My Mastodon account has moved: I’m now @m1ch@graz.social. The old account, @mightymich@mastodon.social, points there, and Mastodon’s account migration brought my followers along, so if you followed me before you don’t need to do anything. – TBH: If I knew how easy this step would be, I’d done it long ago.

Why

graz.social is a Mastodon server for Graz and the surrounding area, run by the association graz.social – Verein zur Förderung ethischer Digitalkultur (info.graz.social). I’m part of its admin team, and now my own account lives there too: on a server I help look after, in the city I live in.

My Mastodon account has moved: I’m now @m1ch@graz.social. The old account, @mightymich@mastodon.social, points there, and Mastodon’s account migration brought my followers along, so if you followed me before you don’t need to do anything. – TBH: If I knew how easy this step would be, I’d done it long ago.

Why

graz.social is a Mastodon server for Graz and the surrounding area, run by the association graz.social – Verein zur Förderung ethischer Digitalkultur (info.graz.social). I’m part of its admin team, and now my own account lives there too: on a server I help look after, in the city I live in.

My Mastodon account has moved: I’m now @m1ch@graz.social. The old account, @mightymich@mastodon.social, points there, and Mastodon’s account migration brought my followers along, so if you followed me before you don’t need to do anything. – TBH: If I knew how easy this step would be, I’d done it long ago.

Why

graz.social is a Mastodon server for Graz and the surrounding area, run by the association graz.social – Verein zur Förderung ethischer Digitalkultur (info.graz.social). I’m part of its admin team, and now my own account lives there too: on a server I help look after, in the city I live in.

TL;DR – My bootc hosts stage new images every hour, but nothing rebooted them into those images. Now a small timer on each host checks a time window, its own health and its neighbours, takes a lock from a ~200-line Python FleetLock server, and only then reboots. No Kubernetes, no etcd, and protocol-compatible with the Fedora CoreOS tooling in case I outgrow it.

In how I tweak my base image I described how I replaced bootc-fetch-apply-updates.timer with my own bootc-fetch.timer: every hour bootc update pulls the newest image and stages it, but doesn’t reboot. I ended that post with “the actual reboot is a separate step I control manually or via another timer”. This post is about that missing step.

Running image builds on a schedule makes sense for security – you want your bootc images to pick up the latest Fedora updates automatically. But scheduling a daily build that rebuilds every image every day, even when nothing upstream changed, wastes runner time and fills the registry with identical layers.

This post covers how I added upstream change detection to my Forgejo CI pipelines for gorgeOS, so that scheduled builds are truly no-ops when the upstream image hasn’t moved.

Running a Fedora-based bootc image stack means tracking multiple Fedora releases in parallel. Instead of duplicating every job in the workflow, I wired up the matrix strategy in Forgejo Actions to build F43 and F44 from a single job definition.

The Problem With Hardcoded Versions

Before, every Containerfile had a hardcoded base image:

FROM git.m1ch.eu/oci/c-os:base-43

Supporting F44 would have meant either duplicating the whole workflow or a manual find-and-replace for every release. Neither scales.

In the last post I walked through the base image that every one of my servers shares. This time I want to look at the first layer on top of it: the cloud image, which adds everything a virtual machine running in a hypervisor environment needs.

The full source is in my gorge.os repository.

Layered images

One of the things I really like about BootC is that you can layer images just like you layer application containers. The cloud image simply starts from the base:

In the last post I explained why I decided to switch to BootC for all my servers. This time I want to walk through what I actually put into my base image - the packages, the config files, and the custom services that make every host feel like home.

The full source is in my gorge.os repository.

The Containerfile structure

Before getting into what’s in the image, I want to explain how I put things into it. The Containerfile is split into three stages: package management, file placement, and service activation.

I have a fair amount of servers that I’m (co-)responsible for. To make my life easier I tried serveral managent tools to do the common tasks for all servers as smooth as possible.
The two tools I mainly use at the moment are ansible and cloud-init.

Cloud-init is a great tool to spin up a new server, or to resore an existing one.
ansible is great to do common tasks, like updating servers, installing packages to multiple hosts, but when it comes to thinks like adding a systemd-service to just a view hosts, it never felt natural to me.

