Networking, embedded systems, and infrastructure — the real problems that show up along the way.
Three unrelated storage failure modes on the same k3s cluster all present as an unresponsive node — Longhorn iSCSI stalls under memory pressure, CIFS mounts entering D-state, and kubelet mis-measuring ephemeral-storage. How to tell them apart before reaching for the power button.
On Fedora with firewalld, `tailscale up` can leave the tailscale0 interface unassigned to any zone, silently dropping real traffic while tailscale's own control-plane pings keep working.
A CIFS globalmount on a TrueNAS SMB share went stale on every k3s node at once, and csi-driver-smb kept bind-mounting the dead handle into every new pod — fixed with noserverino, a real mount-stat liveness probe, and a DaemonSet that force-unmounts stale CIFS globalmounts.
Docker sets the kernel FORWARD chain policy to DROP and leaves DOCKER-USER empty, silently killing traffic from libvirt's default NAT network even when firewalld and libvirt are both configured correctly.
kubelet computed ephemeral-storage capacity from the small /var partition instead of the 838G data disk, evicting Jellyfin pods that used 1.1MB. Fixed by bind-mounting the big disk at /var/lib/kubelet instead of moving root-dir, which breaks Longhorn CSI.
Longhorn iSCSI I/O stalls and memory pressure were freezing k3s nodes and requiring physical power-button reboots. How kdump revealed what journald couldn't.
CIFS mounts in Kubernetes have no reliable timeout option on most kernels. Every obvious fix fails. This documents what was tried, what the kernel actually supports, and the sidecar pattern that works.
Key-only SSH and Tailscale on Steam Deck / SteamOS that survive every update — the atomic update whitelist for SSH and the official deck-tailscale installer, explained.
Install the os-tailscale plugin on OPNSense, connect to Tailscale or Headscale, and advertise subnet routes — the WebUI steps most guides skip, including firewall rules and route approval.
Building a 6-bay NAS with a Raspberry Pi 5 and an ASM1166 SATA controller — including the silent boot hang caused by the Pi 5's MSI implementation.