ktz.

How I Made My 10-Year-Old Nvidia Shield Feel Brand New

Alex Kretzschmar — Sun, 12 Jul 2026 03:59:29 GMT

The original Nvidia Shield TV has had an extraordinary run, but ten years of apps, updates, launchers, and background services had left mine feeling sluggish.

I used Codex and Android Debug Bridge (ADB) to inspect it over my local network. The biggest issue was simple: Projectivy Launcher was visible, but Android TV Home was still registered as the real home app and continued running behind it.

The steps below make Projectivy the actual home app, disable the unused stock launcher components, shorten Android’s animations, compile Projectivy for faster startup, and verify that everything survives a reboot.

These commands are specific to my Shield TV setup. ADB provides administrator-like access, so review every command before running it. This is a responsiveness tune-up, not a hardware upgrade.

Before you start

Install and configure Projectivy Launcher before disabling the stock launcher. You will also need Google’s ADB platform tools. On macOS:

brew install android-platform-tools

Enable network debugging on the Shield:

Open Settings > Device Preferences > About.
Select Build seven times.
Return to Device Preferences > Developer options and enable Network debugging.
Find the Shield’s IP address under Network & Internet.

Connect from your computer, substituting the Shield’s address:

adb connect YOUR_SHIELD_IP:5555
adb devices

Accept the authorization prompt on the TV. The device should appear as device rather than unauthorized or offline.

Before changing anything, record the current launcher and animation settings:

adb shell cmd package resolve-activity --brief \
  -a android.intent.action.MAIN \
  -c android.intent.category.HOME

adb shell settings get global window_animation_scale
adb shell settings get global transition_animation_scale
adb shell settings get global animator_duration_scale

Apply the changes

Run these commands one at a time:

adb shell cmd package set-home-activity \
  com.spocky.projengmenu/.ui.home.MainActivity

adb shell pm disable-user --user 0 com.google.android.tvlauncher
adb shell pm disable-user --user 0 com.google.android.tvrecommendations
adb shell pm disable-user --user 0 com.netflix.ninja

adb shell settings put global window_animation_scale 0.5
adb shell settings put global transition_animation_scale 0.5
adb shell settings put global animator_duration_scale 0.5

adb shell cmd package compile -m speed -f com.spocky.projengmenu
adb shell am kill-all
adb reboot

What they do:

set-home-activity makes Projectivy Android’s real home app instead of leaving it layered over Android TV Home.
The two Google disable-user commands disable the stock launcher and recommendations for user 0. They do not remove the packages, so the change is reversible.
Disabling com.netflix.ninja is optional. It neutralized the dedicated Netflix remote button in my setup, but also disables the Netflix app. Skip it if you use Netflix.
The three animation settings halve transition times. This changes perceived responsiveness rather than processor performance.
The final commands compile Projectivy in speed mode, stop disposable background processes, and reboot.

I deliberately left Chromecast, Google Play Services, Bluetooth, voice control, media providers, and Nvidia system services alone.

Verify the result

Reconnect after the reboot and check the active home app, animation values, and relevant processes:

adb connect YOUR_SHIELD_IP:5555

adb shell cmd package resolve-activity --brief \
  -a android.intent.action.MAIN \
  -c android.intent.category.HOME

adb shell settings get global window_animation_scale
adb shell settings get global transition_animation_scale
adb shell settings get global animator_duration_scale

adb shell ps -A | grep -E 'projengmenu|tvlauncher|tvrecommendations|netflix'

The home resolver should return Projectivy, each animation value should be 0.5, and the disabled packages should not have running processes. Test the home button, voice input, casting, Bluetooth remote, and your usual apps.

Roll everything back

These commands re-enable the disabled apps, restore normal animation timing, and select Android TV Home again:

adb shell pm enable com.netflix.ninja
adb shell pm enable com.google.android.tvlauncher
adb shell pm enable com.google.android.tvrecommendations

adb shell settings put global window_animation_scale 1.0
adb shell settings put global transition_animation_scale 1.0
adb shell settings put global animator_duration_scale 1.0

adb shell cmd package set-home-activity \
  com.google.android.tvlauncher/.MainActivity

adb reboot

If that stock component name changes in a future Shield release, enable the packages, reboot, and choose Android TV Home from the on-screen home-app picker instead of guessing another activity name.

A Shield update may re-enable system packages, so recheck the resolved home app afterward. Once you are finished, turn off Network debugging to be on the safe side. Happy Shielding.

Faking disks to look real with QEMU and Proxmox

Alex Kretzschmar — Sat, 06 Jun 2026 23:46:24 GMT

Whilst prepping for Perfect Media Server Part 3, I needed to conduct some testing with a Proxmox VM and make fake QEMU disks attached via SCSI look real to inxi -xD.

The problem was that inxi kept showing generic QEMU HARDDISK. Fine, but not what I wanted when filming a video about how to identify physical disks and map them to your fstab file. I had hoped I could make it feel a bit more real in the video without having to drag a ton of old physical disks out of storage.

root@proxtest:~# inxi -xD
Drives:
  Local Storage: total: 240 GiB lvm-free: 16 GiB used: 5.71 GiB (2.4%)
  ID-1: /dev/sda vendor: QEMU model: HARDDISK size: 10 GiB
  ID-2: /dev/sdb vendor: QEMU model: HARDDISK size: 8 GiB
  ID-3: /dev/sdc vendor: QEMU model: HARDDISK size: 5 GiB
  ID-4: /dev/sdd vendor: QEMU model: HARDDISK size: 7 GiB
  ID-5: /dev/sde vendor: QEMU model: HARDDISK size: 10 GiB

Unfortunately, setting the serial= parameter had no effect. Which led me to do a deepdive on the fields that Proxmox SCSI disks support:

vendor
product
serial
wwn

The useful ones for inxi -xD are vendor and product.

Here is one example:

qm set 1000 \
  --scsi0 local-lvm:vm-1000-disk-2,discard=on,iothread=1,product=WD10EZEX-D10A,serial=SNAP1000D10A,size=10G,vendor=WDC,wwn=0x5000100001001000

I did that for each fake disk. Then after a full VM stop and start, inxi -xD showed me what I wanted. Pretty convincing at first glance, wouldn’t you say? Perfect for my needs tonight.

ID-1: /dev/sda vendor: Western Digital model: WD10EZEX-D10A size: 10 GiB
ID-2: /dev/sdb vendor: HGST (Hitachi) model: HDN7280D08 size: 8 GiB
ID-3: /dev/sdc vendor: Crucial model: CT500MX500D05 size: 5 GiB
ID-4: /dev/sdd vendor: Seagate model: ST7000VN-D07 size: 7 GiB
ID-5: /dev/sde vendor: Western Digital model: WD10PURX-P10 size: 10 GiB

A couple of small gotchas, you can only set the values to a max:

vendor  = max 8 bytes
product = max 16 bytes
serial  = max 20 bytes
wwn     = 0x plus 16 hex digits

Also, vendor=WDC shows up as Western Digital in inxi because it normalizes some short hardware vendor codes into friendly names. WDC is the common vendor string for Western Digital disks. Linux sees the SCSI vendor as WDC, but inxi maps that to Western Digital for display.

