processes
ps   aux | head -10
#ps -ef --sort=-%cpu
#+BEGIN_SRC shell

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.0  28020 12880 ?        Ss   Jun15   4:08 /usr/lib/systemd/systemd --switched-root --system --deserialize=52 splash
root           2  0.0  0.0      0     0 ?        S    Jun15   0:01 [kthreadd]
root           3  0.0  0.0      0     0 ?        S    Jun15   0:00 [pool_workqueue_release]
root           4  0.0  0.0      0     0 ?        I<   Jun15   0:00 [kworker/R-rcu_gp]
root           5  0.0  0.0      0     0 ?        I<   Jun15   0:00 [kworker/R-sync_wq]
root           6  0.0  0.0      0     0 ?        I<   Jun15   0:00 [kworker/R-kvfree_rcu_reclaim]
root           7  0.0  0.0      0     0 ?        I<   Jun15   0:00 [kworker/R-slub_flushwq]
root           8  0.0  0.0      0     0 ?        I<   Jun15   0:00 [kworker/R-netns]
root          10  0.0  0.0      0     0 ?        I<   Jun15   0:00 [kworker/0:0H-kblockd]

kill -9 <PID>
pkill -f <process-name>
sudo systemctl stop <service>

= User Management =

# Add user
sudo adduser <username>
# Remove user
sudo deluser <username>
sudo userdel -r <username>
# View users
sudo cat /etc/passwd

= File System & Disk =

# Check disk space
df -h

# Check filesystem errors
sudo fsck -f /dev/<device>

# View inode usage
sudo du -sh /* | sort -hr

= Network Diagnostics =

# Test connectivity
ping -c 4 <hostname>
traceroute <hostname>
dig <hostname>

# Check open ports
sudo netstat -tulpn
sudo ss -tulpn

= System Logs =

# View logs
sudo journalctl -xe
sudo tail -f /var/log/syslog
sudo grep <error> /var/log/syslog | tail -100

= Package Management =

# Update packages
sudo apt update && sudo apt upgrade -y

# Search packages
apt search <keyword>

# Remove packages with dependencies
sudo apt remove <package>

• View running services
  

  systemctl list-units --type=service --state=running
  

• Start/Stop/Restart
  

  sudo systemctl start ssh
  sudo systemctl stop docker
  sudo systemctl restart network
  

gnome

We can configure the system behavior

#sudo apt install dconf-editor
xev -event keyboard

I want to map the menu key

KeyRelease event, serial 28, synthetic NO, window 0x1000001,
    root 0x352, subw 0x0, time 913179790, (-526,-209), root:(345,337),
    state 0x0, keycode 135 (keysym 0xff67, Menu), same_screen YES,
    XLookupString gives 0 bytes:
    XFilterEvent returns: False

Annoying close window prompt on applications with background operations

# extend ubuntu timeout to check if a window is still alive
gsettings set org.gnome.mutter check-alive-timeout 60000

echo -e "keycode 66 = Hyper_L\nkeycode 118 = Hyper_L\nkeycode 135 = Hyper_L\nkeycode 133 = Hyper_L"  > ~/.xmodmap
xmodmap ~/.xmodmap

#xbindkeys
# gsettings reset-recursively org.gnome.desktop.input-sources
# gsettings reset-recursively org.gnome.desktop.wm.keybindings
gsettings list-recursively org.gnome.desktop.input-sources
gsettings set org.gnome.desktop.input-sources xkb-options "['caps:hyper', 'insert:hyper', 'menu:hyper', 'keycode_133:hyper']"
gsettings get org.gnome.desktop.input-sources xkb-options
# gsettings set org.gnome.desktop.wm.keybindings panel-main-menu "[]"
# gsettings set org.gnome.desktop.wm.keybindings show-desktop "[]"
# gsettings set org.gnome.desktop.wm.keybindings toggle-fullscreen "[]"
#xkeyboard-config

org.gnome.desktop.input-sources current uint32 0
org.gnome.desktop.input-sources mru-sources @a(ss) []
org.gnome.desktop.input-sources per-window false
org.gnome.desktop.input-sources show-all-sources false
org.gnome.desktop.input-sources sources @a(ss) []
org.gnome.desktop.input-sources xkb-model 'pc105+inet'
org.gnome.desktop.input-sources xkb-options @as []
['caps:hyper', 'insert:hyper', 'menu:hyper']

