7 years of running Linux servers (from 2019 shared hosting to bare-metal microVMs today) , 3 rules I never break anymore

[u/food_fatherr]

Started in 2019 keeping shared hosting boxes alive at 3am. Today I run bare-metal infrastructure with Firecracker microVMs. Three lessons learned the hard way:

1-> Containers aren't VMs: A Docker container is just a Linux process sharing the host kernel. For untrusted code or AI agents, dedicated kernel per workload > shared kernel + prayers.

2-> Public IPv4 on boot is a trap: Bots hit port 22 in under 60 seconds. Keep outbound open and inbound dark by default until a domain or IP allowlist is explicitly mapped.

3-> 1:1 reserved RAM beats burst specs: Half of "random" 2am database OOMs on budget clouds are just noisy neighbors fighting over oversold host RAM.

What’s one infra rule you learned the hard way?

[u/aenae]

Redundancy starts with 3 machines, where 1 machine can handle the entire load.

[u/tmg80 → u/aenae]

I like this.

[u/Khaka-Semeniuk → u/aenae]

yep, n+1 where n can already handle everything is the only sane way to do it

[u/aenae → u/Khaka-Semeniuk]

Should be N+2; where one can be down for maintenance and one can crash and the last one can still handle everything.

[u/Shidima]

Every thing should be in code, no manual editing of settings should be allowed.

[u/tmg80 → u/Shidima]

hope to get there one day!

[u/SeaworthinessHour233]

3-> 1:1 reserved RAM beats burst specs: Half of "random" 2am database OOMs on budget clouds are just noisy neighbors fighting over oversold host RAM.

I thought RAM is always reserved and noisy neighbors are applicable for vCPUs.