Jess Frazelle

Key Insight: Manufacturing workflows could be treated like software deployments, with declarative configuration files defining robot positions, behaviors, and artifact pipelines that can be version-controlled and switched on command.

Jess Frazelle explores what it would take to build robot workshop assistants like those in Iron Man, breaking down the technical requirements for fire detection, object passing, and suit assembly. She then extends this into a broader concept: a configuration management system for manufacturing that treats physical factory layouts like code deployments. The key insight is that robotics workflows could be defined in declarative config files, enabling version-controlled 'modes' for different manufacturing processes.

Key Insight: Tesla's battery improvements succeed because they take a holistic, first-principles approach—optimizing cell design, manufacturing, materials, and vehicle integration together rather than focusing on a single breakthrough technology.

This post provides a comprehensive technical deep-dive into battery technology, prompted by Tesla's 2020 Battery Day announcement. Frazelle explains the fundamentals of how batteries work—from the chemistry of redox reactions to the differences between alkaline and lithium-ion cells—before exploring emerging technologies like solid-state batteries, nuclear batteries, and silicon anodes. The bulk of the post analyzes Tesla's holistic approach to battery improvement, which addresses cell design, manufacturing processes, materials selection, and vehicle integration to achieve their goal of halving cost per kilowatt-hour.

Key Insight: Owning your company's operational data in a centralized database with an API layer provides resilience, searchability, and the flexibility to build custom tooling on top of external services.

Jess Frazelle describes building an automated internal infrastructure system at Oxide Computer Company that consolidates data from various external services (Google Forms, GitHub, etc.) into a single database with an API layer on top. The system evolved from 'bash, popsicle sticks, glue, and some rust' into a cleaner Rust-based architecture that provides resilience against API rate limits and service downtime. The infrastructure handles everything from applicant tracking to RFD (Request for Discussion) document management, with Airtable serving as a visual frontend for the data.

Key Insight: When evaluating hardware products, the integrated software experience matters as much as the underlying technology, and SLA's superior print quality and speed make it the better choice for those seeking polished results over raw hackability.

This post provides a comprehensive technical overview of all seven ASTM-classified additive manufacturing processes, from FDM to sheet lamination, before comparing two consumer 3D printers: the MakerBot Replicator+ (FDM) and Form 3 (SLA). Frazelle's hands-on testing reveals the Form 3 produces significantly higher quality prints in less time, though the MakerBot offers better user experience with its iPad app and camera integration. The article reflects her characteristic approach of doing deep research before purchasing, wanting 'the best' thing that 'just works' as an integrated product.

Key Insight: The solution to the epidemic of underpowered consumer computers isn't just better hardware standards—it's making compute a seamlessly shareable, distributed resource so local specs become irrelevant.

Frazelle uses her mother's frustrating experience with cheap, underpowered Windows machines to argue that manufacturers shouldn't sell computers with specs so low they provide terrible user experiences. She contrasts this with Apple's approach of maintaining minimum quality standards, then pivots to an optimistic vision: emerging technologies like process migration and 'teleforking' could let even low-spec machines offload computation to remote resources seamlessly. The future of computing should make powerful compute readily available to everyone, not just those who can afford premium hardware.

Key Insight: Display technology is advancing faster than internet infrastructure can support it, and satellite internet may be the only economically viable path to universal high-bandwidth access.

As display technology advances from HD to 4K to 8K, bandwidth requirements are growing exponentially—8K streaming requires 100mbps while average US speeds barely reach 96mbps. The 'last mile' problem makes fiber deployment prohibitively expensive, as Google Fiber discovered. Satellite internet from companies like Starlink and Astranis may finally solve the connectivity gap, delivering gigabit speeds without the infrastructure challenges of laying physical cable to every home.

Key Insight: Automation is fundamentally a time arbitrage calculation, and consumer tools are finally democratizing this productivity superpower beyond programmers.

Jess Frazelle argues that automation is fundamentally about reclaiming time by transferring repetitive manual tasks to scripts and services. She presents a simple equation: time gained equals time doing the task manually minus time to automate it. The post covers her personal automations (employee onboarding in Rust, Gmail filters, newsletter management) while celebrating how consumer tools like Apple Shortcuts, home automation, and IFTTT are democratizing automation patterns for non-programmers.

Key Insight: While storage technology has advanced exponentially in speed and density over 70 years, the fundamental abstraction remains unchanged: everything reduces to representing and persisting 0s and 1s through whatever physical mechanism the era's technology enables.

This post traces the evolution of data storage from 1951's UNISERVO tape drives through modern NVMe and emerging technologies like HAMR and storage class memory. Using a single byte (the letter 'j') as a narrative thread, Frazelle explains how each storage medium physically represents 0s and 1s—from holes in paper cards to magnetic polarities to trapped electrons in floating gates. The piece concludes by examining cutting-edge technologies like phase change memory, helium-filled drives, and heat-assisted magnetic recording that will define storage's future.

Key Insight: Rack-level power architectures with DC bus bars can achieve 8-12% efficiency gains over commodity servers, and broader adoption of Open Compute designs would significantly reduce the tech industry's carbon footprint beyond just hyperscalers.

