Sizing a colocation cabinet means committing to rack space and power before you've finished filling it, whether it's your first cabinet or your fifth. Here's how to size both realistically, and what to check before you sign.
]]>After that it keeps returning. It comes up again at contract renewal, when a hardware refresh changes what the same rack units draw, and when growth forces a choice between adding a second cabinet and consolidating into a bigger one. The question is the same every time, and so are the two ways of getting it wrong.
The first is renting more rack than you need because it feels safer, then paying monthly for years of capacity that never gets used. The second is squeezing into a quarter rack that runs out of power six months in, forcing an unplanned move or a second cabinet in a different part of the facility.
Both come from the same gap: not knowing which of the two constraints that actually govern a cabinet will bind first, so you either over-buy to hedge the uncertainty or size on server count and get caught by power. This guide covers both of them, how they interact, and what to confirm with a provider before signing anything.
Rack space is measured in rack units, written as U, where one U is 1.75 inches of vertical space. A standard full cabinet is typically 42U, though 45U and 47U cabinets exist and some facilities use taller ones.
Colocation is usually sold in fractions of that: a full rack, a half rack (around 20U), a quarter rack (around 10U), or individual U slots for very small deployments. The fractions aren't always exactly half or a quarter of the total, since shared cabinets need space for cable management and per-customer power distribution, so confirm the actual usable U count rather than assuming the arithmetic.
Sizing starts with an honest inventory. Count the U height of every device going in, including the things people forget: switches, firewalls, a patch panel, a KVM or console server, anything terminating your own address space, and the power distribution units themselves if they're rack-mounted rather than vertically mounted in the cabinet's rear channel. If you're speccing hardware rather than relocating equipment you already own, run the same count from the bill of materials you intend to buy, since U height and rated power are on every vendor's spec sheet. Then add a growth buffer for 12 to 24 months, which is a more useful horizon than five years, because hardware density and business requirements both change faster than that.
Here's the part that surprises people sizing their first cabinet, and still catches out plenty who have done it before: most contracts are priced and capped by power, and you can exhaust your power allocation with half the cabinet still empty.
A quarter rack might come with a 5 amp or 10 amp allocation at 208V or 230V, which works out to roughly 1 kW at the low end and a little over 2 kW at the high end, before any derating is applied. Five or six modern dual-socket 1U servers can reach that under load, which leaves you holding half an empty quarter rack you aren't allowed to fill. This is why "how many servers fit" is the wrong opening question and "how many watts am I allowed" is the right one.
Estimating draw starts with nameplate wattage, the rated maximum on each device's power supply label. Summing nameplates gives you a conservative ceiling, and actual draw is typically well below it, often in the range of 40 to 70 percent for general-purpose servers at normal utilization. The useful discipline is to size against realistic sustained draw while leaving headroom, rather than either summing nameplates (which overbuys) or assuming idle figures (which underbuys and trips breakers).
Circuit derating matters too, and it catches people out. Electrical code practice generally limits continuous load to 80 percent of a circuit's rated capacity, so a 20 amp circuit gives you about 16 amps of usable continuous draw. If a provider quotes you a 20 amp feed, plan around 16, and confirm whether their quoted figure is the breaker rating or the usable allocation.
Most colocation cabinets offer A and B power feeds from separate upstream paths, and devices with dual power supplies connect to both. Under normal operation each supply draws roughly half the device's load, and if one feed fails the other carries the whole thing.
This creates a billing question worth asking explicitly, because practices differ. Many providers bill on the higher of the two feeds rather than the sum, on the reasoning that you're paying for the capacity you can actually use continuously. Others bill total provisioned capacity across both. The difference can be substantial on your monthly invoice, so get the answer in writing rather than inferring it.
The operational point matters just as much. Each feed needs to be able to carry your entire load alone, because that's the scenario redundancy exists for. If you're drawing 8 amps split across two 10 amp feeds you're fine, but if you're drawing 16 amps split across two 10 amp feeds you have no redundancy at all, just two feeds running at 80 percent, where losing one pushes the entire 16 amps onto the survivor and trips it too.
Power and cooling are related but not interchangeable. A facility can have power available for your cabinet and still not have the airflow to keep dense equipment in a safe temperature range.