setxkbmap -option caps:hyper -option insert:hyper -option menu:hyper -option keycode_133:hyper

networking

find interfaces

ifconfig

br-0efbd0189d0b: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.18.0.1  netmask 255.255.0.0  broadcast 172.18.255.255
        inet6 fe80::8845:74ff:fe9b:2a34  prefixlen 64  scopeid 0x20<link>
        ether 8a:45:74:9b:2a:34  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

docker0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        inet6 fe80::18a8:d9ff:fe04:fcee  prefixlen 64  scopeid 0x20<link>
        ether 1a:a8:d9:04:fc:ee  txqueuelen 0  (Ethernet)
        RX packets 1378329  bytes 76106951 (76.1 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2277146  bytes 17072057476 (17.0 GB)
        TX errors 0  dropped 754 overruns 0  carrier 0  collisions 0

enp1s0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether c8:5b:76:52:8b:5b  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 17162  bytes 1796876 (1.7 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 17162  bytes 1796876 (1.7 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth1684e57: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::d81e:aeff:fe72:4d1d  prefixlen 64  scopeid 0x20<link>
        ether da:1e:ae:72:4d:1d  txqueuelen 0  (Ethernet)
        RX packets 11  bytes 598 (598.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 386  bytes 213031 (213.0 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth33a8a86: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::bc6b:6eff:fe53:2480  prefixlen 64  scopeid 0x20<link>
        ether be:6b:6e:53:24:80  txqueuelen 0  (Ethernet)
        RX packets 26452  bytes 2688148 (2.6 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 44586  bytes 144310169 (144.3 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

veth38c6122: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::980c:3fff:fe33:82d1  prefixlen 64  scopeid 0x20<link>
        ether 9a:0c:3f:33:82:d1  txqueuelen 0  (Ethernet)
        RX packets 3  bytes 126 (126.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1672  bytes 919330 (919.3 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

vethc7d9473: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet6 fe80::cd2:abff:fe4f:7fb3  prefixlen 64  scopeid 0x20<link>
        ether 0e:d2:ab:4f:7f:b3  txqueuelen 0  (Ethernet)
        RX packets 736074  bytes 50653576 (50.6 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1574469  bytes 7053971724 (7.0 GB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlp2s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.68.109  netmask 255.255.252.0  broadcast 192.168.71.255
        inet6 fe80::da25:ec0d:871:bd2e  prefixlen 64  scopeid 0x20<link>
        ether cc:b0:da:aa:34:05  txqueuelen 1000  (Ethernet)
        RX packets 19503463  bytes 27835160694 (27.8 GB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2407943  bytes 228634476 (228.6 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ping network

is_alive_ping(){
  ping -c 1 $1 > /dev/null
  [ $? -eq 0 ] && echo Node with IP: $i is up.
}

for i in 192.168.68.{1..255} 
do
is_alive_ping $i & disown
done

Node with IP: 192.168.68.1 is up.
Node with IP: 192.168.68.109 is up.
Node with IP: 192.168.68.249 is up.
Node with IP: 192.168.68.248 is up.
Node with IP: 192.168.68.250 is up.
Node with IP: 192.168.68.103 is up.
Node with IP: 192.168.68.110 is up.
Node with IP: 192.168.68.101 is up.

scan network

Scan local network

nmap -sP 192.168.68.0/24

Starting Nmap 7.98 ( https://nmap.org ) at 2026-11-02 17:57 +0100
Nmap scan report for _gateway (192.168.68.1)
Host is up (0.0083s latency).
Nmap scan report for 192.168.68.100
Host is up (0.033s latency).
Nmap scan report for 192.168.68.103
Host is up (0.036s latency).
Nmap scan report for manestro.local (192.168.68.109)
Host is up (0.00027s latency).
Nmap scan report for 192.168.68.248
Host is up (0.017s latency).
Nmap scan report for 192.168.68.249
Host is up (0.011s latency).
Nmap scan report for 192.168.68.250
Host is up (0.0087s latency).
Nmap done: 256 IP addresses (7 hosts up) scanned in 4.82 seconds

