One User, Two UIDs: NFSv4, Kerberos, and Docker on a Domain-Joined TrueNAS

Tue, 13 Oct 2026 00:00:00 +0000

SSSD and TrueNAS gave the same AD user different UIDs. How that showed up as nobody, Permission denied, root:root 755, and "I have no name!", and how we aligned them.

Docker Authorization with OPA: The Silent Fail-Open and Other Production Lessons

Mon, 12 Oct 2026 00:00:00 +0000

The plugin looks enabled, the policy is correct, yet Docker allows everything. A silent security gap I hit with opa-docker-authz in production, and its lessons.

About

Mon, 01 Jan 0001 00:00:00 +0000

I’m Onur Baydaş, a systems and infrastructure engineer based in Turkey. Since 2024 I’ve been designing, running, and troubleshooting on-premises infrastructure: the kind of environments where there is no managed cloud service to fall back on and every layer, from storage to scheduling, is your responsibility.

What I work on

Virtualization and storage: Proxmox VE clusters with Ceph, VMware vCenter/ESXi, hyperconverged platforms, TrueNAS/ZFS.
GPU infrastructure: NVIDIA GPU servers for AI and research workloads, GPU partitioning with MIG and vGPU, job scheduling with Slurm.
Multi-user platforms: Shared Linux systems for many users: user isolation, container access control, and day-to-day operations.
Container security: Restricting Docker on shared machines, authorization policies with OPA/Rego, and the gaps those policies can’t close.
Identity and operations: Samba-based Active Directory, Kerberos/NFS home directories, centralized logging, and backup monitoring.

What I write about

I write about problems I actually hit in production: the silent failures, the misleading documentation, and what the source code says when the docs don’t. Every post is based on a real incident, tested on a live system, and backed by links to the source.