A single runaway service — a rebuild, a backup, a memory leak — can starve everything else on a small VPS. cgroups v2 lets you bound each service’s CPU, memory…
Read MoreTCP BBR vs CUBIC on a VPS: A Reproducible Benchmark Methodology
Switching a VPS to BBR is a two-line change that people either swear by or claim does nothing. The truth is measured: BBR helps most on links with loss and…
Read MoreFinding VPS Scheduler Latency with perf sched and bpftrace
“The CPU is at 30% but everything is slow” is the classic symptom of scheduler latency — the time a runnable thread waits before it actually gets a core. Aggregate…
Read MoreTuning TCP Keepalive and TIME_WAIT Exhaustion on a High-Connection VPS
If you run anything with a large number of short-lived TCP connections — an HTTP API behind a load balancer, a scraping or proxy workload, or a busy reverse proxy…
Read MoreServing Stale Content: Nginx proxy_cache stale-while-revalidate and stale-if-error
Most Nginx caching advice stops at proxy_cache_path and a proxy_cache_valid line. That configuration will serve stale content happily when your origin is slow, but it has no strategy for the…
Read MoreFixing Bufferbloat on a VPS: fq_codel and CAKE Queue Disciplines Explained and Measured
You can tune TCP congestion control all day and still see latency spiral during a backup or a large upload, because the culprit is not the congestion-control algorithm — it…
Read MoreTuning the Linux OOM Killer and systemd-oomd on Memory-Pressured VPS Instances
The OOM killer is the least understood thing on a small VPS. It fires, kills your database instead of the runaway process, and the only trace is a line in…
Read MoreAnalyzing systemd-coredump Crash Dumps on a VPS: A Practical Debugging Workflow
When a service dies on a small VPS you usually get “status=11/SEGV” and nothing else. The crash dump that would tell you exactly which instruction faulted and on what address…
Read MoreAuditing Outbound Egress Rules with nftables and ufw to Catch Data Exfiltration
Most firewall reviews focus on inbound ports. That is backwards for a VPS threat model. An attacker who has already executed code does not need inbound access; they need outbound…
Read MoreDiagnosing Sustained Disk-Write Amplification on a VPS (and When to Add Monitoring)
A VPS that does nothing but still lights up its disk I/O counter is a common and frustrating problem. The writes are real, but the process responsible usually is not…
Read More