network interfaces

ip addr show
ip link show

Check IP configuration

ip -4 addr show
ip -6 addr show

Check DNS resolution

nslookup intertino.it
dig intertino.it

Test connectivity

ping -c 4 intertino.it
traceroute intertino.it

Check listening ports

ss -tlnp
netstat -tlnp

View routing table

ip route show
route -n

firewall

• List rules
  

  ufw status verbose
  

• Allow/Deny rules
  

  sudo ufw allow 80/tcp
  sudo ufw deny 22/tcp
  

• Reset firewall
  

  sudo ufw reset
  

port scanning (nmap)

Local port scanning

nmap -sT localhost

lsof -i :80
ss -tlnp | grep :80

http

npm install puppeteer

node -e "require('puppeteer').launch().then(async p => {
  const browser = await p.newPage();
  await browser.goto('http://localhost/13305/api/tags');
  console.log(await browser.content());
});"

curl -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" http://localhost:$PORT/api/tags

socat

Socat is a relay for bidirectional data transfers between two independent data channels. Is meant as the advanced version of netcat. article, article, article.

• Files
• Pipes
• Devices (serial line, pseudo-terminal, etc)
• Sockets (UNIX, IP4, IP6 - raw, UDP, TCP)
• SSL sockets
• Proxy CONNECT connections
• File descriptors (stdin, etc)
• The GNU line editor (readline)
• Programs

#socat [options] <address> <address>
socat TCP4-LISTEN:81 TCP4:192.168.1.10:80
socat TCP4-LISTEN:81,fork,reuseaddr TCP4:TCP4:192.168.1.10:80

nc -l localhost 1234 #terminal1 
socat STDIO TCP4:localhost:1234 #terminal2

Docker host/container connection

socat TCP-LISTEN:1234,reuseaddr,fork TCP:localhost:80

interface statistics

interface traffic

ip -s link show | head -n 5

real-time traffic   network

ip -s link | head -n 5

#+end_src

docker   security scaling

Useful commands to use docker

troubleshooting

A container was spamming the syslog

docker ps --filter id=3534a2d9ee8f | awk '{print $1, $NF}'

overview

Build & Dev:

• docker build -f Dockerfile.dockerfile -t myorg . - Build from Dockerfile
• docker run -it --rm -v $PWD:/workspace myorg org mode :start - Launch org-mode
• docker exec -it myorg bash - Enter container
• docker build -f Dockerfile.dockerfile --build-arg DOCKER_FLAGS“-v $PWD:/workspace” -t myorg .= - Build with volume flags

Run & Manage:

• docker run -it --rm -v $PWD:/workspace -w /workspace myorg org mode --no-user-info - Run org without user info
• docker run --rm -v $PWD:/workspace myorg org mode :source_block_quote: "hello" - Process org block
• docker run --rm myorg org mode :clear_properties - Clear properties
• docker run --rm myorg org mode :close_all - Close all buffers

Network & Logs:

• docker run --rm -v $PWD:/workspace myorg org mode :start_export "latex" - Export to LaTeX
• docker logs myorg - View logs
• docker ps -a - List all containers

Useful for Org workflows:

• docker cp myorg:/workspace/src/*.org $PWD/ - Copy files out
• docker cp $PWD/*.org myorg:/workspace/src/ - Copy files in
• docker commit myorg myorg:latest - Save image
• docker stop myorg && docker rm myorg - Stop and remove

links: attachable networks

binds

127.0.0.1

If your application inside a container binds to 127.0.0.1, it means the application can only be accessed by other processes running inside that exact same container.

0.0.0.0

When you bind your application to 0.0.0.0, it makes the service accessible from anywhere that can reach the container—including the host machine, other containers on the same Docker network, and external networks.

network

docker network inspect webserver_webserver-net

[
    {
        "Name": "webserver_webserver-net",
        "Id": "95f40f2ec00116f8084f23f936e227ce10ab7ef22103bee3693efb013600b558",
        "Created": "2026-05-26T18:17:17.270114938+02:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv4": true,
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Options": {},
	...