Hope you found this little tip useful.

Control a Mitsubishi mini-split with ESPHome and Home Assistant for $10

Alex Kretzschmar — Wed, 27 May 2026 01:49:50 GMT

I recently had a Mitsubishi mini-split air conditioner installed as part of an attic conversion project. The device was, according to the installer, only controllable via the IR remote. And that just won’t do.

So in today’s post I’m going to detail how I used an ESP32 running ESPHome to achieve bi-directional control of the Mitsubishi units using the CN105 control port on the mainboard of the head unit.

What to expect

These units are not cheap. So please only do this if you are comfortable. I am not a lawyer so please apply your own risk disclaimers for damage to property and yourself in case of screw ups. Turn off the power to the units before opening anything up, go slow and take your time. It’s not a difficult install and should be an easy afternoon project for most DIY’ers.

The hardware install can be completed in under 10 minutes. The first time will likely take a bit longer as the plastic housings of the units can be a bit fiddly to free from the clips. I cover this is more detail in the video.

The software side might trip a few folks up the first time as there are a few moving parts. I assume for the purposes of this post that you have a functional Home Assistant installation, and a functional ESPHome installation atop it.

Parts

To complete this project you will need:

Item	Price	Purpose
ESP32	$5	The brains of the operation
Connector PAP-05V-S	$7	Connect ESP32 to CN105 port

Note that I have linked to multi-packs of ESP32s and of the connectors too, you might be able to find these things cheaper elsewhere but regardless it’s still a low cost project.

Also note that these links are affiliate links to support my work.

Unit disassembly

The unit I have is the MSZ-GS09NA, though I have found that the process seems broadly the same across the units in NA I have come across, your mileage may vary.

Begin by turning off power at the breaker, and removing the vanes of the unit. There are two plastic tabs that slide and lock the vanes in position.

With the vanes removed, look for two small plastic screw covers and remove them and their associated screws.

The centre of the unit will have a small screwless retaining clip, give it a sharp tug in the middle towards you and free the housing pulling it straight off the front of the unit. It does not pivot (like the filter housings do).

Once the housing is removed look for the grey mainboard cover on the right of the unit and locate the red coloured CN105 port. We’ll come back to this later.

ESP configuration

This process is not yet fully written up as I got distracted but the code is below so reach out if you get stuck

esphome-mitsubishi.yaml

GitHub Gist: instantly share code, notes, and snippets.

Gist262588213843476

The Enshittification of Plex 💩

Alex Kretzschmar — Sun, 24 May 2026 20:44:44 GMT

Perhaps you heard the news this week that Plex is raising the cost of a lifetime pass from $250 to $750? Perhaps you’ve become numb to the general enshittification of the Plex Media Server software?

Today, I’m going to break down everything that’s happened over the last decade that got us to this point. I’ll aim to be as factually accurate as possible. But I’m now at the point with Plex where I’m done. I’m out. It has been obvious for years that there is only one end result here and with the news of the massive price hike recently I’m fairly certain we are watching the final stages of collapse.

“But lifetime passers are grandfathered in” you might say, “so why should I care?”. That is true, they are. But Plex has to exist for their authentication services, live TV EPG services, and many more aspects of the Plex experience to work at all. So if Plex the company goes away, then so will everything else around it regardless of whether you have a lifetime pass, as I do, or not.

I’m switching to Jellyfin for good, and I hope you will too.

What is Plex?

It’s a “bring your own files”, self-hosted version of a media streaming platform like a Netflix or Spotify. But you run the service on your hardware, streaming your files, using your electricity, hardware, and so forth.

Plex began as a fork of XBMC, originally as a Mac OS X port of XBMC. At the time it was known as OSXBMC and was the creation of Elan Feingold. In May 2008 the Plex name was adopted after the XBMC codebase was forked. Kodi’s own wiki - Kodi is the newer modern name for the XBMC project - notes that newer Plex clients were later rewritten and are no longer based on the forked code.

License is a particularly messy area of Plex’s history. XBMC was GPL-based, so early Plex inherited open-source obligations, but Plex evolved into a commerical product with significant closed-source/proprietary parts. Some Plex client code has remained open for compliance reasons, but the core Plex Media Server code is not open-source.

What is Jellyfin?

To answer this we must introduce Emby. Emby came from a separate lineage of media software known as Media Browser in March 2015. Jellyfin is a fork of Emby. The split here occurred in 2018 from Emby v3.5.2 after Emby moved toward a proprietary/closed-source model.

Jellyfin is the free-software continuation and alternative to both Emby and Plex.

A timeline of events

The idea here is give you a picture of the notably things that have happened in the Plex universe over the last decade or so. You can see quite clearly around 2019+ how the company has been flailing and looking for a purpose since The Verge’s article in July 2019.

