Larvitz Blog
Mastodon

Welcome to Larvitz Blog! I’m Christian, a Senior Consultant by day and FreeBSD enthusiast by night, with over 20 years in enterprise IT. Here I write about FreeBSD jails, PF firewalling, self-hosting, Linux system administration, and anything that’s cleanly engineered. Most articles are hands-on guides born from running my own infrastructure, from dual-stack networking and Ansible automation to hosting a Mastodon instance on FreeBSD.

Have a question or want to discuss something? Find me on the Fediverse at @Larvitz@burningboard.net. I’m always happy to chat!

#podman Articles

  • Sun 08 November 2026
  • Linux

A Read-Only AI Reviewer for Forgejo Pull Requests

A small Python service that reviews every pull request on my self-hosted Forgejo with an LLM, posts a summary and inline findings, and is not allowed to do anything else. The interesting part was not getting a model to comment on a diff. It was getting it to stop being confidently wrong about code it had never seen, and making sure a misbehaving or manipulated bot could not change a single line.
  • Fri 16 October 2026
  • Linux

WinBoat Broke, Windows Kept Running: dockurr/windows with Plain Podman

After a cleanup broke my WinBoat installation, I brought the same Windows 11 VM back with a single rootless podman run against the old storage directory. Here is what dockurr/windows actually is, what lives in its storage folder, why NETWORK=nat quietly became passt in rootless Podman, how I verified RDP without opening a window, and a Quadlet unit to keep it around.
  • Thu 17 September 2026
  • Linux

No Proxmox Backup Client for RHEL? Hold My Container Runtime

RHEL 10 on ARM64, a Proxmox Backup Server, and no convenient native client package. I borrowed the client from an old server container, mounted the host root filesystem read-only, and gave SELinux a very specific explanation. Five minutes later, I had an encrypted, incremental backup. There are caveats. Updated 2026-10-18 with a maintained client image for x86_64 and aarch64 on ghcr.io.
  • Thu 03 September 2026
  • Linux

Running Citrix Workspace on Fedora with Rootless Podman

Citrix Workspace is an application I need but do not want woven into my workstation. I put its official Debian package in a disposable rootless Podman container, then pass through just enough X11, PipeWire, GPU, and webcam plumbing to open downloaded ICA files from Fedora’s file manager.
  • Mon 03 August 2026
  • Linux

Sane Development Environments for Ansible Automation Code

Ansible content deserves something better than a laptop full of loosely related pip packages. My preferred setup puts the editor on RHEL, the Red Hat-packaged Ansible toolchain in a versioned Dev Container, and Podman underneath both development and Execution Environment workflows. The result is reproducible without pretending that upstream community bits and supported downstream product content are the same thing.

Android Development on Fedora 44 Without Installing an Android Development Stack

I wanted to build a native Android companion for Kollect without filling Fedora 44 with a JDK, Gradle, Android SDKs, build tools, emulator images, and assorted mobile-development debris. My complete Android toolchain now lives in an Ubuntu 24.04 Distrobox instead. It builds the APK, talks to my phone over wireless ADB, runs the Android emulator, and even lets Kollect enrich links for free with Gemini Nano through Android AICore.

Fedora Hummingbird: Distroless, Container-Native Linux and a Slim mastogreet

Fedora Hummingbird brings the distroless container model to a full, image-based rolling operating system, and it ships a catalog of hardened language images alongside it. I rebuild the mastogreet bot’s Containerfile on top of registry.access.redhat.com/hi/python to see what changes, what shrinks, and where the commercial Red Hat Hardened Images downstream fits in.

Red Hat Offline Knowledge Portal: All the Docs, Air-Gapped, On Your Laptop

The entire Red Hat documentation site and the full Knowledgebase fit into a single OCI container that updates weekly, runs locally with a web UI and Solr search, and is included in every RHEL subscription that bundles Satellite. I have it on my laptop. I use it daily. Almost nobody I talk to knows it exists. This post is my small contribution to fixing that.