In this episode of The Linux Podcast with Fexingo, Lucas and Luna dive into Linux auditd, the userspace component of the kernel's audit subsystem that logs security-relevant events. They unpack a real-world case: how a major European bank used auditd rules to detect and stop a data exfiltration attempt via SSH in under 90 seconds. The hosts explain auditd's architecture — how it captures system calls, file accesses, and user commands without impacting performance — and contrast it with tools like syslog and systemd-journald. They also walk through configuring persistent audit rules, interpreting /var/log/audit/audit.log, and using ausearch to drill into specific events. Lucas shares a personal anecdote about tracking down a misconfigured cron job that was copying sensitive configs to a public directory. The episode concludes with a forward-looking discussion on how auditd integrates with modern SIEM platforms and eBPF-based observability. Perfect for sysadmins, security engineers, and anyone hardening a Linux environment.

#Linux #Auditd #EnterpriseSecurity #SystemAdministration #SecurityAuditing #SyscallMonitoring #Compliance #SIEM #SSH #DataExfiltration #Kernel #TechPodcast #OpenSource #LinuxSecurity #ausearch #auditctl #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna explore Linux Kernel Same-Page Merging (KSM), a memory deduplication technique that can reduce RAM usage by up to 60% in virtualized environments. They break down how KSM works, its trade-offs with CPU overhead, and real-world use cases like optimizing container density on a 256 GB server. The episode includes a comparison with newer approaches like userfaultfd and UFFD, and discusses KSM's role in VMware and other hypervisors. Perfect for sysadmins, DevOps engineers, and cloud architects looking to cut infrastructure costs without sacrificing performance.

#Linux #KSM #KernelSamePageMerging #MemoryDeduplication #Virtualization #Containers #DevOps #SysAdmin #CloudComputing #OpenSource #Technology #FexingoBusiness #BusinessPodcast #Podcast #TechPodcast #LinuxKernel #MemoryManagement #Hypervisor

Keep every episode free: buymeacoffee.com/fexingo

Episode 123 of The Linux Podcast explores how eBPF (extended Berkeley Packet Filter) is transforming observability, security, and networking in Linux. Lucas and Luna dive into a specific case: how eBPF enables deep kernel tracing without modifying code or rebooting, using tools like Cilium and Falco. They discuss why eBPF is replacing older methods like iptables and kernel modules, how it works with BPF maps and programs, and a 2025-2026 shift: eBPF now supports up to 1 million instructions per program, unlocking complex filtering and runtime security policies. The hosts walk through a real-world scenario: a cloud-native startup using eBPF to detect zero-day exploits in containers, reducing detection lag from hours to milliseconds. They also touch on the upcoming Linux 6.15 kernel features for eBPF and the growing ecosystem of eBPF-based tools. This episode is perfect for DevOps engineers, SREs, and any Linux user curious about modern kernel instrumentation.

#eBPF #LinuxKernel #Observability #Security #Cilium #Falco #BPF #KernelTracing #Containers #CloudNative #DevOps #SRE #Linux #OpenSource #Technology #FexingoBusiness #BusinessPodcast #LinuxPodcast

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna dive into Linux's dm-crypt subsystem — the kernel-level disk encryption that powers LUKS and underpins everything from laptop full-disk encryption to cloud VM storage. They break down how dm-crypt uses a device-mapper target to sit transparently between the filesystem and the physical disk, encrypting data in flight with AES-XTS on block boundaries. Lucas explains why the crypto overhead is often smaller than you think — modern CPUs with AES-NI instructions can sustain multi-gigabyte-per-second throughput, and the real bottleneck is usually the drive itself. They cover practical trade-offs: cryptsetup defaults, key derivation with Argon2 in LUKS2, the performance hit from using a slow passphrase vs. a key file, and how dm-crypt interacts with TRIM on SSDs. Luna asks about side-channel attacks and whether dm-crypt protects against cold-boot attacks — the answer is nuanced. This episode is for anyone who locks their laptop, provisions encrypted cloud instances, or just wants to know what happens when they type 'cryptsetup luksOpen'. No prior crypto background needed.

#Linux #dm-crypt #LUKS #DiskEncryption #Kernel #DeviceMapper #AES-NI #Cryptsetup #Argon2 #FullDiskEncryption #SSD #TRIM #ColdBootAttack #Technology #OpenSource #FexingoBusiness #BusinessPodcast #LinuxPodcast

Keep every episode free: buymeacoffee.com/fexingo

In this episode, Lucas and Luna dive into systemd-journald, the daemon that has quietly revolutionized Linux logging. They explore how it shifts from plain-text syslog files to structured binary logs, enabling fast indexed queries and real-time monitoring via journalctl. The discussion covers practical use cases for server administrators, including filtering by priority, unit, and boot session, as well as the trade-offs of persistent vs. volatile journal storage. Lucas explains why journald is critical for debugging production issues and how it integrates with modern observability stacks. A must-listen for anyone managing Linux servers.