August 2012 - PlexPass launches
- Plex framed PlexPass as a supporter / early-access program
- Early access, private forums, premium feature testing, and discounts were part of the pitch
- Launch price was $3.99/month
November 2012 - PlexSync becomes an early premium feature
- PlexSync let users reformat and load media onto mobile devices for offline viewing
- Announced as a PlexPass feature
September 2014 - Plex Pass price hike
- Plex announced new pricing effective Sept 2014
  - Monthly increased from $3.99 -> $4.99
  - Annual increased from $29.99 -> $39.99
  - Lifetime increase from $74.99 -> $149.99
November 2014 - Plex Home / parental-control tiering
- Plex introduced Plex Home, managed users, and finer access controls
- Some multiuser features became free
- More advanced Home / sharing controls stayed Plex Pass
July 2015 - Forum security breach
- Plex’s forum was hacked.
- HaveIBeenPwnd.net listed 327,000+ exposed accounts including emails, IPs, usernames, and weakly implemented salted password hashes.
- Plex reset users passwords
- Reports noted a ransom demand
September 2016 - DVR beta added to Plex Pass
- Plex DVR launched in beta for Plex Pass subscribers
- Initially tied to HDHomeRun tuners and guide data
December 2016 - Hardware transcoding preview
- Plex Media Server 1.4.0 added a Hardware Transcoding Preview
- It was introduced as a Plex Pass feature for Windows, macOS, and Linux
- Early support included Intel graphics caveats
- Plex’s current docs still list hardware-accelerated streaming as premium, while ordinary software transcoding remains free
  - exceptions include NVIDIA SHIELD and WD My Cloud Pro PR2100 / PR4100 servers
June-August 2017 - Live TV / DVR solidifies as Plex Pass
- Plex added Live TV and later expanded time shifting / DVR support
- Live TV / DVR required Plex Pass plus supported tuner / antenna hardware
August 2017 - Privacy policy changes and backlash
- A proposed policy removed users’ ability to opt out of some data collection, prompting fears about library tracking
- Plex revised the policy in response and restored opt-out controls
December 2017 - Plexamp launches
- Plex Labs unveiled Plexamp as its first project
- A Winamp-inspired desktop music player for Plex music libraries
October 2018 - Plex Cloud and feature retirements
- Plex retires Watch Later, Recommended, Cloud Sync and plugins
- Plex shutdown their hosted Plex Cloud service after reliability / cost problems
Nov 2018 - Plex adds TIDAL integration
- This added streaming music, TIDAL-powered discovery, universal playlists/search, and library augmentation alongside personal music collections
July 2019 - The Verge very publicly highlights Plex’s piracy problem
- A Verge feature highlighted Plex’s role in private shared libraries
- Plex is framed as enabling “unofficial piracy streaming clubs”
- Emphasizes the piracy problem that Plex has (ed: and always will have!)
Dec 2019 - Ad-supported streaming launches
- Plex launched free, ad-supported movies and TV in 200+ countries,
- This marked a major pivot beyond personal media libraries into studio-backed streaming
Feb 2020 - Plex servers used for DDoS amplication
- Researchers found exposed Plex Media Server instances being abused for PMSSDP reflection/amplification DDoS attacks
- Plex said unusual network exposure was required and shipped a hotfix
Apr 2020 - Plexamp 3.0 relaunch
- Plexamp was rewritten/relaunched across desktop and mobile as a Plex Pass app
- coverage notes its search/recent plays included servers, podcasts, and TIDAL
May 2020 - Skip Intro added
- Plex launched Skip Intro as a new Plex Pass feature for TV libraries
May 2020 - CVE-2020-5741
- Flaw where an attacker with admin account access could abuse Camera Upload to execute malicious code
July 2020 - Free Live TV expands Plex’s ad business
- Plex launched free Live TV in 220+ countries with 80+ channels, further broadening its shift toward ad-supported streaming
Jan 2021 - Mar 2022 - Plex Arcade gets the “killed by Google” treatment
- Plex launched a retro-game streaming subscription with Atari/Parsec
- Then announced Plex Arcade would shut down on Mar. 31, 2022
April 2021 - Plex raises $50m
- Plex announced a growth equity investment round from existing investor Intercap
- Only about $15M was new capital
- The rest was used to buy shares/options from employees and shareholders
Dec 2021 - CVE-2021-42835
- Plex disclosed a Windows local privilege-escalation flaw affecting PMS before 1.25.0
- Exploitation required local/physical access and was fixed in 1.25.0.5282+
April 2022 - Universal Watchlist and cross-service search
- Plex launched Discover (to a mixed response)
- Launched cross-service search
- And a universal watchlist to help users find content across streaming services
- Presumably aimed at become a “one stop shop” for all your streaming needs?
August 2022 - Account database breach
- Another breach this time involving suspicious database activity
- A third party accessed emails, usernames, and encrypted/bcrypt-hashed passwords
- Plex forced account password resets and said payment data was not stored
Feb 2023 - Skip Credits added
- Skip Credits became available for Plex Pass holders on personal libraries
- Plex’s own free streaming catalog also got the feature
Mar 2023 - LastPass breach linked to unpatched Plex on an employees computer
- Reports said attackers exploited an old Plex flaw on a LastPass engineer’s home computer
- CISA added CVE-2020-5741 to its known-exploited catalog
Jul 2023 - Plexamp becomes free
- Plex made core Plexamp free for all users
- Advanced features such as downloads, Sonic Sage, and some Guest DJ features behind Plex Pass
Sept 2023 - Hetzner ban hammer on Plex servers
- Plex warned users that servers at a hosting provider widely identified as Hetzner would be blocked over large-scale ToS violations
- Sparked yet another anti-piracy and legitimisation debate
November 2023 - Discovery Together privacy controversy
- “Your week in review” emails leak user watch habits
- This triggering Reddit/forum outrage over opt-out social sharing and concerns that personal-server watch history was being exposed without clear consent
Feb 2024 - Movie rentals launch
- Plex launched a movie-rental store with 1,000+ titles
- Coverage criticized limits such as U.S.-focused availability, 1080p/5.1 quality, no 4K HDR, and no downloads
April 2024 - Jun 2025 - VPPA / Meta lawsuit
- Plex faced a proposed class action alleging it shared viewing histories with Meta
- The suit advanced in Mar. 2025 but was voluntarily dismissed in Jun. 2025
October 2024 - TIDAL integration removed
- This meant Plexamp would no longer connect to TIDAL
- Plex-billed TIDAL subs stopped
Apr-Nov 2025 - Price hikes and remote paywalls go up
- Plex Pass prices went up for the first time in a decade
  - Monthly - $4.99 -> $6.99
  - Annual - $39.99 -> $69.99
  - Lifetime - $149.99 -> $249.99
- Remote personal-playback became paid
- Enforcement began later in 2025
- Alex and Robbie purchase soapboxes and make use of them
Aug 2025 - CVE-2025-34158
- NVD described the flaw as exposing server-owner credentials in PMS 1.41.7.x–1.42.0.x before 1.42.1
Sep 2025 - A security incident
- An unauthorized third party accessed emails, usernames, securely hashed passwords, and authentication data from one database
- users were told to reset passwords or SSO sessions
May 2026 - Plex hikes the prices by 200% for lifetime
- Lifetime increases from $249.99 -> $749.99
Jun 2026 - Remote Watch Pass price increase scheduled
- Official plan pages show Remote Watch Pass intro pricing ending June 1
- Prices rise from $1.99/$19.99 to $2.99/$29.99 monthly/yearly
July 2026 - Lifetime Plex Pass jumps again
- Scheduled for July 1, 2026
- Lifetime Plex Pass increases from $249.99 -> $749.99
- Monthly and annual prices stay unchanged

My conclusions from this timeline

Over the past decade we have watched Plex flail around looking for a viable business model. What started as a paid supporter tier for early access and genuinely useful personal-media features has slowly become a ratchet. More investor pressure, ad-supported streaming, attempts to become a discovery layer for other services, privacy controversies, price hikes, pieces of the personal-media experience moved behind some kind of recurring payment.

The company has never fully escaped the piracy shadow, but it has also spent years drifting away from the people who used Plex for the legitimate and simple reason that it was the best way to stream their own files from their own hardware.

Plex’s core users provided the servers, the storage, the electricity, the libraries, the bug reports, the community, and in many cases lifetime payments made in good faith. Now those same users are being asked to pay more (ignoring of course that lifetimers are grandfathered at their pre-existing price for the lifetime of Plex the company), accept more cloud dependency, and tolerate a product strategy increasingly aimed somewhere else.

Maybe Plex survives this by becoming a broader streaming portal with personal media as a legacy feature. But if that is the future, then I would rather move now to software whose incentives are aligned with self-hosting, ownership, and local control. That future is Jellyfin.

I read a book.

Alex Kretzschmar — Sat, 23 May 2026 22:20:17 GMT

The modern world has rotted my brain. I find focusing on anything that isn’t designed to hijack my dopamine stream very difficult. Earlier this year I decided to try and set myself the ambitious goal of reading a book. Yes, you read that right. One book.

I haven’t actually finished a book cover to cover in… I don’t even know. Years, at least. Probably a decade or more. That’s insane.

So, I bought a Kobo Clara Color, spent a month setting up an elaborate Rube Goldberg machine to wirelessly sync any epub I could get my hands on wirelessly via an OPDS stream and then finally gave in and started reading.