This post provides a comprehensive technical breakdown of data center power efficiency, explaining the differences between 'carbon neutral,' 'net zero,' and 'carbon negative' designations while examining how hyperscalers like Google, Facebook, and Microsoft optimize power usage. Frazelle dives deep into the engineering trade-offs of power distribution systems, comparing rack-level DC bus bars to individual AC power supplies, and explains how the Open Compute Project's designs achieve significant efficiency gains. The post argues that wider adoption of rack-scale architectures could reduce wasted carbon emissions across the industry, not just at hyperscale companies.

Key Insight: Building robust, scalable network infrastructure from day one is a foundational investment that reflects a startup's technical priorities and culture.

Jess Frazelle documents the network infrastructure setup for Oxide Computer Company's new office, treating it with the same care as her previous home lab posts. She details the UniFi-based setup including a 48-port switch, Dream Machine router, multiple access points, and an isolated secondary network for lab equipment. The post reflects the early startup phase where getting reliable internet took priority over furniture.

Key Insight: The gap between hyperscaler infrastructure capabilities and what's available to everyone else represents a massive opportunity to bring integrated, purpose-built hardware and software to organizations with legitimate on-premises needs.

Jess Frazelle announces the founding of Oxide Computer Company alongside Steve Tuck and Bryan Cantrill, a venture aimed at building integrated hardware and software for on-premises infrastructure. After extensive conversations with companies running their own infrastructure, she identified a significant pain point: organizations with legitimate needs for on-premises computing (security, latency, economics) have been neglected by existing vendors. Oxide aims to bring the 'infrastructure privilege' that hyperscalers like Google and Facebook enjoy to everyone else, through better hardware-software integration, power distribution, and density.

Key Insight: The messy, failure-prone process of hacking on open source firmware—complete with desoldering chips and debugging SPI flash timing issues—is ultimately more educational and rewarding than a smooth success would have been.

Frazelle recounts her experience at the Open Source Firmware Conference hackathon, where she attempted to replace proprietary BMC firmware with OpenBMC on a Supermicro motherboard. The project hit numerous obstacles including SPI flash contention issues, write speed problems, and debugging without a serial console. Despite not achieving a fully working open source BMC by the end, she frames the failures as valuable learning experiences about low-level hardware debugging.

Key Insight: Tech hype that originates in academia and ignores practitioner warnings can lead to flawed implementations with real security consequences, as demonstrated by Intel's TSX enabling side-channel attacks that practitioners predicted would be problematic.

Frazelle uses transactional memory (specifically Intel's TSX) as a case study of how tech hype can lead to flawed implementations. She explains how transactional memory trades deadlocks for livelocks and creates security vulnerabilities that enabled attacks like DrK to break KASLR without generating page faults. The post traces how the transactional memory hype originated in academia around 2008, was implemented by Intel in 2012 despite practitioner warnings, and reflects on how hype propagation channels have evolved from academic journals to social media.

Key Insight: Kubernetes can deliver real benefits, but executives need to understand the significant operational complexity, security risks, and learning curve costs before adopting it—managed offerings don't eliminate these challenges, they just shift some of the burden.

Jess Frazelle offers business executives a reality check on Kubernetes adoption, cutting through the hype to explain the significant challenges organizations face. She covers the risks of using Kubernetes for stateful data, the security dangers of exposed dashboards, the operational pain of upgrades that consistently break production, and the steep learning curve that leads to outages. Even managed Kubernetes offerings don't eliminate these problems—they still require deep expertise and carry their own isolation and security risks.

Key Insight: BPF represents a paradigm shift in Linux observability and networking by moving filtering and tracing into the kernel itself, enabling production-grade tooling that was previously impossible with tools like iptables.

This foreword for the 'Linux Observability with BPF' book explains why BPF (Berkeley Packet Filters) and XDP (Express Data Path) represent a significant advancement in Linux kernel capabilities. Drawing from her experience as a Docker core maintainer dealing with iptables pain points, Frazelle explains how BPF solves real problems in container networking, system tracing, and DDoS mitigation. She emphasizes that BPF enables developers to trace syscalls, build custom tools, and prove performance issues with hard data, all while being production-ready due to its ability to filter and aggregate at the source of events.

Key Insight: Power dynamics distort how leaders are perceived and how their words land, making transparency about mistakes and patience in building trust essential for effective leadership.

Jess Frazelle reflects on the often-invisible power dynamics that affect how leaders are perceived and how their communications land. She argues that people only see a limited view of leaders through brief interactions, which can lead to misunderstandings when feedback feels harsh or requests feel like demands. The post advocates for vulnerability, transparency about mistakes, and patience in building trust over time.

Key Insight: True hardware security is impossible to achieve or verify when the most privileged code in our systems remains proprietary and invisible, making open source firmware essential rather than optional.

The post examines the security implications of proprietary firmware running at the most privileged levels of computing hardware (Rings -2 and -3), which paradoxically have the least visibility despite having more access than the operating system or hypervisor. Frazelle explains how the Intel Management Engine and UEFI kernel contain hidden kernels with their own networking stacks and web servers, creating massive attack surfaces. She advocates for open source firmware initiatives like linuxboot, coreboot, and the NERF stack as solutions to improve security through transparency and reduced complexity.

Key Insight: Complex API integration code with N+1 problems and pagination logic can be dramatically simplified using a SQL abstraction layer that handles the optimization automatically.

Jess Frazelle tests Transposit, a SQL interface for APIs, by rebuilding her 'Gitable' bot that syncs GitHub issues to Airtable. She walks through replacing complex 'glue code' and N+1 query problems with simple SQL joins across APIs. Despite attempting to break the platform with her 'weirdest' bot, the tool handles the complexity gracefully, including pagination and API rate limiting.