Modern facilities use hot aisle and cold aisle arrangements, often with containment, and that design assumes equipment pulls cool air from the front and exhausts hot air to the rear. The temperature and humidity envelopes most facilities design against come from ASHRAE's datacom guidelines, which is useful context if a provider quotes you a supply air range. Getting the benefit requires your side of it: equipment oriented consistently, blanking panels in empty U slots so hot exhaust doesn't recirculate to the front intake, and cabling that doesn't obstruct rear airflow. Blanking panels in particular cost very little and materially improve intake temperatures.
It's also worth separating facility resilience from cooling capacity, since they're quoted together and mean different things. A facility's Uptime Institute Tier rating describes redundancy in power and cooling distribution, not how many kilowatts a single cabinet can shed.
Density is where this becomes a real conversation. A cabinet averaging 3 to 5 kW is unremarkable for most facilities. GPU hosts, dense compute, or heavily populated blade chassis can push a single cabinet well past that, and above roughly 10 to 15 kW you're in territory where the facility's per-cabinet cooling capacity needs explicit confirmation rather than assumption. Ask what they support per cabinet at your intended density, and whether higher-density cabinets are placed differently on the floor.
Start by inventorying every device with both its U height and its nameplate wattage, including network gear and anything rack-mounted that isn't a server. Estimate realistic sustained draw rather than the nameplate sum, then add your 12 to 24 month growth buffer to both the space and power figures.
Next, translate that into the provider's units. Ask whether billing is driven by U space, power allocation, or both, and which one your configuration will hit first, because that's the number that determines what you're actually buying. Confirm whether a quoted amperage is breaker rating or usable continuous capacity, and how A and B feeds are billed.
Finally, confirm the fit on the physical details: usable U count in the specific cabinet fraction you're renting, cabinet depth against your deepest server, per-cabinet cooling capacity at your density, and what the upgrade path looks like if you outgrow the allocation. Those sit alongside the broader question of where the facility should be in the first place. A provider who can answer the upgrade question concretely, whether that's adding an amp allocation in place or moving to a larger footprint, is worth more than one who quotes a slightly lower price and leaves that open.
The same two constraints govern every later decision, but the inputs shift in ways that catch people out. A hardware refresh is the clearest case: replacing older 2U servers with current 1U models can halve your rack space while raising draw per U, so you free up space you can't actually use and reach the power ceiling sooner than the U count suggests.
Renewal is the other moment that deserves a real recalculation rather than a rollover. Measure actual draw at the PDU across a normal week instead of reusing the estimate you built from spec sheets, because the gap between the two is usually wide. Running consistently well under your allocation is a negotiating position; sitting near the derated ceiling is a warning worth acting on before it becomes an incident.
Growth eventually forces a choice between adding a second cabinet and consolidating into a larger one. Two quarter racks in different parts of a facility cost more in cross-connects and cabling complexity than a single half rack, so if the provider can move you into contiguous space it's worth asking about that before defaulting to a second cabinet somewhere else on the floor.
Renting a full rack "just in case" is the most common and the most expensive, because power allocation is billed whether or not you draw it. Starting smaller with a documented upgrade path almost always costs less over two years.
Underestimating power is the mirror error, and it's worse operationally than financially: hitting a hard cap mid-deployment means either an unplanned upgrade on the provider's timeline or splitting equipment across non-adjacent cabinets, which complicates cabling and cooling both.
Two smaller ones are worth naming. Forgetting derating means planning around a breaker number you can't continuously use. And treating a facility's headline power density as guaranteed availability for your specific cabinet, rather than a facility-wide capability that varies by location on the floor, leads to an unpleasant surprise at install time. Both are avoided by asking directly rather than reading the marketing page.
Sizing a cabinet comes down to two numbers checked against each other: the U space your equipment occupies, and the sustained power it actually draws with derating and redundancy accounted for. Whichever one you hit first is your real constraint, and it's frequently power.
Get those two figures right, add a realistic 12 to 24 month buffer rather than a five-year guess, and confirm the billing model and cooling capacity before signing. That's most of the difference between a cabinet that serves you for years and one you're renegotiating in six months.
Thanks for reading! Whether you're sizing a first cabinet or resizing one you've had for years, xTom offers colocation alongside enterprise-grade dedicated servers, NVMe-powered KVM VPS through V.PS, IP transit, shared hosting, and general IT services for whatever else your infrastructure needs.
Ready to discuss your infrastructure needs? Contact our team to explore the right solution for your projects.