This review contains massive spoilers!

Project Hail Mary

The book begins completely grounded in reality. Science we all know and are familiar with. Despite the Sun dimming bacteria Astrophage being fiction, the author fitted them so plausibly into the real universe that I was able to suspend disbelief masterfully.

Andy Weir, author of Project Hail Mary and The Martian, created a star killing bacteria so powerful that it united humanity as one. The world killing dilemma as a reader was quite compelling too. The idea that if politics were no longer a factor, and if science had a blank cheque, we could build an interstellar space ship to save our species? A refreshing thought in these tumultuous times, even if we must charitably permit the small matter of a hitherto unfeasibly energy dense fuel to enable it.

The narrative flowed easily. The first half of the book was enjoyable but not gripping. Then we met Rocky.

Rocky was playful, empathetic, skillful, and an alien. After Rocky showed up I knew I was going to finish this book. I just had to!

Rocky explaining without language, via molecule models, his atmospheric conditions? Genius. Making me understand just enough to be dangerous about evolution and molecular biology (Astrophage evolving Xenonite resistance like a tennis ball finding a way through a forest being a prime example).

Generally speaking the book was what I imagine to be an almost perfect example of great sci-fi writing. Lots of concepts explained just enough to further the story without being overwhelmingly dense. Although I will admit to a couple of moments of bamboozlement to some of the more complicated topics. In general though, I think this is Andy Weir’s biggest strength. I am not a scientist, but this book left me feeling like I could have been if I’d had a teacher like Andy at some point in my life.

By far the most gripping section of the book is after the Adrian biomatter collection. I felt real loss, or at least I thought I was about to, for Rocky. The whole moment where Rocky broke out of his atmospheric containment to save our human hero Ryland Grace was emotionally charged and that night I stayed up late frantically turning page after page to find out what happened. Great storytelling.

Toward the end of the book, once our hero Ryland had made his final decision whether to return home or not, I felt like Andy Weir was kinda done with the story and the ending felt rushed. A version of the ending where we found out how Earth reacted to “The Beetles” return (surely they would build a second Hail Mary to come and meet the Eridanians?!) would have been most welcome. By this point in the story I wasn’t too bothered by how Earth resolved their Astrophage problems, but humanity becoming a space faring species, knowing that there’s actually life out there? C’mon, the ending robbed us of that.

The Movie

I waited to watch the movie until after I’d read the book. I suppose the last time I did that was probably The Hobbit, mostly because the movie took another 20 years to materialise.

The movie got some things really right, like Rocky and the overall sense of humour. Ryan Gosling was great. But how the fuck can you do a movie about a sci-fi book and remove practically all the science? I’m fairly sure the word celcius was not in the script anywhere.

I think I would have enjoyed the movie without having read the book, but because I read the book, I didn’t. Visually they got a lot right, which is always very subjective. But the alien spaceship was quite wrong, as was Rylands Eridanian biome at the end.

The movie did agree with me on point though, that we should know at least a little bit about how Earth reacted to the return of The Beetles.

Codex is changing how I think about computers

Alex Kretzschmar — Wed, 20 May 2026 23:24:21 GMT

There is no doubt we’re living through a seismic change in how we interface with computers. I have spent the last 15+ years learning a craft, how to adminster and interface with Linux. But I’m starting to feel a shift in my own behaviours, which fills me with awe and simultaneously makes me deeply uncomfortable. I wanted to take a moment to share a slice of that journey with you today.

Tea. Earl Grey. Hot.

Picture this. Sitting on the couch with my 5yo daughter watching a new favourite show of hers named “The Creature Cases”. The episode starts playing, in Arabic. She squeaks. I have to put down Project Hail Mary during the penultimate chapter (the humanity!), to navigate the incomprehensible Apple TV Plex on screen menu system and select from one of 28! audio tracks.

“I should set up FileFlows or tdarr and really remove all those unneeded audio tracks” I think. Or maybe I can throw codex at the problem.

9 mins later (less than one episode), we’re done. I didn’t leave the couch or the kid and disappear into a sysadmin hole. I just spent the rest of the evening with my kid. Nice.

See below for a nuanced take on what I really think of AI as a whole. But isn’t that kind of incredible? Like, actually though?

I didn’t have to know anything about how the machine worked. This democractises technology in a way that few previous generations have experienced and man is that exciting.

I want you to know that AI was not used at all to write the text of this article. Just for the avoidance of doubt.

I'm still trying to figure out where this all goes

Factorio: Controlling imports from Space

Alex Kretzschmar — Fri, 10 Apr 2026 23:25:39 GMT

Interplanetary logistics are a fundamental component of Factorio Space Age. It is puzzling to me why this particular aspect of the game feels half finished in what is otherwise a masterpiece of a game.

Anyway, the problem at hand is this. I want to import items from one planet to another planet. Not an endless supply, though. Just the right amount. We can achieve this by using combinators to read the current number of items in the logistics network on a specific surface (planet) and comparing that with values we set in a constant combinator. The delta between those two values is what we want to import.

The first step is to hook up a Roboport with a wire (red in my case)

Read the logistics network contents from a Roboport

We need to configure the Roboport to Read logistic network contents . This is so that all the items in the logistics network that this Roboport belongs to are made available to the circuit network.

Set "Read logistic network contents"

Now we configure an Arithmetic combinator to multiply everything from the input by -1 so we get a negative number and output it. Configure INPUT: EACH * -1 / OUTPUT: EACH.

Take each item in the logistics network and multiply by -1 to give us a negative number

Now we hook up the Arithmetic combinator output to a Decider combinator input (I used a red wire in my example). Now hook up a Constant combinator configured with the numbers of items you want to import to the Decider combinator input (I used a green wire in my example).

The decider combinator (top) essentially compares Red (logistics) to Green (I want X)

The constant combinator makes liberal use of logistics groups. These are such a great feature. Particularly if you’re able to utilize 5x GROUP to make sure you have a nice buffer of certain items in one place without having to keep separate groups for different use cases.

Logistics groups are very useful

Now, we need to configure the Decider combinator to compare the Red inputs to the Green inputs and output the delta to send to space.

Before: We need to import 10k green transport belts

We configure the Decider combinator Conditions: EACH ≥ 1 - Outputs: EACH Input count. This subtracts the red signals from the green signals, so that anything with a positive number gets imported (if present on a Space ship).

For example, note above that we have a -100 Blue Circuit signal. Below I have added 50k green transport belts into my logistics network, which makes for an easy comparison to see the combinator in action.

After: We have a surplus of green transport belts so they are no longer an output (request)

The last step to actually send these requests to space ships is to hook up the output from the Decider to the Cargo landing pad building and set Set requests.

Note "Controlled by circuit network"

With this in place you will never over import a specific product from space again. I’ve found this really helped keep rockets on other planets available for other purposes instead of spamming ships full of the same items over and over and over. Especially in the early stages of space where your remote bases might be less capable.

Again though, I’m left wondering, why can’t we just have interplanetary logistics networks? Make it an end game tech or something idk. But anyway, until we get that this will have to do.