TL;DR – My bootc hosts stage new images every hour, but nothing rebooted them into those images. Now a small timer on each host checks a time window, its own health and its neighbours, takes a lock from a ~200-line Python FleetLock server, and only then reboots. No Kubernetes, no etcd, and protocol-compatible with the Fedora CoreOS tooling in case I outgrow it.

In how I tweak my base image I described how I replaced bootc-fetch-apply-updates.timer with my own bootc-fetch.timer: every hour bootc update pulls the newest image and stages it, but doesn’t reboot. I ended that post with “the actual reboot is a separate step I control manually or via another timer”. This post is about that missing step.

Running image builds on a schedule makes sense for security – you want your bootc images to pick up the latest Fedora updates automatically. But scheduling a daily build that rebuilds every image every day, even when nothing upstream changed, wastes runner time and fills the registry with identical layers.

This post covers how I added upstream change detection to my Forgejo CI pipelines for gorgeOS, so that scheduled builds are truly no-ops when the upstream image hasn’t moved.

Running a Fedora-based bootc image stack means tracking multiple Fedora releases in parallel. Instead of duplicating every job in the workflow, I wired up the matrix strategy in Forgejo Actions to build F43 and F44 from a single job definition.

The Problem With Hardcoded Versions

Before, every Containerfile had a hardcoded base image:

FROM git.m1ch.eu/oci/c-os:base-43

Supporting F44 would have meant either duplicating the whole workflow or a manual find-and-replace for every release. Neither scales.

In the last post I walked through the base image that every one of my servers shares. This time I want to look at the first layer on top of it: the cloud image, which adds everything a virtual machine running in a hypervisor environment needs.

The full source is in my gorge.os repository.

Layered images

One of the things I really like about BootC is that you can layer images just like you layer application containers. The cloud image simply starts from the base:

In the last post I explained why I decided to switch to BootC for all my servers. This time I want to walk through what I actually put into my base image - the packages, the config files, and the custom services that make every host feel like home.

The full source is in my gorge.os repository.

The Containerfile structure

Before getting into what’s in the image, I want to explain how I put things into it. The Containerfile is split into three stages: package management, file placement, and service activation.

I have a fair amount of servers that I’m (co-)responsible for. To make my life easier I tried serveral managent tools to do the common tasks for all servers as smooth as possible.
The two tools I mainly use at the moment are ansible and cloud-init.

Cloud-init is a great tool to spin up a new server, or to resore an existing one.
ansible is great to do common tasks, like updating servers, installing packages to multiple hosts, but when it comes to thinks like adding a systemd-service to just a view hosts, it never felt natural to me.

TL;DR – My bootc hosts stage new images every hour, but nothing rebooted them into those images. Now a small timer on each host checks a time window, its own health and its neighbours, takes a lock from a ~200-line Python FleetLock server, and only then reboots. No Kubernetes, no etcd, and protocol-compatible with the Fedora CoreOS tooling in case I outgrow it.

In how I tweak my base image I described how I replaced bootc-fetch-apply-updates.timer with my own bootc-fetch.timer: every hour bootc update pulls the newest image and stages it, but doesn’t reboot. I ended that post with “the actual reboot is a separate step I control manually or via another timer”. This post is about that missing step.

My homelab is mostly text: Docker Swarm compose files, bootc Containerfiles, Forgejo workflows, a few Ansible playbooks and this Hugo blog. All of it lives in git, and for years the workflow has been the same: edit in an editor, render, deploy, check the logs, repeat.

Over the last months two coding agents moved into that loop: opencode and Claude Code. This post covers how I set them up, what they do for me, and where I still keep my hands on the wheel.

Every prompt you send to a hosted LLM leaves your network. That includes the text you type, the files you attach, and whatever context your tools decide to pack around it. For a quick question about a regex that doesn’t matter. For your mailbox, your customers’ tickets or your company wiki, it matters a lot.

That is the main reason I run most of my models on my own hardware with Ollama. This post covers why, and where these models are useful in a self-hosted setup.

Running image builds on a schedule makes sense for security – you want your bootc images to pick up the latest Fedora updates automatically. But scheduling a daily build that rebuilds every image every day, even when nothing upstream changed, wastes runner time and fills the registry with identical layers.