Key Insight: Before trusting a cloud provider with your data, demand to understand their internal threat model and implementation quality—if they can't answer these questions, that's your answer.

Frazelle outlines three critical questions enterprises should ask before adopting cloud services. She emphasizes cutting through hype to understand actual need, demanding transparency about internal implementation and security practices, and verifying that features solve real customer problems rather than product manager hunches. The post reflects deep skepticism about cloud providers' security posture and transparency.

Key Insight: Just as software engineers use CI to catch bugs before they ship, leaders should use a personal checklist of introspective questions to catch ego-driven or fear-based decisions before they cause harm.

The post proposes a 'Leadership CI' framework—a set of self-assessment questions leaders should ask themselves before making decisions, analogous to how software uses continuous integration tests before merging code. Co-authored with Kathy Simpson, it argues that leaders need pre-established checks to avoid decisions driven by fear and pride, instead favoring growth, humility, and inclusion. The framework includes questions about ego, transparency, curiosity, manipulation, and whether you're empowering your team or creating an echo chamber.

Key Insight: The technical tools engineers use daily for tracking changes and finding differences—like version control diffs—could be powerful instruments for transparency and truth-seeking in journalism and governance.

Frazelle reflects on spending a day shadowing investigative journalist Jeff Kao and discovering parallels between journalism and her technical background. She explores how software engineering tools like diffs and version control could serve as mechanisms for transparency and truth-finding in journalism and governance. The post draws connections between text comparison techniques used in investigative pieces (like uncovering fake net neutrality comments) and the everyday tools of source control.

Key Insight: The entire cloud computing industry is built on dangerous assumptions because different layers of the stack—from hardware to orchestration—were designed in isolation without understanding how they would be composed for multi-tenant security.

Frazelle applies Conway's Law to the software stack and identifies a critical problem: insufficient communication between hardware, firmware, kernel, and application layers leads to dangerous security assumptions. She provides examples from hardware engineers who never intended chips for multi-tenant isolation (leading to Spectre/Meltdown), firmware complexity that frustrates kernel developers, and Kubernetes being misused for multi-tenant isolation despite not being designed for it. The post questions how the industry can solve this fundamental disconnect between stack layers.

Key Insight: Deep technical learning requires embracing a recursive process of exploring foundational concepts before tackling your actual goal, treating it like a choose-your-own-adventure game where you dig into whatever sparks curiosity.

Frazelle uses her exploration of RISC-V as a case study for how she learns new technical topics. Rather than diving straight into RISC-V specifics, she recursively digs into foundational concepts like instruction set architectures, examining RISC, CISC, VLIW, and other ISA types first. She reviews the Berkeley RISC-V design paper, highlighting why existing proprietary ISAs like x86 (with ~2,500 instructions) and ARM were unsuitable, and why an open, simpler architecture was needed. The post deliberately ends before covering RISC-V's actual design to illustrate that deep learning requires extensive foundational exploration.

Key Insight: A distinguished engineer's value lies not in technical brilliance alone, but in their ability to empower others, remain humble, and model the behavior that makes junior engineers want to reach that level.

Jess Frazelle defines what a distinguished engineer should embody after experiencing the 'N+1 shithead problem' - being demotivated by seeing senior engineers behave poorly. She outlines a comprehensive framework covering technical leadership qualities like empowering others, giving constructive criticism, having opinions loosely held, and prioritizing shipping. The post emphasizes that distinguished engineers must also engage with external communities, remain humble, and ultimately demonstrate these values through actions rather than words.

Key Insight: Hardware ownership should include firmware ownership, and the open firmware movement is making real progress despite vendor lock-in mechanisms like Intel's Boot Guard.

Jess Frazelle recaps her recent adventures exploring cutting-edge open source hardware and firmware initiatives, from seeing unikernels boot on RISC-V at Cambridge to witnessing Facebook's open firmware efforts at Open Compute Summit. She highlights the exciting progress in replacing proprietary firmware with open alternatives like LinuxBoot and Coreboot, while critiquing Intel's Boot Guard for locking users out of their own hardware. The post serves as a travelogue through the frontier of open hardware innovation during her time between jobs.

Key Insight: Trust is not given but earned through consistent integrity, and leaders who default to secrecy over transparency are often weaponizing information asymmetry against their own teams.

Frazelle reflects on trust and integrity in leadership after spending time observing the finance industry. She argues that transparency and trust go hand-in-hand, and leaders must earn trust through a track record of doing the right thing rather than assuming it will be given. She criticizes leaders who weaponize information asymmetry against their reports, and emphasizes that unlike respect, trust starts at zero and must be actively built.

Key Insight: Functional hierarchies in government and medicine reward actual accomplishments and enable collaborative leadership, while tech often conflates titles with power and promotes managers who hoard decisions instead of empowering teams.

Jess Frazelle documents her experiences shadowing professionals in government (Pentagon/US Digital Service) and medicine (surgical residency) to compare their organizational cultures with tech. She finds that both fields have hierarchical structures with meaningful lessons: military badges reward actual accomplishments rather than political climbing, and attending physicians work collaboratively with residents rather than dictating from above. She contrasts these healthier dynamics with tech's dysfunction around meaningless titles and managers who hoard technical decisions instead of empowering their teams.