Bonus Tip: What if you have multiple logistics networks on one surface?

Radars can "teleport" circuit signals from one radar to another on the same surface

Use Radars to hook them up! The remote side Roboport is set to the same `Read logistics network contents` and then the red wire is hooked up to the Radar. Then we import the radar signal (on the red wire) to the input of the Arithmetic combinator like we did before.

Happy Factories. Go Artemis II (this post published during reentry).

Factorio: Controlling Space Ship collector filters via circuit logic

Alex Kretzschmar — Thu, 09 Apr 2026 13:22:56 GMT

In Factorio Space Age building Space Ships is a core part of the game. Gathering space rocks to process into raw materials is the most fundamental part of ship building. But how do you stop your ship filling up with just one type of space rock chunk?

The solution involves a Space Age feature of reading belt contents.

Hook ups

I design my ships typically with one big belt for all collectors to deposit their Asteroid chunks onto with no splits or other joins. This is because reading the belt contents only works for a single continuous belt sector. I could use circuits to sum up multiple sections but after a while this design constraint just becomes habit and you remove items with filtered inserters rather than splitters.

💡

I use the mod Circuit Visualizer to make it easier to see which circuit nodes hook up to what.

The first step on our journey, assuming we’ve placed collectors and have them outputting onto a belt, is to connect a single segment of belt to the input of a Decider combinator. Red or green doesn’t matter, just be consistent (I used red here). Set the belt to Read belt contents - Hold (all belts) and this will provide the contents of that belt as an output to the circuit network to be used for conditional logic.

Constant combinators hooked up to green input of Decider

In order to tell the Decider how many chunks of each type we want I used a Constant combinator. This Constant was hooked up to the Deciders green input.

Constant combinator. How many? Of what chunk type?

Next we want to configure the Decider combinator to compare the number of chunks on the belt vs the number of chunks we'd like on the belt.

The decider decides which output signals are sent to the Asteroid collectors

Now we can evaluate RED vs GREEN like so: IF RED INPUT (chunks on belt) IS < GREEN INPUT (chunks we want) THEN OUTPUT CHUNK TYPE. We can do this using the EACH operator represented by the yellow icon with 3 lines.

The Decider will only output a chunk signal if the conditional is TRUE for EACH chunk type.

The green wire connects all Asteroid collectors together.

Next, hook up the output of the Decider to all Asteroid collectors at once. The configure each collector with SET FILTERS to allow the circuit network to control them.

Notice that the collector is disabled because all requested chunks are present on the belts

And there we have it. Each Asteroid collector will now only collect the chunk types required to fulfil the conditional logic

Factorio: Recycler Belt Stacking

Alex Kretzschmar — Wed, 08 Apr 2026 23:56:20 GMT

Circuit logic in Factorio is pretty annoying to deal with, tbh. I really wish there was a way to deterministically configure circuits with expressions. Alas, here we are.

In this post, I’ll walk through a solution to using a recycler in Factorio with a stack inserter without it jamming. There are definitely other approaches, but this is the one that worked for me.

There’s a blueprint string at the end if you’d like it.

Recycling Junk

Recyclers are unlocked on Fulgora and although their primary use is for recycling Scrap into the 12 output products, this is not their only use. We can also use Recyclers to upcycle items quality.

The standard scrap recycling recipe in Factorio

Quality brings 5 tiers of items to the game, each with increasingly powerful stats. Thus, even a simple Scrap recycling recipe can potentially have 60 product possibilities. Upcycling only excerbates the number of possible output products.

A simple quality upcycling example

This is a problem for stack inserters, which only swing when they have a full stack of 16 items. If a machine is outputting just 1 or 2 of something, the inserter won’t clear its output until it reaches 16 - or as we sometimes refer to it, it will jam. If you’re dealing with mixed outputs or qualities and not using filters, you’re going to have a bad time.

So we need a way to buffer items until there are 16 of a kind, and dynamically set the inserter’s filters so it only picks up items that have reached that threshold.

Circuit City

To make this next section easier to visualise I’m using the mod [Circuit Visualizer](https://mods.factorio.com/mod/circuit_visualizer).

First, we need a way to buffer items until we have a full stack of them. For this, we use chests. Place one at the output of your Recycler.

Next, we must count the items in the chests. For this, we use an arithmetic combinator and red wires linking every chest to the combinators input.

Hook up a red wire to every chest and connect it to the input of the Arithmetic combinator

Configure the Arithmetic combinator to output a signal of value 1 for each item present in the chests. Conditions should be EACH > 0 and Outputs EACH 1.

Arithmetic combinator configuration.

We can think of the Arithmetic combinator like an if statement. If an item is present in any quantity greater than 0, then output a signal via the combinators output.

Connecting the Arithmetic output to the Deciders input via a Green Wire

Now hook up the output of the Arithmetic combinator using a green wire (colour is important) the input of a Decider combinator.

We must also hook up every Stack Inserter via a red wire to the output of the Decider.

Configure the Decider like so: INPUT -> EACH - 16 / OUTPUT EACH.

The job of the decider combinator is to subtract 16 from every signal that comes in thus creating an index of available items to filter. By sending this signal out as -15 we can then compare the contents of the chest to this value and only once it is 16+ (a full load) does the Stack inserters filter become set.

The Stack Inserter should be configured like so

The final piece here is hook up a green wire from the chests to each Stack inserter, one by one. Then configure the Stack Inserter to ENABLE/DISABLE when ANYTHING > 2 and SET FILTERS is checked. The Stack Inserter reads the filters from the circuit network. Do not link these down the line as you have the chests or inserters previously.

Hook up a single green wire connecting the chest to the Stack Inserter

Sit back, and relax

Now sit back and watch the fruits of your hard work.

The final result

When the chest contains 17 of something then it’s OK to swing. The chest contains multiple tiers of quality items and scales as far as I have been able to test to infinite number of items.

The only real downside is that this won’t work in space because you can’t place chests there.

Here’s a blueprint string for you to try it out yourself - I’m in the blueprint sandboxes mod for all of these screenshots.

