linux

Surviving the OOM Killer with Swap

4 minute read Published: 2024-01-13

The Linux OOM killer runs when the kernel can no longer reclaim memory. If anonymous memory exceeds RAM and has nowhere to go, the kernel scores processes and kills the one with the highest score. On a small VPS, that can be the application, database, or build job you meant to keep alive. A low-priority daemon with a large RSS can lose, but so can one large process when there is no swap.

Swap gives anonymous pages backing storage under memory pressure. The kernel can evict those pages instead of killing the owning process, at the cost of latency when it reads them back. On a VPS, that delay is often preferable to losing the process.

Disabling Automatic APT on a Low-Resource Debian VPS

3 minute read Published: 2023-06-10

I run two inexpensive OranMe VPS instances: one has 0.1 CPU and 128MB RAM, the other 0.5 CPU and 512MB. They are only suitable for light self-hosted work, so I installed Debian without a desktop environment.

The 0.1 CPU box kept shutting down. In the OranMe control panel, its CPU usage hit the limit shortly before each crash. That looked like the provider's abuse protection killing the VM. /var/log/system.log showed that the spikes matched apt's periodic tasks.

Setting Up an Nginx Web Server

3 minute read Published: 2022-11-12

Nginx is an event-driven web server. Its worker pool multiplexes I/O across many connections instead of assigning a thread to each one. It is commonly used for static sites, reverse proxies, and TLS termination.

Linux System and Network Tuning

4 minute read Published: 2022-07-28

Default Linux kernel parameters target general-purpose workloads. Servers handling high traffic, many connections, or heavy I/O need tuning. This guide covers the sysctl parameters that matter and why.

Docker and Containers: Security, Rootless Mode, and Podman

3 minute read Published: 2022-07-07

A container is not a virtual machine. VMs emulate hardware and run a full OS kernel. Containers share the host kernel and isolate processes using namespaces (which partition what a process sees: filesystem, network, PIDs, users) and cgroups (which cap what it uses: CPU, memory, I/O).