Ops on 7nolikov | Dmitrii Novikov

Caddy

7nolikov@gmail.com (Dmitrii Novikov) — Fri, 21 Aug 2026 00:00:00 +0000

A web server that gets HTTPS right by default. Point it at a domain and it obtains and renews the certificate itself, with no cron job and no certbot.

A whole reverse proxy config is two lines:

Distroless container images

7nolikov@gmail.com (Dmitrii Novikov) — Fri, 21 Aug 2026 00:00:00 +0000

Base images containing your application and its runtime dependencies, and nothing else. No shell, no package manager, no utilities.

The trade-off against Alpine, which is the usual alternative:

Distroless has the smaller attack surface - with no shell in the image, a lot of privilege escalation and post-exploitation techniques simply have nothing to run. The static variant is around 2MB. The cost is debugging: you cannot exec in and look around, because there is nothing to exec. In Kubernetes you attach an ephemeral container instead.

Dokku - a small PaaS on your own box

7nolikov@gmail.com (Dmitrii Novikov) — Fri, 21 Aug 2026 00:00:00 +0000

git push to your own server and it builds, containerises and runs your app behind a reverse proxy with a TLS certificate. Heroku’s workflow on a VPS you control.

It handles the parts that are tedious to assemble by hand: buildpack or Dockerfile detection, environment variables, zero-downtime restarts, database plugins, Let’s Encrypt.

One thing to know before you commit: Dokku officially supports Debian and Ubuntu LTS. Pairing it with an immutable container OS looks appealing and does not work - Dokku installs via apt and owns nginx and the container lifecycle, which is exactly what an immutable OS refuses to let it do.

Reproducible Builds

7nolikov@gmail.com (Dmitrii Novikov) — Fri, 21 Aug 2026 00:00:00 +0000

A set of practices for making a build produce a bit-for-bit identical artifact every time from the same source.

The reason it matters is supply chain: if the binary you ship cannot be reproduced from the source you published, nobody - including you - can verify that the two correspond. Reproducibility turns “trust the build server” into something checkable by anyone.

The things that break it are mundane and everywhere: embedded timestamps, absolute paths, locale, filesystem ordering, and anything that hashes a map iterated in random order. The site catalogues each one and how to fix it.

Uncloud - Compose for production

7nolikov@gmail.com (Dmitrii Novikov) — Fri, 21 Aug 2026 00:00:00 +0000

Fills the gap between “docker compose on a VPS” and Kubernetes. Clustering, automatic HTTPS, service discovery, a WireGuard mesh between machines - without a control plane.

The design choice I find interesting: there is no central control plane at all. Every machine holds the full cluster state in a CRDT-backed distributed SQLite, syncing peer to peer. No etcd, no leader election, and the cluster keeps working when machines go offline.