0eNrlWNuSoyoU/ReecUrwEk3VnB/pSlmopEONogcx56S6/PfZqNF0Yroxvs08RTew1mbti5APlBYtr5WQGu0/kMgq2aD92wdqxLtkhbFJVnK0R4pnl6zgCnUYCZnz/9GedHhhom5VWjlaMdnUldJOygt9s4h2B4y41EILPlD1L5dEtmUK8HuCv0TCqK4aWFxJwwmAjkd2PwKMLmgfBj8CYMoFODvMiIyLdwR0A4FvQ+BNBI1m2S9HyIYrDSNL0OFTaH8B2p+ghTwKCUNOduLNstfBZ+jriqThWgv53piZipfVmSctjBXgIs8ToXkJQ0dWNByjwTwEamSuC9ZokTkpMzvKqtbkDnFdjMoqNxOYdgrOeqemTDl0C7sJpt0wJfSp5AY2q8pUSKarZb3cKdadIZdaVUWS8hM7C1gB02aoBIbzfnm/1aNQjU7mfNWX2lCfhdItWOag9TMczrKTyduGGxiDBdHstxpiVNVcscEx5MDSqtV1uxq8WxIlnObmPBM5V98pQr5TZMS5k+P27e1ldcC3mqnetz36B5niHrS4byPWePUl6XMqOaqqTIQErDEbTRItCLbbUM87m3qONhCENgTxSw3jAZrQBWzi4ocWvgTrj4Lc9SAo4aEfQDBFftPm/4UomvYDNd8W3PH6Fj9MhZkSAncGTyp1GZbObwDZ7xLtXePu4gh5OkKfjngmPQ5LCpA18rpfyLtcXplQWSt0wiVLCw4aadVC57yapzp7oQcxedEnaNVDZVwbEH0su5kOmnsyNW3jCYy1Db+3PapEb1TivPjiu0JuJVqC8lYXjBuvqkjib2CwKkkSbCj6yIohfKnqI7uq362q+vgPrPpofT5HT/I5fqmBRH9XA6Huhpq0qhh6fzVoakjGJ3Fw4zG1H5Cvh9qbtP58pB2THOwFf+cyZ5Byd4r9NIqNhz64PVXqOv9o7jqPntMVGeROtR5bqeLZJrobfpPodENb3RErZ4MNDK4VQ7ieIXrKsHQHo+sPnJPylgzrT5zubh3D3NLStrDsaDtqA+25a+6o5DP2ujtq34mWXCD2u5uDT62+rB7dkMHU6u8Db4WAc9xfFxDubP+BS+Zz/xZgikPsHzA8eRiOzgQeQwy/tH80FgwfxPGZGjs1z9TYo8EeGXsM9sNwOjBxmP5mwugMn5F+D0FIYz+Og8h3qetHXfcbT7ktQw==

Was Solar Worth It?

Alex Kretzschmar — Tue, 13 Jan 2026 18:30:02 GMT

I wanted a clear answer to a simple question: is my solar system paying off? So I pulled real data from my Duke Energy bills and SolarEdge monitoring and ran the numbers.

Below is a plain-English breakdown of the system, the numbers, and the ROI.

The System

Installed: June 7, 2021
System size: 8.16 kWp
Inverter: SolarEdge SE7600H
Optimizers: 24 × P401

What I Paid

Total system price: $23,223
Loan terms: 1.49% for 20 years
- Estimated payment: $122.32/mo
Federal tax credit claimed: $6,500

So my net cost after the tax credit is:

$16,723 (using contract price)

Net Metering Assumption

I reviewed the last year of my Duke Energy Progress bills and came up with some asnwers. Exports are netted 1:1 at the retail rate within each billing period.

Would a battery help? Short answer: no — not right now. Because Duke’s 1:1 net metering already gives me full retail value for exports within the billing period, so a battery doesn’t add much financial benefit. It could add backup power, but for ROI it’s hard to justify. The only scenario where that changes is if Duke moves to time‑of‑use rates or reduces export credits. Under TOU, a battery could help by shifting solar into expensive evening hours — but until that happens, net metering does the same job for free.

2025 Snapshot (Usage + Production)

From Duke Energy bills (12 unique 2025 bills) and SolarEdge:

Grid import (Energy Used): 15,858 kWh
Grid export (Energy Delivered): 2,409 kWh
Net billed usage: 13,449 kWh
SolarEdge production: 6,663 kWh
Blended rate (all charges): ~$0.163/kWh

Important note:
In Jan–Mar 2025 the inverter stopped producing for about 10 weeks. I didn’t notice right away because the Wi‑Fi monitoring was throwing false positives. I’ve now hard-wired the inverter to fix that. It turns out a simple reboot was all that was needed, but it was still frustrating to lose ~2.5 months of production.

Annual Savings Estimate (Year by Year)

Using the 2025 blended Duke rate ($0.163/kWh) applied to SolarEdge production:

Year	Solar production (kWh)	Estimated savings ($)
2021	4,565	744.55
2022	7,495	1,222.40
2023	8,042	1,311.71
2024	6,833	1,114.41
2025	6,663	1,086.70

ROI and Payback

Simple payback (no inflation or escalation):

Net cost: $16,723
Payback: ~15.4 years
ROI: ~6.5%/yr

2025 Monthly Detail (From Bills)

Bill date	Billing period	Import (kWh)	Export (kWh)	Net billed (kWh)	Charges ($)
Jan 27, 2025	Dec 21–Jan 23	1,578	157	1,421	220.07
Feb 26, 2025	Jan 24–Feb 24	1,554	99	1,455	224.98
Mar 26, 2025	Feb 25–Mar 24	1,276	0	1,276	200.99
Apr 25, 2025	Mar 25–Apr 23	1,465	115	1,350	213.47
May 27, 2025	Apr 24–May 22	1,175	347	828	143.30
Jun 25, 2025	May 23–Jun 23	1,353	287	1,066	178.22
Jul 28, 2025	Jun 24–Jul 24	2,038	99	1,939	305.59
Aug 26, 2025	Jul 25–Aug 22	1,598	128	1,470	236.77
Sep 25, 2025	Aug 23–Sep 23	1,276	315	961	162.29
Oct 28, 2025	Sep 24–Oct 24	886	363	523	100.38
Nov 24, 2025	Oct 25–Nov 21	680	366	314	70.08
Dec 26, 2025	Nov 22–Dec 22	979	133	846	152.02

Chart: Estimated Solar Production vs Net Billed (2025)

This chart uses bill data plus a simple self-consumption ratio to estimate monthly solar production. It is directional, not exact, and will not perfectly match the annual SolarEdge total.

Jan | P:############ (587) B:---------------------------- (1421)
Feb | P:########## (523) B:----------------------------- (1455)
Mar | P:####### (348) B:-------------------------- (1276)
Apr | P:########## (515) B:--------------------------- (1350)
May | P:############# (668) B:----------------- (828)
Jun | P:############# (656) B:--------------------- (1066)
Jul | P:############# (655) B:--------------------------------------- (1939)
Aug | P:########### (564) B:----------------------------- (1470)
Sep | P:############# (663) B:------------------- (961)
Oct | P:############ (605) B:---------- (523)
Nov | P:########### (551) B:------ (314)
Dec | P:######## (400) B:----------------- (846)

The Takeaway

Based on real 2025 billing data and SolarEdge production, the system is on track for a 15 year payback and a ~6% simple ROI after the federal tax credit. That’s not as good as I’d hoped honestly. But, it’s a solid, predictable savings — and likely improves as electricity rates rise.

AppArmor's Awkward Aftermath Atop Proxmox 9

Alex Kretzschmar — Sun, 09 Nov 2025 01:48:23 GMT

If you run Docker inside LXC containers on Proxmox you probably woke up this week to a fun surprise. Your containers won’t start anymore. The error looks like this:

Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: open sysctl net.ipv4.ip_unprivileged_port_start file: reopen fd 8: permission denied: unknown

This isn’t a Proxmox bug. It’s not even really a Docker bug. It’s a security patch that landed in containerd.io version 1.7.28-2 around November 5th fixing CVE-2025-52881, a critical container escape vulnerability. The fix involves reopening file descriptors for procfs operations which triggers AppArmor permission errors when running Docker inside nested LXC containers.