We often need to install ping to check communication between containers

apt update
apt install iputils-ping

cleanup

Docker stores containers, volumes, image, and filesystem layers

docker rm $(docker ps -aq)
docker rmi $(docker images -q)
docker image prune -a
docker volume prune
docker system prune                 

swarm

SWARM_NAME=malestro SWARM_NODE=malestro NET_NAME=webserver-net SERVICE_NAME=db SUBNET=“10.11.0.0/16” GATEWAY=" docker swarm init

#docker network create –scope=swarm $NET_NAME #docker network create –scope=swarm –driver overlay –attachable $NET_NAME docker network create –driver=overlay –attachable $NET_NAME #docker network create –scope=swarm –driver overlay –ingress –opt com.docker.network.driver.mtu=1200 $NET_NAME docker network create –driver overlay –ingress –subnet=$SUBNET –gateway=$GATEWAY –opt com.docker.network.driver.mtu=1200 traefik-ingress

docker network create –subnet $SUBNET –opt com.docker.network.bridge.name=docker_gwbridge –opt com.docker.network.bridge.enable_icc=false –opt com.docker.network.bridge.enable_ip_masquerade=true docker_gwbridge

#docker network create –subnet=172.20.0.1/16 -o com.docker.network.bridge.enable_icc=false -o com.docker.network.bridge.name=docker_gwbridge docker_gwbridge

#docker service update –network-rm traefik-net myservice #docker service create –publish 80:80 –network=$NET_NAME –name nginx nginx docker service update –network-add $NET_NAME db

docker node update –availability active $SWARM_NODE docker swarm init

issues

Docker has many advantages in terms of portability but few topics makes it really hard to use. I wish I can learn how to face time demanding issues:

user

is really tedious to have the same user as host, I’m not sure I found the best workaround. Volumes are mounted as root and the container user cannot work ref1

root

if a pre-built images starts a user I can’t do any root change

build

building takes an enormous amount of time and tentatives. I wish I could find a better way to avoid debugging every single line for unmet dependencies

mounting

Dockerfile copies the directory losing the dynamic changes

volumes

I use docker because I want a standard on the mounted directory and share LLM for example. Why it is so hard to find out every time where the provider puts the models

transparency

I use docker mainly for security reasons because I want to control what each service does on my machine but often compiling and launching from docker is really badly documented and I sometimes don’t manage to have it running

dependencies

I can’t count the time spent in figuring out the dependencies for each image

orchestration

We can orchestrate the different containers

docker ui

portainer, arcane

orchestration

kubernetes

enterprise

openshift

docker UI

We start with a simple UI tool

orchestrator

enterprise

kubernetes

We install kubectl

curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl.sha256"
echo "$(cat kubectl.sha256)  kubectl" | sha256sum --check
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

Write down in org-mode useful commands and snippets for kubectl with mentions to configuration files

#+begin_src org

kubectl org-mode cheatsheet

Basic Commands

# Get help
kubectl help

# Get cluster info
kubectl cluster-info

# Get nodes
kubectl get nodes

# Get pods (all namespaces)
kubectl get pods --all-namespaces

# Get pods in current namespace
kubectl get pods

Configuration Files

~/.kube/config

• Default kubeconfig file
• Contains cluster information, users, and contexts
• Can be modified with kubectl config commands

~/.kube/cache

• Caches authentication tokens
• Used for interactive login

.kube/config (project-specific)