Work out both your U requirement and your sustained power draw, add a 12 to 24 month buffer, and see which constraint you hit first. If your equipment fits comfortably in 10U but draws more than a quarter rack's power allocation, the power figure is what decides it.
Frequently, yes, particularly with modern dual-socket servers. It's common to exhaust a power allocation with half the cabinet still physically empty, which is why sizing on server count alone tends to mislead.
Nameplate is the maximum the power supply is rated for, while actual sustained draw for a general-purpose server often lands somewhere around 40 to 70 percent of that under normal load. Size against realistic sustained draw with headroom rather than either extreme.
No, and treating it that way removes the redundancy you're paying for. Each feed needs to be able to carry your full load alone, so your usable capacity is effectively one feed's worth. Billing practice varies between the higher feed and the combined total, so confirm it with the provider.
Continuous load is generally limited to 80 percent of a circuit's rating, so a 20 amp circuit supports about 16 amps sustained. Planning against the breaker number rather than the derated number is a common way to end up tripping circuits under normal operation.
Yes, rather than rolling over the same allocation by default. Measure actual draw at the PDU over a normal week, since a hardware refresh can change your power profile substantially even when the U count stays the same, and the measured figure is usually well below the estimate you originally sized against.
Twelve to 24 months is the practical range. Beyond that you're usually paying for capacity that will be filled by hardware you haven't specified yet, and hardware density changes enough that a five-year projection rarely holds.
]]>A BGP route leak can silently reroute a meaningful share of internet traffic through the wrong network for hours before anyone notices. Here's what a route leak actually is, and how operators monitor for one.
]]>A hijack is usually someone announcing address space they don't hold. A leak is usually someone announcing space they legitimately learned about, to a network they shouldn't have announced it to. The first is often malicious; the second is almost always a filter that wasn't there.
This piece covers the mechanics of a leak, why they keep happening, how detection actually works, and what an operator can do both to avoid causing one and to find out quickly when their own routes get caught in someone else's.
Routing on the internet follows commercial relationships as much as topology. A network has customers who pay it for transit, peers it exchanges traffic with at no charge, and upstream providers it pays. Which routes get announced to which of those parties is governed by convention: routes learned from one upstream generally shouldn't be re-announced to another, because doing so offers to carry traffic between two networks you have no business carrying.
A route leak is the violation of that convention, and RFC 7908 is worth reading for its taxonomy of the specific patterns these take. The classic case is a multi-homed network that accidentally announces routes learned from Upstream A to Upstream B. Suddenly it appears to offer transit between two large networks, and because the announcement is valid in every technical sense, traffic starts flowing through it.
The consequences follow from capacity. A network sized for its own traffic is now receiving some portion of the traffic between two much larger networks, so links saturate, latency climbs sharply, and packets get dropped. Traffic that should have taken a direct, well-provisioned path is instead squeezed through a much smaller one, and the affected prefixes see degradation or outright unreachability until the announcement is withdrawn.
The proximate cause is nearly always missing or incorrect export filtering. A BGP session without an explicit outbound policy will happily announce everything in the routing table, and default configurations on some platforms are more permissive than operators expect.
Complexity and change are the aggravating factors. A network with one upstream is hard to leak from; a network with two upstreams, three peers, and an internet exchange connection has many more places where a policy has to be correct, and each new session is an opportunity for an inconsistency. Leaks frequently follow a configuration change, a maintenance window, or the addition of a new peer, which is worth knowing because it tells you when to be watching.
There's also a structural reason this persists: the network that leaks is often not the network that suffers most. A small operator's misconfiguration can degrade traffic between two large networks and their customers, and since the consequences land elsewhere, the incentive to invest in careful filtering is weaker than the harm would suggest. That asymmetry is much of why the industry has pushed toward automated filtering and third-party detection rather than relying on every operator's diligence.
Detection is fundamentally an external exercise. You cannot see a leak of your own prefixes from inside your own network, because your view of BGP is what your neighbors tell you, not what the rest of the internet is hearing.
The infrastructure that solves this is a network of vantage points. Projects and services collect live BGP data from routers and collectors in many places around the world, building a picture of what announcements look like globally rather than locally. That collected view is what makes anomalies visible.
