---
title: "Inbox — 2026-10-17"
date: "2026-10-17"
---
# Inbox — 2026-10-17

- 02:24 — SQLite-backed single-pod apps on Kubernetes: keep the live DB on a node-local PV (local-path), not NFS (SQLite locking/atomic rename is unreliable on NFS). Use NFS only as the backup target: nightly CronJob scales the app to 0, tars the data dir + sha256 onto an inline nfs volume, scales back to 1. local-path PVs carry node affinity, so a Job mounting the same PVC lands on the right node automatically.
- 04:08 — versitygw 1.4.1 (posix backend) works with @aws-sdk/client-s3 3.1109 + lib-storage under the SDK default CRC32 checksums: put, multipart, ranged GET, metadata all pass a real contract test in CI. Gotchas: SigV4 region must equal the gateway --region (default us-east-1); posix dir needs user. xattrs or --sidecar; on ext4 CompleteMultipartUpload stores all parts in one xattr and fails near ~1418 parts (versity/versitygw#2424); If-None-Match:* create is not atomic before 1.8.0; streamed aws-chunked uploads store Content-Encoding until 1.9.0.
- 12:40 — Amazon republished the RDS global CA bundle (the global-bundle file on truststore.pki.rds.amazonaws.com) on 2026-10-14: 114 self-signed RDS roots, 38 regions x RSA2048/RSA4096/ECC384, new sha256 90a6f1a7978a1b1b096dca6c57511ca48d3b8cf052f8e704baf358f34ea2f21b. Dockerfiles that pin it with ADD --checksum fail with 'digest mismatch' until re-pinned (hit plannotator/artifact-server and the duyet fork).
- 12:40 — In the user's zsh profile, 'paste' is aliased to pbpaste: shell pipelines using paste -sd/-d silently emit clipboard text. Use awk or tr instead.
- 13:55 — SQLite over NFS 4.2 (Linux 6.8 client+server), WAL mode, single writer: ~7 ms/commit vs ~1.4 ms local; kill -9 mid-write left integrity ok with no lost commits; a second writer got 'database is locked' from the same host AND from another host (NFSv4 locks are server-side); after release the other host read every row. Workable for one low-traffic writer; never run two writers (k8s: replicas 1 + strategy Recreate).
- 13:55 — Helm 4 'helm template' assumes its own newest Kubernetes version unless told; a chart with an upper kubeVersion bound (e.g. <1.37) then fails with 'incompatible with Kubernetes v1.37.0'. Pass --kube-version <cluster version> when rendering offline.
- 13:55 — 'helm template --output-dir' appends hook manifests (e.g. a pre-install migration Job) to files already in the output dir, so a second render duplicates the Job and kustomize fails with 'already registered id'. Clean the output dir before every render.
- 13:55 — GitHub auto-merge needs a required check (branch protection or a ruleset with required_status_checks) to wait for CI. With allow_auto_merge on but no required checks, arming auto-merge merges immediately even while checks are still running.
- 13:55 — Correction to an earlier note: for a SQLite app on Kubernetes with NFS available, live data on NFS can work for a single writer (see the NFS 4.2 probe note); the earlier 'never put SQLite on NFS, use local-path + NFS backups' advice is the conservative default, not a hard rule.