• Local configuration file
• Can be set with KUBECONFIG environment variable

Useful Configuration Commands

# View current context
kubectl config current-context

# List contexts
kubectl config get-contexts

# Switch context
kubectl config use-context <context-name>

# Set current namespace
kubectl config set-context --current --namespace=<namespace-name>

# Add cluster
kubectl config add-cluster <cluster-name> --server=<api-server-url>

# Add user
kubectl config add-user <user-name> --client-certificate=<cert-file> --client-key=<key-file>

Common Operations

# Create resource from file
kubectl apply -f <filename.yaml>

# Delete resource
kubectl delete -f <filename.yaml>

# Get resource description
kubectl describe <resource-type> <resource-name>

# Get resource details in YAML
kubectl get <resource-type> <resource-name> -o yaml

# Get logs
kubectl logs <pod-name>

# Execute command in pod
kubectl exec -it <pod-name> -- <command>

# Port forward
kubectl port-forward <pod-name> <local-port>:<remote-port>

Namespace Management

# Create namespace
kubectl create namespace <namespace-name>

# Switch to namespace
kubectl config set-context --current --namespace=<namespace-name>

# Get all namespaces
kubectl get namespaces

Troubleshooting

# Get events
kubectl get events

# Get pod logs with timestamps
kubectl logs -l <label> --timestamps

# Watch pods
kubectl get pods -w

# Check resource usage
kubectl top nodes
kubectl top pods

Quick Context Switching

# Save current context
kubectl config current-context > /tmp/current-context

# Switch to different context
kubectl config use-context <context-name>

# Switch to default context
kubectl config use-context docker-desktop

Aliases for ~/.bashrc or ~/.zshrc

alias k=kubectl
alias kg='kubectl get'
alias kga='kubectl get all'
alias kd='kubectl describe'
alias kl='kubectl logs'
alias kpf='kubectl port-forward'

#+end_src

Here are useful kubectl commands and snippets in org-mode with configuration file references:

#+BEGIN_SRC org

kubectl Commands and Snippets

Basic Configuration

kubeconfig file locations

• Default: ~/.kube/config
• Custom: KUBECONFIG=/path/to/config kubectl …

Context management

• List contexts: kubectl config get-contexts
• Switch context: kubectl config use-context <context>
• Show current context: kubectl config current-context
• Set user credentials: kubectl config set-credentials <user>

Common Operations

Pods

• Get pods: kubectl get pods
• Describe pod: kubectl describe pod <pod-name>
• Logs: kubectl logs <pod-name>
• Exec into pod: kubectl exec -it <pod-name> -- /bin/sh
• Port forward: kubectl port-forward <pod-name> <local-port>:<remote-port>

Deployments

• Get deployments: kubectl get deployments
• Scale deployment: kubectl scale deployment <deployment> --replicas=<count>
• Update image: kubectl set image deployment/<deployment> <container>=<image>

Services

• Get services: kubectl get services
• Expose deployment: kubectl expose deployment <deployment> --port=<port>

Useful Snippets

Quick pod creation

kubectl run <name> --image=<image> --port=<port>

Apply configuration from file

kubectl apply -f <config-file.yaml>

Delete resources

kubectl delete -f <config-file.yaml>
kubectl delete pod <pod-name>
kubectl delete deployment <deployment-name>

Namespace operations

• Create namespace: kubectl create namespace <name>
• Switch namespace: kubectl config set-context --current --namespace=<namespace>
• List namespaces: kubectl get namespaces

Advanced Tips

JSONPath queries

• Get specific field: kubectl get pod <pod> -o jsonpath’{.spec.containers[0].image}’=
• Format output: kubectl get pods -o wide --show-labels

Watch operations

• Watch pods: kubectl get pods -w
• Watch deployments: kubectl get deployments -w

Configuration file examples

# Deployment YAML
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: app
        image: my-image:latest
        ports:
        - containerPort: 80

Troubleshooting

Check cluster status

• kubectl cluster-info
• kubectl get nodes
• kubectl get pods --all-namespaces

Debugging

• kubectl describe node <node>
• kubectl logs --previous <pod>
• kubectl get events

#+END_SRC

multimedia

audio

The current choice is pipewire

• Lower latency for real-time audio processing.
• Better compatibility with Wayland display servers (unlike PulseAudio)
• Hardware-accelerated video passthrough for screen sharing
• Integration with Mesa DRM for improved graphics performance
• Support for native Wayland audio protocol instead of X11
• Reduced CPU overhead and power consumption
• Better support for virtualization and nested audio contexts
• Improved video effects and filters support
• Seamless integration with Ubuntu’s native GNOME environment
• Better support for multimedia applications and games
• More efficient resource management for audio devices
• Improved compatibility with modern Linux kernels
• Reduced latency for audio streaming and VoIP applications
• Better support for audio mixing and routing
• Integration with JACK protocol for professional audio work

sudo apt install pulseaudio-utils
sudo apt install pipewire pipewire-pulse wireplumber pipewire-alsa pipewire-jack -y

pactl info | grep "Server Name"

