JokerTech

Subscribe

The Story of Shipping a Side Project, Told Through Commit Messages

Every one of these real commit messages describes a decision, not a diff. Read in order, they're a better changelog for what actually happened than any release notes would be.

Harbor's Pull-Blocking Does Not Block an OCI Index

The same image, same 7 Critical findings, gets a 412 PROJECTPOLICYVIOLATION as a plain manifest and a 200 as an OCI index — the format buildx and most modern build tooling produce by default.

An Offline Swipe Queue Where a Later Verdict Replaces an Earlier One

Photo Sweep's Android client writes every verdict to a local queue before sending it anywhere. Changing your mind twice about the same photo shouldn't send two contradictory instructions — so a later entry silently replaces an earlier one.

The One Failure That Looks Like Ten Different Failures: an etcd Quota Incident

212 MB of SBOM custom resources filled a 200 MB etcd and took down Flux reconciliation cluster-wide. Every visible symptom pointed somewhere else.

One SQL view that tells me what is overdue across forty-odd trackers

One SQL view that tells me what is overdue across forty-odd trackers

How a single UNION ALL view in NocoBase became the only list I read each morning, and the two things Postgres and NocoBase refused along the way.

We Migrated Away From a Google-Recommended Library Because Google Broke It

EncryptedSharedPreferences was Google's own recommended way to store secrets on Android. It's now deprecated and unmaintained, and was the known source of the keyset corruption this app had to defend against.

No Password Form: Login Flow v2 and Revocable App Passwords

Photo Sweep's Android client has no login screen that asks for a password. It hands you to your own Nextcloud's login page in a browser and comes back with a revocable, per-device app password instead.

Why the App Isn't Called 'Nextcloud Cleaner': A Trademark Rename Story

The Nextcloud app store rules say plainly: apps must not use 'Nextcloud' in their name. The app was built as Nextcloud Cleaner, renamed to Photo Sweep, and the app id itself changed along the way.

The Paperwork Nobody Tells You About Before Publishing a Nextcloud App

A signing certificate for the Nextcloud app store isn't self-service: you submit a CSR as a GitHub pull request and wait for a maintainer to sign it, days rather than minutes, and the CN has to exactly match your immutable app id.

The Honest Ceiling: Why 38 of 94 Images Can Never Route Through Harbor

Maximum Harbor routing is 56 of 94 images — the other 38 run only in namespaces that must keep pulling direct, each one a dependency loop with a written reason. The honest framing: routing raises patchability, not visibility.

A Batch Endpoint Designed for Someone Syncing 100 Decisions From a Train

POST /decisions accepts either one verdict or an array of them, through the same handler and the same validation. The batch form exists so a review session with no signal doesn't turn into a hundred requests.

Keyless Signing Has Two Hard Blockers Here

Cosign's keyless mode needs a CI platform Fulcio trusts and a live path to public Sigstore at admission time. This cluster fails one of those for one CI platform, and fails the other for both — so the phase-in policy ships key-based only.

One REST API, Two Clients: The Web UI and the Android App Share Every Endpoint

Photo Sweep's Android client and Vue web UI both talk to the same OCS API with no client-specific endpoint anywhere. A verdict given on the phone shows up in the web review screen, and back.

pod-security-admission

Four of Our Six Policies Shouldn't Be Policies

A Kyverno ClusterPolicy with four rules — non-root, no privileged, no privilege escalation, drop ALL capabilities — is four rules Pod Security Admission already enforces for free. The policy file says so in its own header.

Minimizing Blast Radius When You Must Use Unstable Internals

Two files in Photo Sweep touch Nextcloud internals that have no public equivalent — OC\Files\Search\* and OCA\Files_Trashbin. Both check what's available first and degrade rather than break.

Absence of a Report Is Not Evidence of a Clean Image

Trivy Operator reports over ~1.5 MiB fail to write, silently. Your largest images — often your riskiest — show zero findings. Here is how to detect it and the trade-offs in fixing it.

The house rules for adding one more app to a crowded VPS

The house rules for adding one more app to a crowded VPS

One folder, one compose file, a .env.example, a setup.sh that writes the secrets, and nothing in git that the server owns. The conventions I add apps by, and where each one came from.

A Two-Phase Commit for File Moves, Without a Database Transaction

Photo Sweep marks a verdict 'applied' only after the file has actually moved — never before. A crash between the move and the write leaves the file gone but the row still pending, and retrying handles that correctly.

Deciding Is Separated From Doing

In Photo Sweep, a verdict is just a database row until one specific action executes it. You can judge a thousand photos, change your mind about any of them, and close the tab having changed nothing.

Resumable Background Indexing Against an API That Doesn't Support What You Need

Nextcloud's file search only accepts eq/in on fileid, not gt — so a keyset cursor for resumable indexing literally cannot be expressed. Order by file id instead, and let a final sweep catch what slipped.

Rejecting Dates That Only Look Like Dates

PHP's date parser doesn't fail on 20241312 — it rolls month thirteen into January 2025. A parse that succeeds is not evidence of a real date, so Photo Sweep formats every result back and requires a match.

Safest First: Ordering a Migration by Blast Radius, Not by Image Count

The nine-registry routing queue is sorted safest-first: gcrmirror touches one scanner, quay touches OpenBao's StatefulSet, and dragonflydb — GitLab's own Redis — comes with a note that skipping it is a reasonable choice.

Figuring Out When a Photo Was Actually Taken

Nextcloud stores no first-class 'date taken' field. Photo Sweep's month-by-month review depends on one, so it walks a four-link chain — EXIF, filename, mtime, upload time — and records which link answered.

Nine Compliance Specs Hidden in the Binary

Trivy 0.73.0 ships nine compliance specs compiled into the binary — CIS for AWS, Docker, EKS, Kubernetes and RKE2, plus NSA and both Pod Security Standards profiles. Nothing in the help output tells you their names.

Standing on Shoulders, Ethically: Crediting Prior Reverse-Engineering Work

The batchexecute rpcids this app relies on were mapped by someone else's open-source project first. No code was copied, but the knowledge came from somewhere — and the README says exactly where.