This post covers how I added upstream change detection to my Forgejo CI pipelines for gorgeOS, so that scheduled builds are truly no-ops when the upstream image hasn’t moved.

Running a Fedora-based bootc image stack means tracking multiple Fedora releases in parallel. Instead of duplicating every job in the workflow, I wired up the matrix strategy in Forgejo Actions to build F43 and F44 from a single job definition.

The Problem With Hardcoded Versions

Before, every Containerfile had a hardcoded base image:

FROM git.m1ch.eu/oci/c-os:base-43

Supporting F44 would have meant either duplicating the whole workflow or a manual find-and-replace for every release. Neither scales.

Why bother with a fancy Match block?

When you SSH into a fleet of servers that share a naming scheme, you usually end up copying-pasting the same options over and over. A Match block that tests the host name and then tweaks the connection parameters lets you:

• Keep a single config file that works for every member of the group.
• Automate proxying or port-translation without having to write a wrapper script.

The example below demonstrates the trick.

This morning I woke up and the radio was not playing. I soon figured out, that my DNS, AdGuard, was for some reason down.

I started with the debugging, even before I had breakfast. Not evan a coffee!

The docker-container for AdGuard was running and reported no error. So I dug deeper and deeper, just to find out, that several containers showed strange behavior. For example did Traefik had som error that it could not find the middlewares, that where configured via environment variables.

TL;DR – My bootc hosts stage new images every hour, but nothing rebooted them into those images. Now a small timer on each host checks a time window, its own health and its neighbours, takes a lock from a ~200-line Python FleetLock server, and only then reboots. No Kubernetes, no etcd, and protocol-compatible with the Fedora CoreOS tooling in case I outgrow it.

In how I tweak my base image I described how I replaced bootc-fetch-apply-updates.timer with my own bootc-fetch.timer: every hour bootc update pulls the newest image and stages it, but doesn’t reboot. I ended that post with “the actual reboot is a separate step I control manually or via another timer”. This post is about that missing step.

TL;DR – I plan my side project with a coding agent in OpenProject instead of a chat window. I write user stories (what and why); the agent, working as its own least-privilege user, turns them into features and tasks with specs (how) and hands them back for review. It only writes code for items assigned to it, and only when I ask. It works, it costs some ceremony, and the MCP tooling still has rough edges.

My homelab is mostly text: Docker Swarm compose files, bootc Containerfiles, Forgejo workflows, a few Ansible playbooks and this Hugo blog. All of it lives in git, and for years the workflow has been the same: edit in an editor, render, deploy, check the logs, repeat.

Over the last months two coding agents moved into that loop: opencode and Claude Code. This post covers how I set them up, what they do for me, and where I still keep my hands on the wheel.

Every prompt you send to a hosted LLM leaves your network. That includes the text you type, the files you attach, and whatever context your tools decide to pack around it. For a quick question about a regex that doesn’t matter. For your mailbox, your customers’ tickets or your company wiki, it matters a lot.

That is the main reason I run most of my models on my own hardware with Ollama. This post covers why, and where these models are useful in a self-hosted setup.

Running image builds on a schedule makes sense for security – you want your bootc images to pick up the latest Fedora updates automatically. But scheduling a daily build that rebuilds every image every day, even when nothing upstream changed, wastes runner time and fills the registry with identical layers.

This post covers how I added upstream change detection to my Forgejo CI pipelines for gorgeOS, so that scheduled builds are truly no-ops when the upstream image hasn’t moved.

Running a Fedora-based bootc image stack means tracking multiple Fedora releases in parallel. Instead of duplicating every job in the workflow, I wired up the matrix strategy in Forgejo Actions to build F43 and F44 from a single job definition.

The Problem With Hardcoded Versions

Before, every Containerfile had a hardcoded base image:

FROM git.m1ch.eu/oci/c-os:base-43

Supporting F44 would have meant either duplicating the whole workflow or a manual find-and-replace for every release. Neither scales.

TL;DR – My bootc hosts stage new images every hour, but nothing rebooted them into those images. Now a small timer on each host checks a time window, its own health and its neighbours, takes a lock from a ~200-line Python FleetLock server, and only then reboots. No Kubernetes, no etcd, and protocol-compatible with the Fedora CoreOS tooling in case I outgrow it.