Key Insight: Reading romanticized accounts of computing history can rekindle the passion and idealism that originally drew engineers to the field, serving as a counterbalance to tech cynicism.

Jess Frazelle shares her curated reading list divided into 'romanticized tech' books that capture the idealistic spirit of computing history, and non-fiction spanning leadership, science, and self-improvement. The romanticized tech section features books about Data General, CERN, Commodore, and the origins of the Internet that remind readers why they entered the field. The non-fiction recommendations range from technical resources like Google's datacenter design to management guides and physics texts, reflecting her diverse interests in leadership, mathematics, and particle physics.

Key Insight: Authentic self-expression and unconventional thinking, even when criticized by authority figures, can be a strength rather than a liability.

Jess Frazelle shares her college entrance essay to encourage others who may have been criticized for their unconventional writing style. She recounts how her satirical senior thesis about the moon landing being fake earned her first D, but she refused to compromise her authentic voice. The essay itself, 'Pharmy Tales,' is a collection of humorous vignettes from her high school job at a pharmacy, showcasing her natural storytelling ability and sardonic wit.

Key Insight: Technologies should be evaluated in the context of their original design intent, and what appears to be a flaw may simply be users pushing the technology into use cases it was never built to handle.

Jess Frazelle revisits her earlier critique of Intel SGX after learning it was originally designed for DRM, not as a general execution environment. She acknowledges the HAVEN paper's novelty in repurposing enclaves for code execution and praises Joanna Rutkowska's thoughtful approach to SGX tradeoffs at Golem. The post emphasizes the importance of understanding a technology's original design intent before judging its limitations, and reflects on how users inevitably push technologies beyond their intended purposes.

Key Insight: LD_PRELOAD is an incredibly powerful Linux mechanism for intercepting and replacing library functions, enabling everything from debugging and security research to creative hacks and satirical cloud architectures.

Jess Frazelle professes her love for LD_PRELOAD, an environment variable that allows overriding library symbols by loading custom shared objects before any other library. She clarifies that LD_PRELOAD is NOT a linker flag (despite common confusion), then showcases creative uses collected from Twitter, including hacking Quake 3, bypassing Dropbox filesystem restrictions, and reproducing SSH key vulnerabilities. The post culminates in her satirical 'Cloud Native Syscalls' project that uses LD_PRELOAD to forward all syscalls to a remote cloud daemon.

Key Insight: The end of Moore's Law combined with open source hardware tools creates an opportunity to return to building computers with soul—small teams driven by passion and accomplishment rather than corporate fragmentation.

Frazelle argues that the end of Moore's Law, rather than being a crisis, opens up a new golden age for computer architecture and passionate building. Drawing inspiration from 'The Soul of a New Machine' and the garage-computer-building era, she contrasts the soul-driven work of small, mission-aligned teams with today's fragmented corporate engineering roles. She sees democratization of hardware design through open source tools as enabling a return to that era of building with passion and purpose.

Key Insight: True multi-tenant security for arbitrary code execution requires defense in depth with VM-level isolation, and Kubernetes' complexity makes it unsuitable for high-security multi-tenancy despite its popularity.

This design document outlines a secure multi-tenant container orchestrator for running untrusted third-party code in isolation. Frazelle argues for using Firecracker VMs instead of plain containers to allow full syscall access while maintaining security through multiple isolation layers. The design emphasizes defense in depth with locked-down host OSes, network deny-all defaults, eBPF monitoring, and explicit rejection of Kubernetes due to its complexity and large attack surface.

Key Insight: Hardware security features like Intel SGX are often undermined by fundamental architectural vulnerabilities and corporate licensing schemes, making their security promises more marketing than reality.

Frazelle documents her deep dive into firmware and hardware security during her unemployment, exploring baseboard management controllers (BMC), Intel Management Engine, and Intel SGX. She traces her path from openbmc and u-bmc projects through the security vulnerabilities of closed-source firmware, ultimately landing on SGX's extensive attack surface including Foreshadow and cache attacks. The post reveals how technologies marketed as security features often contain hidden complexities, licensing restrictions, and fundamental vulnerabilities that undermine their stated purpose.

Key Insight: The Unix pipe represents brilliant software design because it allows simple, single-purpose programs to become building blocks for solving complex problems their original authors never imagined.

Jess Frazelle celebrates the Unix pipe as a brilliant piece of software design that embodies the Unix philosophy of making programs that do one thing well and can be combined with others. She traces the concept back to Doug McIlroy's 1964 memo proposing ways to 'couple programs like garden hose.' The post argues that this design pattern enables creativity and extensibility by allowing simple tools to become building blocks for solving complex problems the original authors never anticipated.

Key Insight: GitHub Actions is essentially 'scriptable GitHub' where Docker containers run in response to repository events, with the workflow file orchestrating the trigger conditions and the Dockerfile defining the execution environment.

This post walks through the complete lifecycle of a GitHub Action, from workflow file configuration to Docker container execution. Using a practical example of automatically deleting merged PR branches, Frazelle explains how GitHub triggers events, resolves action dependencies, builds Docker images, and executes scripts. The tutorial demystifies the Actions system by showing each component: workflow files, Dockerfiles, and the bash scripts that do the actual work.

Key Insight: Kubernetes complexity is often unnecessary—choose the simplest tool that solves your actual problem rather than following industry hype.