Server Name: PulseAudio (on PipeWire 1.6.2)

systemctl --user enable --now pipewire pipewire-pulse wireplumber
journalctl --user -u pipewire  # Replace "pipewire" with the failing service name

Sep 05 00:36:29 manitro systemd[3162]: Stopping pipewire.service - PipeWire Multimedia Service...
Sep 05 00:36:29 manitro systemd[3162]: Stopped pipewire.service - PipeWire Multimedia Service.
Sep 05 00:36:29 manitro systemd[3162]: pipewire.service: Consumed 3min 31.719s CPU time over 2d 15h 50min 9.478s wall clock time, 21.7M memory peak, 4.6M memory swap peak.
-- Boot 2f8cdd9bf9554f12ba750e8021731469 --
Sep 05 10:15:53 manitro systemd[3180]: Started pipewire.service - PipeWire Multimedia Service.

pw-top

I’m running LMMS configured with alsa and pipewire but I hear no sound, how can I debug it?

echo "=== LMMS Audio Debug Script ==="
echo ""
echo "Checking ALSA devices..."
alsaloop -P default -c 2 -t 2 -p
echo "Checking PulseAudio status..."
if pgrep -x pulseaudio> /dev/null; then
    echo "PulseAudio is running"
elif pgrep -x pipewire > /dev/null; then
    echo "PipeWire is running"
elif pgrep -x pavucontrol > /dev/null; then
    echo "PavuControl is available"
fi
echo "Checking ALSA modules..."
cat /proc/asound/cards
echo "Checking PulseAudio modules..."
pactl info 2>/dev/null || echo "Pactl not available or PulseAudio not running"
echo "Checking PipeWire modules..."
pipewire-pulse-info 2>/dev/null || echo "PipeWire-Pulse not available"
echo "Checking user audio permissions..."
id
ls -la ~/.cache/pulse/ 2>/dev/null || echo "Pulse cache not found"
# Test with a686196b566e5e97b932e4168a028a1295b5b3d06e6d1c3e1e9b17f3d1c2e3f4
echo ""
echo "Test sound output..."
play -t alsa /dev/zero 2>/dev/null &
sleep 1
kill $! 2>/dev/null || true
echo "" echo "

=== LMMS Audio Debug Script ===

Checking ALSA devices...
Checking PulseAudio status...
PipeWire is running
Checking ALSA modules...
 0 [NVidia         ]: HDA-Intel - HDA NVidia
                      HDA NVidia at 0xbc000000 irq 124
 1 [Generic        ]: HDA-Intel - HD-Audio Generic
                      HD-Audio Generic at 0xbc8c8000 irq 126
 2 [Generic_1      ]: HDA-Intel - HD-Audio Generic
                      HD-Audio Generic at 0xbc8c0000 irq 127
 3 [Fold           ]: USB-Audio - nanoKEY Fold
                      KORG INC. nanoKEY Fold at usb-0000:66:00.4-1, full speed
Checking PulseAudio modules...
Server String: /run/user/1000/pulse/native
Library Protocol Version: 35
Server Protocol Version: 35
Is Local: yes
Client Index: 523
Tile Size: 65472
User Name: sabeiro
Host Name: manitro
Server Name: PulseAudio (on PipeWire 1.6.2)
Server Version: 15.0.0
Default Sample Specification: float32le 2ch 48000Hz
Default Channel Map: front-left,front-right
Default Sink: alsa_output.pci-0000_64_00.6.analog-stereo
Default Source: alsa_input.pci-0000_64_00.6.analog-stereo
Cookie: 0b3e:429a
Checking PipeWire modules...
PipeWire-Pulse not available
Checking user audio permissions...
uid=1000(sabeiro) gid=1000(sabeiro) groups=1000(sabeiro),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users),111(lpadmin),114(lxd),973(docker),994(input)
Pulse cache not found

Test sound output...