In how I tweak my base image I described how I replaced bootc-fetch-apply-updates.timer with my own bootc-fetch.timer: every hour bootc update pulls the newest image and stages it, but doesn’t reboot. I ended that post with “the actual reboot is a separate step I control manually or via another timer”. This post is about that missing step.

TL;DR – I plan my side project with a coding agent in OpenProject instead of a chat window. I write user stories (what and why); the agent, working as its own least-privilege user, turns them into features and tasks with specs (how) and hands them back for review. It only writes code for items assigned to it, and only when I ask. It works, it costs some ceremony, and the MCP tooling still has rough edges.

TL;DR – I plan my side project with a coding agent in OpenProject instead of a chat window. I write user stories (what and why); the agent, working as its own least-privilege user, turns them into features and tasks with specs (how) and hands them back for review. It only writes code for items assigned to it, and only when I ask. It works, it costs some ceremony, and the MCP tooling still has rough edges.

My homelab is mostly text: Docker Swarm compose files, bootc Containerfiles, Forgejo workflows, a few Ansible playbooks and this Hugo blog. All of it lives in git, and for years the workflow has been the same: edit in an editor, render, deploy, check the logs, repeat.

Over the last months two coding agents moved into that loop: opencode and Claude Code. This post covers how I set them up, what they do for me, and where I still keep my hands on the wheel.

Every prompt you send to a hosted LLM leaves your network. That includes the text you type, the files you attach, and whatever context your tools decide to pack around it. For a quick question about a regex that doesn’t matter. For your mailbox, your customers’ tickets or your company wiki, it matters a lot.

That is the main reason I run most of my models on my own hardware with Ollama. This post covers why, and where these models are useful in a self-hosted setup.

TL;DR – I plan my side project with a coding agent in OpenProject instead of a chat window. I write user stories (what and why); the agent, working as its own least-privilege user, turns them into features and tasks with specs (how) and hands them back for review. It only writes code for items assigned to it, and only when I ask. It works, it costs some ceremony, and the MCP tooling still has rough edges.

TL;DR – I plan my side project with a coding agent in OpenProject instead of a chat window. I write user stories (what and why); the agent, working as its own least-privilege user, turns them into features and tasks with specs (how) and hands them back for review. It only writes code for items assigned to it, and only when I ask. It works, it costs some ceremony, and the MCP tooling still has rough edges.

My homelab is mostly text: Docker Swarm compose files, bootc Containerfiles, Forgejo workflows, a few Ansible playbooks and this Hugo blog. All of it lives in git, and for years the workflow has been the same: edit in an editor, render, deploy, check the logs, repeat.

Over the last months two coding agents moved into that loop: opencode and Claude Code. This post covers how I set them up, what they do for me, and where I still keep my hands on the wheel.

My homelab is mostly text: Docker Swarm compose files, bootc Containerfiles, Forgejo workflows, a few Ansible playbooks and this Hugo blog. All of it lives in git, and for years the workflow has been the same: edit in an editor, render, deploy, check the logs, repeat.

Over the last months two coding agents moved into that loop: opencode and Claude Code. This post covers how I set them up, what they do for me, and where I still keep my hands on the wheel.

Every prompt you send to a hosted LLM leaves your network. That includes the text you type, the files you attach, and whatever context your tools decide to pack around it. For a quick question about a regex that doesn’t matter. For your mailbox, your customers’ tickets or your company wiki, it matters a lot.

That is the main reason I run most of my models on my own hardware with Ollama. This post covers why, and where these models are useful in a self-hosted setup.

My homelab is mostly text: Docker Swarm compose files, bootc Containerfiles, Forgejo workflows, a few Ansible playbooks and this Hugo blog. All of it lives in git, and for years the workflow has been the same: edit in an editor, render, deploy, check the logs, repeat.

Over the last months two coding agents moved into that loop: opencode and Claude Code. This post covers how I set them up, what they do for me, and where I still keep my hands on the wheel.

Every prompt you send to a hosted LLM leaves your network. That includes the text you type, the files you attach, and whatever context your tools decide to pack around it. For a quick question about a regex that doesn’t matter. For your mailbox, your customers’ tickets or your company wiki, it matters a lot.