The signals that indicate a leak are mostly comparative. An AS appearing in the path for a prefix it has never carried before is the primary one, particularly when that AS sits in a topologically implausible position, such as a small network appearing between two large transit providers. A sudden change in AS path length across many observers, or a prefix that suddenly appears to have a new transit provider it has no relationship with, are variations on the same theme.
For an operator, the practical form this takes is alerting. Register your prefixes with a BGP monitoring service, define what a legitimate path for them looks like, and receive a notification when an unexpected AS shows up in the observed path. That converts a problem you'd otherwise learn about from customer complaints into one you learn about from a monitoring alert.
Explicit outbound filtering is the foundation, and it's the first of the actions MANRS asks participating networks to commit to. Every BGP session should have a policy defining exactly which prefixes get announced to that neighbor, built from prefix lists, AS path filters, or automation driven by Internet Routing Registry data. The goal is that an accidental leak is structurally impossible rather than merely unlikely, and IRR-based automated filtering is the approach that scales as sessions multiply.
Max-prefix limits are the cheap safety net. Setting a reasonable ceiling on how many prefixes you'll accept from a session means that if a peer leaks a full table at you, the session tears down instead of your network propagating the problem onward. It's a few lines of configuration that turns a potential incident into a logged event.
Route origin validation via RPKI catches an adjacent category. It won't detect a leak that preserves the correct origin AS, which is most of them, but it does catch announcements with the wrong origin, and the two mechanisms together cover meaningfully more than either alone.
There's also a newer piece worth knowing about. RFC 9234, published in 2022, moves relationship signaling into BGP itself: peers negotiate a role (provider, customer, peer, route server, or route server client) when the session opens, and an Only to Customer attribute marks routes learned from a provider or peer so they can't be propagated where they shouldn't go.
The useful property is that it catches leaks in-band rather than depending on every operator's manual policy being correct, and it allows detection at a distance rather than only at the point of the mistake. It isn't universally deployed yet, but it's the direction this problem is being solved from, and it's worth asking upstreams whether they support it.
Confirm externally first. Check public looking glasses and BGP monitoring tools to see what the internet is actually hearing for your prefixes, since your own routers won't show you the problem. You're looking for an unexpected AS in the path and for how widely that path has propagated.
Then contact the offending network directly. Most operators publish NOC contact details through PeeringDB, and since the overwhelming majority of leaks are accidental, a specific and factual message tends to get a fast response. Include the prefixes involved, the AS path you're observing, and where you're observing it from; that's enough for a competent NOC to find their own misconfiguration quickly.
While waiting, look at what you control. If the leak is propagating to you through a particular upstream, your own filters and max-prefix settings determine whether you pass it along further. Announcing more specific prefixes can sometimes pull traffic back to the correct path as a temporary measure, though it's a blunt tool that adds routing table churn and is better treated as a short-term mitigation than a fix.
Afterwards, write down what happened. Leaks tend to recur from the same sources and through the same paths, and a short record of which prefixes were affected, which AS caused it, and which contact resolved it makes the next occurrence much faster to handle.
Route leaks are mostly honest mistakes with disproportionate consequences, caused by filtering that wasn't strict enough and found by monitoring that watches from outside your own network.
The defensive work splits cleanly in two. To avoid causing one, filter outbound announcements explicitly, set max-prefix limits, and treat every new session, and every block of address space you announce, as a policy to get right. To find out quickly when one affects you, register your prefixes with an external monitoring service so you hear about it from an alert rather than from a customer.
Thanks for reading! If your network relies on its own BGP sessions, xTom offers IP transit alongside enterprise-grade dedicated servers, colocation, NVMe-powered KVM VPS through V.PS, shared hosting, and general IT services for whatever else your infrastructure needs.
Ready to discuss your infrastructure needs? Contact our team to explore the right solution for your projects.
A hijack is announcing address space you don't hold, and it's often deliberate. A leak is announcing legitimately learned routes to a network you shouldn't have announced them to, usually because an export filter was missing, and it's almost always accidental.
Anywhere from minutes to hours, depending on how visible the disruption is and whether affected networks have monitoring in place. Operators with external BGP alerting typically find out in minutes; those relying on customer reports can take considerably longer.
No. RPKI validates which AS originated a prefix, and most leaks preserve the correct origin while inserting an extra network into the path. It catches wrong-origin announcements, so it's worth deploying, but it isn't a complete answer to leaks specifically.