Jess Frazelle pushes back against the assumption that she's a Kubernetes advocate, clarifying that the problems she's written about are often specific to Kubernetes' design choices rather than universal container orchestration challenges. She argues that many teams could build simpler, custom orchestrators using containerd directly, and that the truly hard problems (like unprivileged image building) exist independent of Kubernetes. The post is a call for pragmatism over hype-driven technology choices.

Key Insight: Containers can encapsulate and manage even kernel-level software like Wireguard, maintaining a clean host system while still gaining full functionality.

Jess Frazelle demonstrates how to install and use Wireguard VPN entirely through containers, staying true to her philosophy of never installing software directly on the host system. She provides Dockerfiles for both installing the Wireguard kernel module and running the wg command-line tools, showing how containers can manage even kernel-level components. The post includes a complete walkthrough of setting up a Wireguard connection using the demo server, with an update noting that Tailscale now offers an easier cross-platform solution using a Go implementation.

Key Insight: A record of Frazelle's evolution as a speaker from container evangelism through deep-dive security research, reflecting the maturation of container technology itself from novelty to production security concerns.

This is a curated index page listing Jess Frazelle's conference talks from 2015-2019, organized chronologically. The talks span topics including container security, building containers from Linux primitives, Intel SGX, open source firmware, running desktop apps in containers, and the intersection of individual contributors and corporate interests in open source. It serves as a reference archive for her public speaking on containers, security, and infrastructure topics.

Key Insight: Marketing hype from large organizations often dismisses existing security work without proper research, creating echo chambers that spread FUD rather than building on the defense-in-depth mechanisms already implemented in container runtimes.

Frazelle pushes back against marketing claims that existing container security mechanisms are inadequate, pointing out that she personally implemented Docker's default Seccomp and Apparmor profiles which provide multiple overlapping layers of protection. She argues that gvisor's marketing dismisses this work while spreading FUD, and that large organizations suffer from 'not invented here' syndrome combined with echo chambers that prevent them from recognizing external contributions. The post defends the extensive testing and thoughtful defaults built into container runtimes while questioning whether gvisor actually provides better security given its operational complexity and larger syscall surface.

Key Insight: Hard multi-tenancy in Kubernetes requires treating it like an operating system kernel and applying proven intra-kernel isolation techniques, giving each tenant their own nested control plane rather than relying on a single shared system that can be fully compromised by one exploit.

Jess Frazelle argues that achieving hard multi-tenancy in Kubernetes requires more than one layer of security, drawing parallels to how operating system kernels handle privilege separation. She proposes applying 'intra-kernel isolation' to Kubernetes, where each namespace gets its own nested Kubernetes system services (api-server, kube-proxy, etc.), so that exploiting one tenant's services doesn't compromise the entire cluster. The post outlines how combining namespace isolation with node-level resource control—or alternatively using VM-based container isolation—can provide defense in depth against both API vulnerabilities and container breakouts.

Key Insight: Building unprivileged container images in Kubernetes is achievable but requires coordinated patches across multiple layers of the container stack—from runc to Docker to Kubernetes—demonstrating how deeply intertwined these systems have become.

Jess Frazelle documents her journey to create 'img', an unprivileged container image builder for Kubernetes, after a challenge from a coworker who claimed it couldn't be done. She builds on prior art from Docker colleagues and the buildkit project, then systematically works through the technical obstacles of running unprivileged builds inside containers—requiring patches to runc, Docker, and Kubernetes itself. The post demonstrates how achieving seemingly simple goals in the container ecosystem often requires deep yak-shaving across multiple layers of the stack.

Key Insight: By combining kernel-level binary format registration with self-contained container binaries, you can create a system where any programming language can be executed as a script without polluting your host with dependencies.

Jess Frazelle takes a Cloudflare blog post about using BINFMT_MISC to script in Go and extends it to run any language through containers. She combines her binctr project (which embeds container images into static binaries) with BINFMT_MISC to execute Common Lisp scripts in isolated containers without installing anything on the host. The result is a proof-of-concept where any script can be 'dot slashed' and run in its own container environment.

Key Insight: Building and maintaining your own personal infrastructure gives you control, performance, and the satisfaction of automation that generates its own automation.

Jess Frazelle details her extensive personal infrastructure setup, which includes self-hosted Jenkins CI, a private Docker registry with vulnerability scanning, a private git server, and various automation bots. She runs everything in Docker containers across NUCs and cloud instances, with automated pipelines that generate their own automation. The post serves as a practical guide to the tools and configurations she uses, demonstrating her philosophy of building custom infrastructure for control and performance.

Key Insight: A well-designed home lab with proper network segmentation and hardware-backed authentication enables secure, seamless remote development from anywhere.

Jess Frazelle walks through her home lab setup, detailing how she rebuilt her home networking using Ubiquiti Unifi equipment and Intel NUCs. She containerized the Unifi controller, set up VLANs for network isolation, and configured SSH authentication using Yubikeys for secure remote access. The result is a setup that lets her SSH into her home lab from anywhere, including from a Pixelbook at 39,000 feet using hardware-backed authentication.

Key Insight: Windows Subsystem for Linux represents a remarkable engineering achievement where Microsoft engineers reimplemented Linux syscalls from scratch, creating a native Linux compatibility layer that rivals containerization in its technical elegance.

