“Cron runs at the top of the minute” is the standard explanation for thundering-herd load spikes and missed maintenance windows, but on modern systemd hosts the real behaviour is subtler….
Read Morecgroups v2 on a VPS: Capping CPU, Memory and I/O per Service with systemd
A single runaway service — a rebuild, a backup, a memory leak — can starve everything else on a small VPS. cgroups v2 lets you bound each service’s CPU, memory…
Read MoreTCP BBR vs CUBIC on a VPS: A Reproducible Benchmark Methodology
Switching a VPS to BBR is a two-line change that people either swear by or claim does nothing. The truth is measured: BBR helps most on links with loss and…
Read MoreFinding VPS Scheduler Latency with perf sched and bpftrace
“The CPU is at 30% but everything is slow” is the classic symptom of scheduler latency — the time a runnable thread waits before it actually gets a core. Aggregate…
Read MoreTuning TCP Keepalive and TIME_WAIT Exhaustion on a High-Connection VPS
If a VPS runs anything with a large number of short-lived TCP connections — an API behind a load balancer, a reverse proxy, a scraping or queue-worker fleet — it…
Read MoreServing Stale Content: Nginx proxy_cache stale-while-revalidate and stale-if-error
Most Nginx caching advice stops at proxy_cache_path and a proxy_cache_valid line. That configuration will serve stale content happily when your origin is slow, but it has no strategy for the…
Read MoreFixing Bufferbloat on a VPS: fq_codel and CAKE Queue Disciplines Explained and Measured
You can tune TCP congestion control all day and still see latency spiral during a backup or a large upload, because the culprit is not the congestion-control algorithm — it…
Read MoreTuning the Linux OOM Killer and systemd-oomd on Memory-Pressured VPS Instances
The OOM killer is the least understood thing on a small VPS. It fires, kills your database instead of the runaway process, and the only trace is a line in…
Read MoreAnalyzing systemd-coredump Crash Dumps on a VPS: A Practical Debugging Workflow
When a service dies on a small VPS you usually get “status=11/SEGV” and nothing else. The crash dump that would tell you exactly which instruction faulted and on what address…
Read MoreAuditing Outbound Egress Rules with nftables and ufw to Catch Data Exfiltration
Most firewall reviews focus on inbound ports. That is backwards for a VPS threat model. An attacker who has already executed code does not need inbound access; they need outbound…
Read More