Register them with a BGP monitoring service that collects data from many global vantage points and alerts you when an unexpected AS appears in the observed path. Monitoring from inside your own network can't detect this, since you only see what your neighbors tell you.
Fix the export filter immediately to stop the announcement, then verify externally that the leaked paths have withdrawn. If the disruption was significant it's worth notifying affected peers, since a promptly acknowledged and corrected misconfiguration is generally handled with understanding.
No. Any network's prefixes can be caught in a leak, and small networks are frequently the ones causing them. The scale of disruption tracks how much traffic gets pulled onto the wrong path rather than the size of the network that leaked.
]]>Rate limiting can slow down a determined attacker, but it isn't built to handle a genuine volumetric DDoS attack. Here's what DDoS scrubbing actually does differently, and when a server needs it.
]]>The distinction becomes expensive when you discover it during an incident: a carefully tuned application-layer rate limiter does nothing for a server whose uplink is already saturated, because the limiter never receives the traffic it was supposed to evaluate.
This piece covers where each one actually works, what scrubbing infrastructure does mechanically, the tradeoffs between always-on and on-demand approaches, and how to tell which layer your own risk sits at.
Rate limiting works at the application or server level. A request arrives, the limiter identifies the source, checks a counter, and decides whether to serve or reject it. That's genuinely useful against scrapers, credential stuffing, and API abuse from a misbehaving client.
Notice what the mechanism requires: the request has to arrive and be processed before a decision can be made. Rate limiting assumes your server has enough bandwidth to receive traffic and enough CPU to evaluate it, and that assumption is exactly what a volumetric attack removes.
A flood measured in tens or hundreds of gigabits per second, and modern attacks have reached well past that, saturates the link before your application sees anything. Your rate limiter is intact, correctly configured, and irrelevant, because the packets it was supposed to reject are already occupying all available capacity on the way in. Legitimate traffic is dropped by congestion rather than by policy.
Even below full saturation, some attack types exhaust resources other than bandwidth. Half-open connection floods consume connection table entries, and application-layer floods hitting expensive endpoints consume CPU and database capacity. Rate limiting helps against application-layer floods, where per-source judgment is exactly the right tool, and does relatively little against link saturation or connection-table exhaustion.
Scrubbing moves filtering upstream, away from the thing being protected. The core idea is that a link with 10 Gbps of capacity cannot defend itself against 100 Gbps of traffic, so the filtering has to happen somewhere with more capacity than the attack.
Mechanically, traffic destined for a protected address is diverted into a scrubbing center or a distributed scrubbing network, typically by announcing the prefix from the scrubbing provider's infrastructure via BGP, or by routing through a GRE tunnel or similar. Distributed scrubbing networks often lean on anycast here, spreading one address across many sites so an attack is absorbed in pieces rather than landing in one place. That infrastructure is provisioned with far more aggregate capacity than any single customer's uplink.
Inside, traffic is analyzed and filtered. The techniques stack: known attack signatures and spoofed-source packets are dropped, traffic is compared against a learned baseline of what normal looks like for that destination, protocol-level checks discard malformed or non-conforming packets, and challenge-response mechanisms distinguish real clients from simple attack tools. What survives is forwarded on to your actual server, usually over a dedicated path.
The important property is where the drop happens. Attack traffic is discarded while it's still on infrastructure sized to absorb it, so your uplink only ever carries what passed filtering.
Always-on scrubbing routes all your traffic through the scrubbing path permanently. Protection is immediate because there's no detection or diversion step, and the cost is a small, constant latency addition from the extra network hop, plus generally higher pricing since the provider carries your traffic continuously.
On-demand scrubbing leaves traffic on its normal path and diverts only when an attack is detected, either automatically from flow monitoring or manually. Baseline latency stays clean and cost is lower, but there's a window between the attack starting and the diversion completing, typically measured in seconds to a few minutes depending on detection method and BGP convergence, during which the attack reaches you.
The choice comes down to what that window costs. For a service where a few minutes of degradation is survivable, on-demand is a reasonable economic tradeoff. For payment processing, competitive gaming, or anything where brief unavailability has immediate revenue or reputational cost, always-on is usually worth the premium.
Rate limiting belongs at the application layer, where it has context scrubbing lacks. It knows which endpoint is expensive, which user is authenticated, and what a reasonable request rate looks like for your specific API. That contextual judgment is something upstream filtering can't replicate, because it doesn't know your application.