Jess Frazelle explores Windows Subsystem for Linux (WSL) after joining Microsoft, explaining how it works at a technical level including Pico processes, system call translation, and the ability to run Linux binaries natively without a VM. She walks through the architecture where WSL kernel drivers translate Linux syscalls to Windows NT APIs, discusses practical features like launching Windows executables from WSL and running X applications, and shares pain points around copy/paste, file performance, and filesystem interoperability. The post also covers how to set up a Windows machine reproducibly using Boxstarter.

Key Insight: The best security is invisible security—enabled by default, requiring no user configuration, and generated deterministically at build-time rather than through error-prone runtime profiling.

Jess Frazelle argues that security tools have historically been too difficult to use, causing users to disable them entirely. She advocates for finding the right balance between security and usability through collaboration between security and software engineers. Using Docker's default seccomp and AppArmor profiles as examples of security made invisible to users, she proposes a future where programming languages generate seccomp filters at build-time, allowing binaries to sandbox themselves automatically.

Key Insight: Containers provide incomplete isolation by default because critical kernel objects like time and the keyring aren't namespaced, making seccomp profiles and capability restrictions essential for security.

This post explains two Linux kernel objects that aren't namespaced in containers: time and the kernel keyring. Frazelle demonstrates that changing time inside a container affects the host system, and that keys stored in the kernel keyring by one container are visible to all other containers on the same host. She emphasizes that Docker's default seccomp profiles block these potentially dangerous operations, reinforcing that namespaces and cgroups alone don't provide complete container isolation.

Key Insight: Containers' flexibility and security trade-offs stem from being assembled from primitives rather than designed as first-class isolation units, making them fundamentally different tools than VMs, Zones, or Jails—not inferior ones.

Jess Frazelle argues that containers are fundamentally different from Solaris Zones, BSD Jails, and VMs because containers are not first-class objects—they're built from Linux primitives (namespaces and cgroups) rather than being designed as top-level isolation mechanisms. This architectural difference gives containers unique flexibility, like sharing namespaces between processes, but also introduces complexity that leads to security bugs. She advocates for improving container security through hardening rather than abandoning them for alternatives that serve different use cases.

Key Insight: A truly secure containerized desktop requires not just running apps in containers, but ensuring the container runtime itself doesn't need root privileges, combined with an immutable base OS that enforces containerization by design.

Jess Frazelle describes her quest to build the ultimate Linux desktop experience by modifying CoreOS Container Linux (a server OS) to run on her laptop with graphics drivers, then running all applications in rootless containers. She hacked Gentoo-based ebuilds to add Intel graphics support, set up auto-updates via an Omaha server, and leveraged the read-only /usr filesystem to enforce containerization of everything. The setup represents her vision of a secure, automatically-updating desktop where even the container runtime doesn't require root privileges.

Key Insight: Infrastructure changes that seem simple can cascade into unexpected breakage across interconnected systems, but systematic scripting and a tolerance for self-inflicted pain can get you through.

Jess Frazelle documents the chaos that ensued when she changed her GitHub username from 'jfrazelle' to 'jessfraz' to match her other online handles. What started as a simple username swap cascaded into broken Jenkins builds, failed Go imports across 50+ repositories, and potential breakage for other developers who depended on her repos. She walks through her systematic approach to fixing everything using sed, vim's argdo command, and pull requests, while maintaining her characteristic humor about self-inflicted infrastructure pain.

Key Insight: Corporate-backed open source succeeds when companies recognize that maintainers' passion and loyalty to the project must come before company interests, and when everyone—employees and external contributors alike—plays by the same rules.

Frazelle examines the tension between personal passion for open source projects and corporate interests when getting paid to maintain them. Drawing from her experience on Docker's core team, she argues that maintainers can and should stand up for project integrity while keeping their jobs. The post outlines practical lessons for companies backing open source projects, emphasizing that community trust depends on everyone playing by the same rules regardless of employment status.

Key Insight: Even highly accomplished engineers can feel exhausted by the tech industry's environment, viewing departure as an eventual relief rather than a loss.

Jess Frazelle reflects on the growing appeal of leaving the tech industry, noting that at only 27 years old, departure already feels imminent. She describes fantasies of teaching math abroad, writing, or playing professional poker after leaving. Despite her frustrations, she's not ready to quit yet and remains committed to helping more women feel welcome in tech, even as she acknowledges having a 'hate/love' relationship with the industry.

Key Insight: Data from GitHub's top repositories confirms the conventional wisdom that smaller pull requests are significantly more likely to be merged than larger ones.

Jess Frazelle uses BigQuery to analyze GitHub Archive data, examining pull request statistics across popular repositories in 2015. She calculates merge ratios for top projects by unique contributors, finding that Docker had a 75.79% merge rate. The analysis culminates in comparing the average size of merged vs. closed pull requests to test the hypothesis that smaller PRs are more likely to be merged.

Key Insight: A childhood house fire taught the valuable lesson that material possessions are ultimately replaceable, but relationships with people are what truly matter.

Frazelle shares a childhood memory from 1995 Phoenix when varnish rags left by painters spontaneously combusted in the extreme Arizona heat, causing a house fire that destroyed much of her family's home. The post reflects on how losing material possessions—including her beloved teddy bears—taught her an early lesson about what truly matters. She closes with an eerie coincidence: a fire-scorched page of the Ten Commandments from discarded Sunday school books landed at their front door and remains framed in her parents' home today.