#Linux #Systemd #Journald #Logging #Sysadmin #DevOps #Observability #Journalctl #BinaryLogs #StructuredData #ServerManagement #ProductionDebugging #Technology #OpenSource #FexingoBusiness #BusinessPodcast #ServerStack #Distros

Keep every episode free: buymeacoffee.com/fexingo

In this episode, Lucas and Luna dive into Linux Control Groups v2, the unified hierarchy that replaced cgroups v1 starting in kernel 4.5. They explain how cgroups v2 simplifies resource accounting by avoiding multiple controller hierarchies, which reduced complexity and bugs in container orchestration. The discussion focuses on the io.weight controller for I/O prioritization: a concrete example shows how a single noisy container can degrade performance for latency-sensitive workloads, and how cgroups v2 lets you set proportional weights across containers without manual throttling. They also touch on memory.min and memory.high for reclaim protection and early pressure signaling. By July 2026, most major distributions ship with cgroups v2 as default, yet many DevOps teams still configure legacy v1 due to outdated documentation. This episode helps engineers understand the practical benefits of v2: simpler configuration, better isolation, and fewer surprises under load. No generic Linux intro—just a targeted look at one of the most impactful kernel features you're probably misconfiguring.

#Linux #CgroupsV2 #ResourceAccounting #ContainerOrchestration #Kernel #IOPrioritization #MemoryManagement #DevOps #Technology #OpenSource #SystemsAdmin #Kubernetes #Docker #Performance #FexingoBusiness #BusinessPodcast #LinuxPodcast #ServerStack

Keep every episode free: buymeacoffee.com/fexingo

Episode 119 of The Linux Podcast with Fexingo dives into overlay filesystems, the unsung hero behind Docker and container image layering. Lucas and Luna break down how overlayfs merges multiple directories into a single unified view, enabling copy-on-write, efficient image sharing, and instant container startup. They walk through a concrete example — a Docker pull of Ubuntu jammy — showing exactly how the lower and upper layers interact. They also discuss the history: from union mount prototypes in Plan 9 to the current overlay2 driver in Linux kernel 5.11+, and why overlayfs matters more than ever as Kubernetes clusters scale to thousands of nodes. If you've ever wondered why 'docker pull' is fast or how containers stay tiny, this episode explains the kernel mechanics behind it.

#Linux #OverlayFilesystem #ContainerImages #Docker #Kubernetes #CopyOnWrite #OverlayFS #UnionMount #Kernel #TechPodcast #OpenSource #DevOps #CloudNative #FexingoBusiness #BusinessPodcast #Technology #SystemsProgramming #StorageLayering

Keep every episode free: buymeacoffee.com/fexingo

Episode 118 of The Linux Podcast dives into persistent memory (PMEM) — what it is, how it differs from DRAM and SSD, and why it's reshaping storage architecture in data centers. Lucas explains the Linux kernel's direct access (DAX) mechanism, which allows PMEM to be accessed as byte-addressable storage without going through the page cache. Luna brings up real-world cost and performance trade-offs, including the example of Intel Optane's discontinuation. They also discuss how applications like databases (e.g., PostgreSQL) are adapting to persistent memory, and what the future holds as CXL-attached memory emerges. If you're a sysadmin or developer wondering whether PMEM is practical today, this episode gives you the concrete numbers and trade-offs.

#Linux #PersistentMemory #PMEM #DAX #Kernel #Storage #NVMe #CXL #Optane #PostgreSQL #DataCenter #ByteAddressable #MemoryMappedFiles #NonVolatileMemory #TechPodcast #OpenSource #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

In episode 117 of The Linux Podcast, Lucas and Luna dive deep into io_uring, the Linux kernel interface that's revolutionizing asynchronous I/O for storage and networking. Lucas explains how io_uring cuts system call overhead by using shared ring buffers between user space and kernel space, reducing latency for high-performance applications. Luna questions how it compares to traditional epoll and AIO, and they walk through real-world benchmarks showing up to 50-70 percent reduction in I/O latency for databases and web servers. The episode also covers recent improvements in kernel 6.12 that add TCP support and registered buffers, and debates whether io_uring will eventually replace older async I/O mechanisms in the Linux ecosystem. A practical, technical discussion for developers and sysadmins looking to squeeze more performance from their Linux systems.

#Linux #io_uring #AsyncIO #Kernel #Storage #Networking #Performance #SystemProgramming #LinuxKernel #HighPerformanceComputing #Databases #WebServers #LinuxPerformance #OpenSource #Technology #FexingoBusiness #BusinessPodcast #LinuxPodcast

Keep every episode free: buymeacoffee.com/fexingo

In this episode of The Linux Podcast with Fexingo, Lucas and Luna dive into Linux namespace isolation and its critical role in container security. They explore the seven key namespaces—mount, PID, net, IPC, UTS, user, and cgroup—and how each creates a virtualized boundary that prevents container breakouts. Using Docker and Kubernetes as real-world examples, they explain what happens when a namespace is misconfigured, such as a privileged container leaking host network access. They also discuss recent kernel hardening efforts, including user namespace restrictions and the shift to rootless containers. If you've ever wondered how containers stay secure without a hypervisor, this episode gives you the concrete mechanisms. Hosted by Lucas and Luna.

#Linux #Namespaces #ContainerSecurity #Docker #Kubernetes #Kernel #Isolation #Technology #FexingoBusiness #BusinessPodcast #Rootless #MountNamespace #PIDNamespace #NetNamespace #UserNamespace #Cgroup #IPC #UTS

Keep every episode free: buymeacoffee.com/fexingo