Scrubbing belongs upstream, where it has capacity your server lacks. It doesn't know or care what your application does; it knows how to absorb and discard a volume of traffic that would otherwise fill your pipe.
They're complementary rather than alternatives, and a well-protected setup runs both. Scrubbing handles the network-level flood, rate limiting handles the application-level abuse that survives filtering because it looks superficially legitimate, and each covers a gap the other has. Choosing one and skipping the other leaves an obvious hole in whichever direction you skipped.
The clearest signal is outage behavior. If you've seen incidents where the server became unreachable rather than merely slow, and monitoring showed the uplink saturated, that's a bandwidth-layer problem and no amount of application tuning addresses it.
Threat profile is the other input. Competitive gaming services, high-profile e-commerce, cryptocurrency-adjacent services, and anything that attracts organized hostility have historically drawn larger and more persistent attacks than a typical business site. So does anything where a competitor benefits directly from your downtime, which is a more common motive than people assume.
Uptime requirements matter independently of likelihood. If your service is contractually or commercially unable to absorb even a brief network-level outage, that argues for always-on protection regardless of how probable an attack is, because the cost of the tail event dominates the calculation.
There's also a capacity-ratio point worth naming alongside those. If your total uplink is 1 Gbps, even a modest attack by contemporary standards exceeds it, so headroom is a separate input from likelihood: a small deployment nobody targets may never need scrubbing, while a small deployment that does get targeted hits the wall faster than a larger one would.
Rate limiting and scrubbing solve different problems, and neither substitutes for the other. Rate limiting is contextual judgment applied at your application, bounded by your own capacity. Scrubbing is volume absorption applied upstream, bounded by infrastructure much larger than yours.
Work out which layer your actual risk sits at: whether your bad days look like a saturated uplink or like an expensive endpoint being hammered. That answer tells you where to spend, and in many cases the honest answer is both, with the balance set by how much a few minutes of downtime genuinely costs you.
Thanks for reading! If you're weighing DDoS protection for a growing service, xTom offers enterprise-grade dedicated servers and colocation alongside NVMe-powered KVM VPS through V.PS, IP transit, shared hosting, and general IT services for whatever your infrastructure needs next.
Ready to discuss your infrastructure needs? Contact our team to explore the right solution for your projects.
No, they work at different layers. Rate limiting evaluates requests at your server, which requires the traffic to arrive first. Scrubbing filters upstream on infrastructure with far more capacity than your uplink, discarding attack traffic before it reaches you.
Always-on scrubbing adds a small constant amount, since traffic takes an extra hop through the scrubbing network. On-demand avoids that baseline cost but introduces a detection and diversion window at the start of an attack, during which traffic reaches you unfiltered.
No. Once the uplink is saturated, legitimate and attack traffic are both dropped by congestion before your application processes anything. Rate limiting only acts on requests that actually arrive.
It depends on threat profile and downtime tolerance rather than size. A smaller deployment often has less bandwidth headroom, so it can be overwhelmed by a smaller attack, but many low-profile sites are adequately served by rate limiting and their provider's baseline protections.
Through layered techniques: signature matching against known attack patterns, spoofed-source detection, comparison against a learned baseline of normal traffic for the destination, protocol conformance checks, and challenge-response methods that simple attack tools fail.
Yes, in most serious setups they're complementary. Scrubbing absorbs the volumetric flood, and rate limiting handles application-layer abuse that passes filtering because individual requests look legitimate.
]]>RPKI has gone from a nice-to-have to something more networks expect from their BGP peers. Here's what it actually does, how it works, and why it's becoming a baseline expectation rather than an edge case.
]]>It doesn't scale to a global network of tens of thousands of autonomous systems, and the gap has real consequences: for decades, any network could announce a route to address space it didn't hold, and the rest of the internet would largely believe it.
RPKI is the mechanism that closes the most exploitable part of that gap, and it's shifted from optional hygiene to something an increasing number of networks require before they'll accept a peer's routes at all.
BGP works by networks announcing which address blocks they can reach. Your network tells its neighbors "traffic for this prefix can come to me," those neighbors tell their neighbors, and the path propagates outward until most of the internet knows how to reach you.