Key Insight: Static binaries and understanding linker flags give developers precise control over their build artifacts, enabling everything from minimal deployments to advanced runtime tricks like self-dlopen.

Jess Frazelle presents a satirical 'BuzzFeed-style' listicle of her favorite linker flags, combining genuine technical utility with irreverent humor. The post covers flags for static linking, symbol management, debugging, and stripping binaries. While playfully mocking clickbait formats, it actually provides useful reference material for developers working with the linker.

Key Insight: Closing pull requests is an unavoidable skill for maintainers, and doing it with empathy and clear communication—while being decisive and timely—minimizes frustration for everyone involved.

Being an open source maintainer requires learning to say 'no' to patches, which is one of the hardest parts of the job. The post outlines several techniques for closing pull requests gracefully while minimizing contributor frustration, including the 'ego stroke and close,' closing early before contributors invest more work, and 'carrying' patches to completion when contributors disappear. Frazelle emphasizes that maintainers deal with an information asymmetry where contributors treat their PRs as pets while maintainers must manage them as cattle.

Key Insight: True container sandboxing requires running without root privileges, which user namespaces can enable, but the real security value comes from application-specific profiles rather than generic container configurations.

The post argues that while containers and sandboxes use the same Linux primitives (namespaces, seccomp, AppArmor), containers aren't true sandboxes primarily because they require root privileges to create and run. By leveraging user namespaces, it's possible to create containers as an unprivileged user, though cgroups remain a challenge. The author presents binctr as a proof of concept and advocates for evolving containers toward real sandbox isolation.

Key Insight: Every Docker storage driver has significant tradeoffs, but Overlay with a modern kernel is the most practical choice for most users, while Devicemapper should be avoided unless you're on RedHat.

Jess Frazelle provides an unfiltered evaluation of Docker's storage drivers (graphdrivers), examining the tradeoffs of each option. She advocates for Overlay as her personal choice despite some kernel bugs, dismisses Devicemapper as unreliable outside RedHat, and warns that each driver has significant setup requirements or limitations. The post cuts through marketing to give practitioners real-world guidance on which storage backend to choose.

Key Insight: Native IP assignment in Docker 1.10 transforms a previously hacky container networking task into a simple three-command workflow.

Docker 1.10 introduced the ability to assign specific IP addresses to containers through libnetwork, eliminating the need for hacky workarounds like pipework or custom bash scripts. This feature allows users with dedicated IP blocks to easily assign public IPs directly to containers with simple commands. Jess demonstrates the straightforward three-step process: create a network with your subnet, run a container with a specific IP, and access it publicly.

Key Insight: When higher-level container tools don't expose the low-level controls you need, dropping down to runc gives you complete power over namespace mappings and container configuration.

Jess Frazelle documents her migration from Docker to runc for running desktop applications in containers, motivated by the desire for fine-grained control over user namespace mappings. She needed custom gid mappings to access audio and video devices while still benefiting from user namespace isolation. To facilitate this workflow, she built three tools: Riddler (converts Docker containers to OCI specs), Netns (provides bridge networking for runc containers), and Magneto (displays container stats).

Key Insight: The --privileged flag is a sledgehammer when you usually only need a scalpel—understanding which specific Linux capabilities you actually need enables more secure container configurations.

Jess Frazelle demonstrates how to run desktop applications and Docker-in-Docker using Docker's new user namespace support coming in version 1.10. She walks through practical examples including Chrome, the notify-osd daemon with irssi IRC client integration, and explains how to achieve Docker-in-Docker without the --privileged flag by carefully selecting only the necessary capabilities (CAP_SYS_ADMIN and CAP_NET_ADMIN) and adjusting seccomp/apparmor profiles.

Key Insight: Good security defaults matter because the manual alternative of creating custom seccomp profiles requires deep systems knowledge and hours of painful debugging that no normal user will actually do.

Jess Frazelle explains how to create custom seccomp profiles for Docker containers, walking through her experience generating a profile for Chrome by running it under strace for an entire day. She demonstrates that even with automated tools, the resulting profile missed 6 critical syscalls that required manual debugging and domain knowledge to identify. The post serves as both a tutorial and an argument for why Docker needed to ship sane default seccomp profiles that protect users without requiring this painful manual process.

Key Insight: Docker's cgroup-based I/O throttling provides a practical defense layer against resource exhaustion attacks like decompression bombs by limiting bandwidth at the device level.

Jess Frazelle connects a talk on decompression bombs to Docker's cgroup-based I/O throttling capabilities. After seeing a presentation on malicious compressed files that expand to consume massive resources, she highlights Docker's blkio read/write bandwidth controls as a practical defense mechanism. She demonstrates how the --read-bps-device flag can limit container I/O throughput using cgroups, effectively throttling resource consumption at the device level.

Key Insight: Docker's network namespace sharing combined with a reverse VPN creates a secure, granular way to expose specific home services to the internet without opening up your entire network.

The post explains how to set up a reverse VPN to securely expose services from a home network to the public internet, rather than the traditional use of VPNs for accessing office networks remotely. Jess walks through the complete Docker-based setup using OpenVPN, from generating certificates on a cloud instance to configuring the client on a home NAS. The key insight is using Docker's network namespace sharing to route specific containers through the VPN tunnel, giving fine-grained control over what gets exposed.

Key Insight: Running Tor and Privoxy as separate linked Docker containers provides flexible, lightweight privacy proxies while adhering to the container principle of one process per container.

