open-menu closeme
Engineering
github linkedin rss

  • x509: certificate signed by unknown authority? Maybe the cert pool is empty

    calendar Apr 15, 2025 · 6 min read · Linux Container SELinux Bottlerocket  ·
    Share on: twitter copy

    I recently worked on getting amazon-ssm-agent to run inside containers on Bottlerocket. During that process, I ran into a TLS issue connecting to amazonaws.com. The root cause turned out be interesting and we'll walk through it in this post. Running amazon-ssm-agent in a container: why and how? To enable sessions …


    Read More
    • ««
    • «
    • 1
    • 2
    • »
    • »»

Peng Zhang

Software Engineer

Recent Posts

  • Page-cache thrashing on EC2: kill the tenant before it takes the host down
  • Pre-load container images on the Bottlerocket read-only root filesystem
  • Leaked empty directories exhaust inodes
  • Share one client per service
  • Debugging zero disk reads after moving to Bottlerocket
  • When sync.Cond is a better primitive than channels: lessons from Go's HTTP/2 client
  • Mysterious boot hang on Graviton: mitigated but never root-caused
  • What is an ABI? Break one to find out

Tags

LINUX 29 GO 23 BOTTLEROCKET 11 CONTAINER 9 ALGORITHMS 8 INTERVIEW 7 CONCURRENCY 4 SYSTEMD 4 DISTRIBUTED SYSTEM 3 GUIDE 3 AWS 2 CONTAINERS 2 EC2 2 SELINUX 2
All Tags
ALGORITHMS8 AWS2 BOTTLEROCKET11 CONCURRENCY4 CONTAINER9 CONTAINERS2 CRYPTOGRAPHY1 DATABASES1 DISTRIBUTED SYSTEM3 DNS1 DOCKER1 EC22 GO23 GUIDE3 INTERVIEW7 LINUX29 NETWORK1 SELINUX2 SHELL1 SYSTEMD4 TESTING1 WEB2
[A~Z][0~9]
Peng Zhang

Copyright 2022-  PENG ZHANG. All Rights Reserved

to-top