The technical details are actually kind of fascinating. Bear with me, I’ll make it as simple as I can.

A detached mount is a filesystem mount that exists in the kernel but isn’t attached to any path in the filesystem tree. Think of it like a mounted filesystem that’s floating in memory without a mountpoint.

Normally when you mount something, it gets attached to a specific path thus:

mount /dev/sda1 /mnt/data  # attached to /mnt/data

A detached mount exists but has no path. You can only access it through file descriptors. Runc uses detached mounts as a security feature to avoid race conditions where an attacker could swap out mountpoints while runc is trying to access them.

The problem is that when the kernel tries to generate a pathname for files inside a detached mount (which AppArmor needs since it’s path-based), it can only see the relative path from the mount root. So /proc/sys/net/ipv4/ip_unprivileged_port_start inside a detached procfs mount just looks like /sys/net/ipv4/ip_unprivileged_port_start to AppArmor because the /proc part doesn’t exist in the filesystem tree.

It’s basically a mismatch between two security features: runc’s use of detached mounts to prevent path-based attacks, and AppArmor’s path-based access control system that needs actual paths to make decisions.

In case you were curious, SELinux wouldn’t have this problem because it’s label-based rather than path-based.

SELinux assigns security labels (contexts) directly to files, processes, and other objects. When you access a file, SELinux checks if your process label is allowed to perform that action on the file’s label.

How we do fix this?

For now, the only way I could find is to disable AppArmor entirely on a per LXC basis. Not exactly the ideal long term solution but for now, the only one available.

lxc.apparmor.profile: unconfined
lxc.mount.entry: /dev/null sys/module/apparmor/parameters/enabled none bind 0 0

As per this comment you can trick Docker into thinking AppArmor is disabled. Also yuck.

% mount --bind /dev/null /sys/module/apparmor/parameters/enabled
% systemctl restart docker

AppArmor, you are making this hard

Look, I get it. AppArmor exists for good reasons. It provides mandatory access control and helps contain potential security issues. But for homelab users and small deployments this stuff is beginning to get exhausting. This is not my first frustration with AppArmor since adopting Proxmox 9 a few months ago. The enterprise folks have teams to deal with this crap, the rest of us are just trying to run some containers.

Unfortunately, I just do not believe AppArmor is not fit for purpose, nor was Proxmox diligent or rigorous in their including it in Proxmox 9. I won’t belabor the point any further here but I did write about it recently.

Proxmox is genuinely great software. And I have made countless videos both at work and personally about it. The team does excellent work and the platform is rock solid for virtualization. But the AppArmor integration continues to be a source of friction that makes recommending it harder than it should be. I’m going to have to start to look for alternatives soon, not that there really are any. Ugh.

Unprivileged LXCs are just a bit annoying

Alex Kretzschmar — Tue, 30 Sep 2025 01:07:34 GMT

Proxmox 9 shipped with AppArmor 4.1 in August 2025, and the new security restrictions make Intel GPU “passthrough” with monitoring tools like intel_gpu_top effectively impossible without either host-wide security reductions or abandoning the unprivileged model entirely.

Recently, I documented a workaround for issues the new AppArmor release introduced in my configuration. This led to folks suggesting that running docker containers on the Linux Proxmox host itself was “evil” (I jest but you know how comment sections can get).

Credit: Midwesternrodent at selfhosted.show/discord

So, to dogfood what the “just run it in an LXC crowd” were espousing, I decided to attempt to port my homelab to LXCs this weekend - and follow all best practices in the process.

It has not gone well.

Why unprivileged containers matter

In a privileged LXC container, root inside the container is the same as root on the host. Container escapes means full host compromise. And whilst these escapes are rare, the LXC security team doesn’t consider escape exploits in privileged containers as security issues because the isolation is minimal by design.

Unprivileged containers use UID/GID mapping to run as high-numbered users (100000+) on the host whilst appearing as root (UID 0) inside. Even if an attacker escapes, they’re a nobody on the host with no privileges. It’s the difference between “rebuild the container” versus “rebuild your entire hypervisor.”

What's broken?

Proxmox VE 9.0 shipped with AppArmor 4.1, a major version jump from 3.x in the previous Proxmox release.

With this new release, any attempt to run intel_gpu_top in an unprivileged LXC fails with “Failed to initialize PMU! (Permission denied)” in unprivileged containers, even with correct GPU device passthrough. Privileged containers continue to work as you would expect.

Here’s the frustrating part: GPU transcoding still works fine. You can pass /dev/dri/renderD128 to your container and transcode just fine. Of course, we could just use intel_gpu_top on the host itself but that’s not the point here is it?

There’s also a great deal of complexity when it comes to mounting network shares and many other things the UID shifts introduce.

Why it fails technically

The intel_gpu_top tool needs access to Intel’s PMU (Performance Monitoring Unit) through the Linux perf_events interface via the perf_event_open() syscall. In unprivileged containers, this syscall crosses the UID remapping boundary. Container root (UID 0) becomes UID 100000+ on the host, and the kernel strips all capabilities.

Modern Linux distributions set kernel.perf_event_paranoid to 2 or higher (Debian/Ubuntu use 3-4), blocking performance monitoring for unprivileged users. Even setting it to -1 doesn’t help because of UID remapping. AppArmor 4.1’s stricter enforcement makes this worse.

Your options (they're all bad)

Option 1: Host-wide kernel parameter changes

Set kernel.perf_event_paranoid=0 on your Proxmox host. This reduces security system-wide. Every container and VM can now access performance monitoring, potentially leaking information about other processes.

Option 2: Disable AppArmor confinement

Add lxc.apparmor.profile: unconfined to your container config. You’ve removed the mandatory access control layer that prevents container escapes. You’re left with just namespace isolation and UID mapping.

Option 3: Combine both

Many “successful” deployments use both workarounds. You’ve made host-wide security reductions AND disabled container-level protections just to monitor GPU usage.

Option 4: Run privileged containers

Set unprivileged: 0 and accept that root in your LXC container equals root on your host. At least you’re being honest about your security posture.

Here’s the uncomfortable truth: if you’re already making host-wide kernel changes or disabling AppArmor, running privileged containers is arguably more pragmatic. You’ve already accepted substantial security reductions. Privileged containers at least give you full functionality without pretending you’ve maintained security through half-measures.

Option 5: Run privileged containers and rootless docker/podman

We’re getting a bit into Inception spinning top territory here but what if we combine everything in option 4 - run the LXC as unprivileged: 0 but then also migrate our application containers to rootless podman? At least then we have the applications isolated from root as much as possible. Of course, not every container supports running rootless so this introduces its own set of problems. Sigh.

Proxmox is changing with enterprise focus

Proxmox has seen significant growth since Broadcom’s VMware pricing changes in late 2023. The project is now competing for corporate deployments that demand security certifications and compliance checkboxes. And in a world where you’re competing against Red Hat who have had SELinux for years at this point AppArmor seems like an obvious W.