Jess Frazelle demonstrates how to set up a Tor SOCKS5 proxy and a Privoxy HTTP proxy as separate Docker containers, continuing her series on combining Docker with Tor. She walks through the Dockerfiles, configuration changes, and runtime commands for both containers, showing how to link them together. The approach emphasizes container best practices by keeping each service in its own container rather than bundling multiple processes together.

Key Insight: Docker's lightweight containerization makes it trivially easy to contribute to the Tor network by running a relay, lowering the barrier for privacy infrastructure participation.

This tutorial walks through how to set up three types of Tor relays (bridge, middle, and exit) using Docker containers built on Alpine Linux. The post explains the differences between relay types, with bridge relays being unlisted for censorship resistance, middle relays forwarding traffic, and exit relays being the publicly visible endpoint. It provides complete Dockerfiles and torrc configurations for each type, including a reduced exit policy that limits which ports accept traffic to minimize abuse complaints.

Key Insight: The tech industry's harassment problem is so severe that women cannot participate visibly in open source and conferences without enduring threats of violence, yet refusing to be silenced is itself an act of resistance.

Jess Frazelle confronts the severe harassment she has faced as a woman in the tech industry, describing threats of sexual violence, death threats, and graphic disturbing images sent to her since she began speaking at conferences and contributing to open source. She expresses frustration that she cannot simply do the work she loves without enduring this abuse. Despite the hostility, she refuses to leave the industry or change who she is.

Key Insight: Running R data science workflows inside Docker containers keeps the host clean and makes analytical environments reproducible and portable.

Jess Frazelle demonstrates how to build a custom Docker container for R-based data science work, driven by her philosophy of never installing tools directly on the host machine. She walks through creating a Dockerfile with popular R packages like ggplot2 and the Wes Anderson color palette, then shows how to run it with X11 forwarding for graphical output. The post is a quick, practical tutorial written during what was supposed to be her vacation.

Key Insight: Containerizing Tor and using host networking with iptables provides a clean, reproducible way to route all system traffic through the Tor network without complex Docker networking workarounds.

This technical tutorial demonstrates how to route all host traffic through a Tor Docker container using iptables rules. Frazelle provides a straightforward approach: run her Tor image with host networking, then apply iptables NAT and filter rules to redirect all TCP traffic through Tor's transparent proxy port while allowing local network exceptions. The post acknowledges the tradeoff of using --net host but argues it's pragmatic given the goal of routing all traffic.

Key Insight: Running your entire testing infrastructure in the same technology you're building creates a virtuous cycle where dogfooding catches bugs early while automation keeps operational overhead minimal.

Jess Frazelle explains how she manages Docker's testing infrastructure of ~50 servers as a part-time responsibility while working as a core maintainer. The infrastructure tests Docker across 6 storage drivers, multiple Linux distros, various kernel versions, and Windows clients, processing hundreds of builds weekly. By running everything in Docker containers—Jenkins, Consul, IRC bots, webhook services—and using tools like Consul for monitoring, the system essentially runs itself, allowing her to focus on her primary engineering work.

Key Insight: Docker containers aren't just for production deployments—they can sandbox desktop applications, giving you resource control and clean isolation that traditional package managers can't provide.

Jess Frazelle demonstrates an unconventional use of Docker: running desktop applications in containers on Linux. Motivated by the desire for OS X-style application sandboxing and clean uninstalls, she shows how to containerize everything from text-based apps (IRC, email, Twitter clients) to full GUI applications (Chrome, Spotify, Skype, Tor Browser) by mounting the X11 socket. This approach provides resource control (CPU/memory limits), application isolation, and the satisfaction of knowing deleted apps leave no traces behind.

Key Insight: Running Linux on Mac hardware requires significant effort including custom kernel builds and driver configuration, but the result—especially thunderbolt hotplugging and retina display support—makes it worthwhile for those committed to escaping macOS.

This tutorial walks through the complete process of installing Debian Linux on a MacBook Pro Retina, covering boot manager setup with rEFInd, disk partitioning, building a custom 3.17.x kernel for thunderbolt hotplugging support, and configuring drivers for wifi, graphics, and touchpad. Frazelle documents the numerous pain points and workarounds required, from dealing with EFI boot quirks to fixing CD-ROM mount errors during installation. The post reflects her frustration with macOS and her determination to run Linux as her primary OS, even sharing her custom kernel configs and shell scripts for backlight control.

Key Insight: An early glimpse of Frazelle's hacker mindset: treating platform restrictions as technical puzzles to understand and circumvent through API exploration.

This early blog post from Jess Frazelle documents her exploration of Foursquare's API to enable remote check-ins for badge collection. She reverse-engineered the check-in process using PHP and cURL, discovering the rate limits and geographic validation rules Foursquare implemented. The post serves as both a technical tutorial on OAuth authentication and API manipulation, and an early example of her characteristic approach to treating security boundaries as puzzles to solve.

Key Insight: While external inspiration and role models can prompt reflection on major decisions, ultimately you must trust yourself as your own best advocate when choosing to embrace change.

Inspired by a coffee shop sign asking 'What would 2PAC do?', Frazelle reflects on Tupac's song 'Changes' and draws parallels to her own life decision to take a new job in New York. She connects Tupac's message about change with Gandhi's philosophy about self-transformation, concluding that while external inspiration is valuable, ultimately you must trust yourself to make important life decisions.