That is the main reason I run most of my models on my own hardware with Ollama. This post covers why, and where these models are useful in a self-hosted setup.

Every prompt you send to a hosted LLM leaves your network. That includes the text you type, the files you attach, and whatever context your tools decide to pack around it. For a quick question about a regex that doesn’t matter. For your mailbox, your customers’ tickets or your company wiki, it matters a lot.

That is the main reason I run most of my models on my own hardware with Ollama. This post covers why, and where these models are useful in a self-hosted setup.

Running image builds on a schedule makes sense for security – you want your bootc images to pick up the latest Fedora updates automatically. But scheduling a daily build that rebuilds every image every day, even when nothing upstream changed, wastes runner time and fills the registry with identical layers.

This post covers how I added upstream change detection to my Forgejo CI pipelines for gorgeOS, so that scheduled builds are truly no-ops when the upstream image hasn’t moved.

Running a Fedora-based bootc image stack means tracking multiple Fedora releases in parallel. Instead of duplicating every job in the workflow, I wired up the matrix strategy in Forgejo Actions to build F43 and F44 from a single job definition.

The Problem With Hardcoded Versions

Before, every Containerfile had a hardcoded base image:

FROM git.m1ch.eu/oci/c-os:base-43

Supporting F44 would have meant either duplicating the whole workflow or a manual find-and-replace for every release. Neither scales.

Running image builds on a schedule makes sense for security – you want your bootc images to pick up the latest Fedora updates automatically. But scheduling a daily build that rebuilds every image every day, even when nothing upstream changed, wastes runner time and fills the registry with identical layers.

This post covers how I added upstream change detection to my Forgejo CI pipelines for gorgeOS, so that scheduled builds are truly no-ops when the upstream image hasn’t moved.

Running a Fedora-based bootc image stack means tracking multiple Fedora releases in parallel. Instead of duplicating every job in the workflow, I wired up the matrix strategy in Forgejo Actions to build F43 and F44 from a single job definition.

The Problem With Hardcoded Versions

Before, every Containerfile had a hardcoded base image:

FROM git.m1ch.eu/oci/c-os:base-43

Supporting F44 would have meant either duplicating the whole workflow or a manual find-and-replace for every release. Neither scales.

Ich hab’s geschafft. Meine ersten 200 km mit dem Rad.

Ich hab’s geschafft. Meine ersten 200 km mit dem Rad.

Ich hab’s geschafft. Meine ersten 200 km mit dem Rad.

Tag 31 (2020-07-06) - Über den Sarstein

In vier Tagen Pause konnte ich mich gut erholen. Eva hat Verwandte in Oberösterreich, und da hat sie beschlossen, diese zu besuchen und mich am Weg abzusetzen.

In der Früh hat sie mich dann am Pötschenpass, zwischen Altaussee und Hallstätter See, abgesetzt. Die ersten 1,5 km waren mir noch wohlbekannt, bin ich sie doch erst fünf Tage zuvor gegangen, damals noch in der Hoffnung, dass ich es vor dem Gewitter auf den Sarstein schaffe.

Nachdem ich das Tote Gebirge durchquert hatte, die Wettervorhersage alles andere als gut war und auch mein Körper eine Pause vertragen konnte, bin ich kurzerhand nach Hause gefahren und habe mich ein paar Tage lang entspannt.

Am Kartenausschnitt oben kann man meinen Weg durchs Tote Gebirge ganz gut erkennen. Leider war es mir nicht immer möglich, genau der Grenze zu folgen. Vor allem den Abschnitt über den Stoderkamm, vom Großen Tragl zum Feuerberg, habe ich diesmal ausgelassen, da noch zu viel Schnee lag und ich alleine unterwegs war. Diese Etappe möchte ich aber auf jeden Fall noch nachholen!

Nach zwei Tagen Pause geht es weiter: ein einsamer Tag über die Gipfel rund um den Rinnerkogel zur Ischler Hütte – und ein Tag, der mit neugierigen Kühen beginnt und im Gewitter am Sommersbergsee endet.

Tag 29 (2020-06-30)