And indeed, AppArmor 4.1’s aggressive security posture makes sense for that audience. The challenge is that Proxmox’s existing user base includes many homelabbers running exactly the workloads that broke, and we can be a bit of annoying, vocal bunch at times.. Media servers with QuickSync aren’t exactly your typical enterprise use case.

Largely speaking theses changes are probably long term good for the Proxmox project in so much as they can make a business out of a truly excellent product. But is it good for the homelab user base that put them there overall? Time will tell.

The practical path forward

Every successful deployment of an unprivileged LXC in the forums I’ve been able to find involves either host-wide kernel changes, disabling AppArmor entirely, or both.

The most pragmatic solution I can come up with? Install intel-gpu-tools on the Proxmox host itself and run intel_gpu_top there. It shows GPU usage from all containers without configuration changes. This defeats the point of containerized monitoring, but that’s where we are. Arguably it makes more sense to do it at the host level to get a holistic picture of the entire system so really you can argue this one either way.

But if you’re running a homelab with QuickSync transcoding and need GPU monitoring, just run privileged containers. You’ve lost the security benefits anyway with host-wide kernel changes or unconfined AppArmor profiles.

The security theater of running “unprivileged” containers with unconfined AppArmor and modified kernel parameters is just that: theater. You’re checking a box that says unprivileged: 1 whilst undermining the mechanisms that make unprivileged containers meaningful.

Hopefully a solution comes along that will permit unprivileged LXCs to access a specific resource like the PMU but technically I do not know enough to know whether that’s even feasible. Until then, unprivileged: 0 it is.

My Terminal and Editor Theming

Alex Kretzschmar — Fri, 12 Sep 2025 16:07:44 GMT

As you may know, I make YouTube videos for Tailscale for a living. One of the most common questions in the comments I get (weirdly) is, “how do you theme your tools?”

This post will set out to answer that question in more detail than I can provide in a simple comment reply.

Font

Where possible I use Berkeley Mono. Fira Code or Jetbrains Mono are nice fallbacks.

Terminal

macOS terminal - ghostty
Linux terminal - omarchy defaults (A lacritty)

Here’s my ghostty config.

# appearance
font-family = "BerkeleyMono Nerd Font"
font-size = 16
window-inherit-font-size = true
window-height = 33
window-width = 130

# shell
mouse-hide-while-typing = true
shell-integration = zsh
clipboard-paste-protection = false

# macos
## nix handles updates
auto-update = off
macos-titlebar-style = native
macos-option-as-alt = true
quit-after-last-window-closed = true
keybind = shift+enter=text:\n

Shell Prompt

Starship

The prompt that you see (the bit that contains the filepath, username, etc) is configured using Starship - a minimal, blazing fast, customizable shell prompt.

The configuration I use hangs out in my nix-config git repo. I use nix and nix-darwin to apply this configuration automatically.

nix-config/home/starship/starship.toml at main · ironicbadger/nix-config

Contribute to ironicbadger/nix-config development by creating an account on GitHub.

GitHubironicbadger

Editor

VSCode - the editor that in the darkness bound them
Neovim - I am still experimenting with neovim but you can find my configuration on GitHub

The VSCode theme shown below is Bearded Theme Monokai Stone. For right now I am using the default icons but in the past the Bearded Icons pack may have been shown too.

Other useful tools

In no particular order a list of other tools I use and enjoy on macOS in particular are:

BentoBox - Window management app
Snippety - Text expansion
Raycast - Spotlight replacement
Ice - makes app “systray” icons on macOS bearable (especially with a notch)
iStat Menus - Shows me what’s going at a glance
Hammerflow (and Hammerspoon) - Keyboard driven task navigation

Proxmox 9 broke my docker containers

Alex Kretzschmar — Mon, 18 Aug 2025 01:35:18 GMT

Proxmox 9 is out 🎉 with a whole host of wonderful upgrades and improvements.

Unfortunately, it prevents any of the docker containers I had running on the host itself from starting as Proxmox 9 ships with apparmor enabled but no default docker apparmor profile.

All containers that need access to the docker socket (traefik), or use an s6 overlay (any Linuxserver.io image and 1000s more) are affected so I am sure this will trip up a lot of you over the coming weeks. Good luck!

After spending about an hour attempting to get a valid, but permissive, apparmor profile working I just needed a quick solution to get things up and running whilst I fixed the problem “properly”.

The workaround came via a very old GitHub issue showing how to disable apparmor for the entire docker daemon.

$ systemctl edit docker

[Service]
Environment=container="setmeandforgetme"

After you’ve edited the file, perform systemctl daemon-reload followed by systemctl restart docker and you should be up and running.

Hilariously, this works by setting the environment variable value for container to literally any string, and thus disabling apparmor. A frustrating concatenation of issues led me here for sure.

Keep an eye out for a more secure, betterer, more permanent solution but for tonight this will do nicely.

Why make it harder for your users?

Apparmor is kind of like SELinux. It has rules that says which things can talk to which other things, what can create network sockets, and so on. It is a very useful security feature in production environments and significantly reduces attack vectors.

HOWEVER, my situation is in a homelab and to be honest I don’t want or need that extra complexity.

The Proxmox developers have gone on record to say that you should not run docker containers directly on the host, but run them in a VM instead. Why? It’s my system, I will hold it however I damn well want.

Seriously, Proxmox is such a fantastic project but why make your product harder to use for the vast majority of folks running containers. Docker is the overwhelming leader in this space not LXCs.

Running containers on the host for me has several key advantages including (but not limited to):

not needing to fart around with PCI passthrough for GPU accelerated workloads (video transcoding, LLMs via an Nvidia GPU)
being able to share those hardware resources across multiple containers in a single, easy abstraction (docker)
simplicity of adminstration
simple and direct access to host storage

Users like the one in this thread make for a really bad smell around a project. And whilst this thread led me to my ultimate workaround tonight, it’s frustrating to see folks defending what is ultimately a user hostile decision.

Over the years I have found tremendous benefits from simplifying the stack wherever I can in my homelab. I do enough tinkering and complex stuff at $dayjob and Proxmox provides the perfect blend of ZFS, container support, a useful webUI, stable releases, and flexibility because it’s just Linux.

Stop making me feel bad about using my computer the way I want to. Just be happy we are here, using a tool to get a job done in the way we best see fit.

What if..?

Alex Kretzschmar — Fri, 20 Jun 2025 18:07:07 GMT

“I have a 4 hour flight next week, grab the Top Gear specials and send them to my iPad”. Or a step better, an LLM looks ahead to your calendar and just figures it out.

As far as I know nothing exists today with enough context into each of the elements required to make this relatively simple idea work.

Imagine if the LLM involved here knew the iPad you were talking about, the current free space, it’s resolution, and any other constraints and just handled the complexities - including offline transfer and encoding of the files to a suitable file size for the target device? Synced watch status and all the rest of it via Jellyfin would be neat.

After all… how hard can it be?

I suppose you could string together a bunch of this stuff together with n8n and ffmpeg perhaps. Anywho, I could see this being the future of software both commercially and for self-hosters.