There's no verification step anywhere in that process. Nothing in the protocol checks whether the network making the announcement actually holds the address space, which means a misconfiguration or a deliberate false announcement propagates the same way a legitimate one does.
When that happens, traffic follows the false path. Depending on where the announcement spread and how specific it was, a hijack can pull anything from a trickle to the majority of traffic for an affected prefix into the wrong network, where it can be dropped, inspected, or silently delayed. Historically, some incidents have persisted for hours, because detection depended on someone noticing and raising the alarm manually.
RPKI stands for Resource Public Key Infrastructure, and its architecture is defined in RFC 6480. It attaches cryptographic proof of address holdership to the routing system, using the existing hierarchy of Regional Internet Registries as the root of trust.
The central object is the Route Origin Authorization, or ROA. A ROA is a signed statement from the legitimate holder of an address block saying which autonomous system number is authorized to originate routes for that block, and up to what prefix length. Because the RIRs already know who holds which address space, they're in the right position to anchor those signatures.
The consuming side is Route Origin Validation, or ROV. A network running ROV pulls published ROA data, checks each BGP announcement it receives against it, and classifies the result as valid (an ROA exists and the announcement matches), invalid (an ROA exists and the announcement contradicts it, wrong origin AS or too specific a prefix), or not found (no ROA covers the prefix). Policy is then applied to those states, and the now-common configuration is to reject invalid announcements outright while still accepting not-found ones.
That last detail explains the current transition period. Because "not found" is still widely accepted, unsigned prefixes keep working today, so the pressure to sign comes from the protection side rather than from immediate breakage: an unsigned prefix is one nobody can validate, leaving you dependent on someone noticing a hijack by hand. The flip side is that signing badly is worse than not signing at all, which makes care rather than speed the priority.
Adoption followed a familiar pattern: a slow start while the tooling matured, then acceleration once large networks moved. Several of the largest cloud providers, content networks, and transit providers now perform ROV and drop invalid routes at their edges, and a number of internet exchanges apply validation on their route servers.
That changes the calculus for everyone else. When a meaningful share of the internet rejects invalid announcements, an incorrectly signed prefix doesn't degrade gracefully, it becomes unreachable from those networks. The risk moved from "hijacks are someone else's problem" to "my own configuration errors now have immediate consequences."
It also shows up contractually. Peering and transit agreements increasingly reference route origin validation, and some peering policies expect valid ROAs as a condition, with industry initiatives like MANRS publishing the baseline actions participating networks commit to. For a network operator, RPKI has quietly become part of the baseline expected of a competent peer rather than a security enhancement to consider later.
If you hold your own address space and run BGP, whether that's on dedicated servers, in a colocation cabinet, or across your own IP transit, creating ROAs for your prefixes is now part of basic operational hygiene. Without them, your announcements are treated as not found, which still works today but leaves you outside the validation system that increasingly governs routing decisions.
If you're a typical VPS or dedicated server customer using your provider's address space, RPKI is largely invisible and handled on your behalf. Your provider signs the prefixes it announces, and nothing about your configuration needs to change.
The middle case is worth calling out, because it's where mistakes cluster: customers who bring their own address space to a provider, or who announce a prefix through more than one upstream. Those setups need ROAs that account for every AS legitimately originating the prefix and every prefix length actually announced, and getting either wrong is the most common way operators break their own reachability.
Start by confirming what you hold and where. Your address blocks and AS number are registered with a Regional Internet Registry, RIPE NCC, ARIN, APNIC, LACNIC, or AFRINIC, and that's where your RPKI records live too.
Create your ROAs through the RIR's hosted RPKI portal, which is the right choice for most operators; running your own delegated certificate authority is possible and mostly worth it at larger scale. For each prefix, specify the originating AS number and the maximum prefix length you intend to announce. If you announce a /22 and never anything more specific, set max length to 22. If you legitimately announce /24s out of that /22, the ROA needs to permit /24.
Then verify rather than assume. Public RPKI validator tools will show you how your prefixes currently evaluate, and checking from outside your own network confirms the data actually propagated. Give it time, since validator caches refresh on a schedule rather than instantly.
Finally, make it something you monitor. A ROA that was correct when created can become wrong when you start announcing a new, more specific prefix or change upstreams, and the symptom is your own traffic disappearing from validating networks. Checking validation state as part of any routing change is a small habit that prevents a self-inflicted outage.
The single most frequent RPKI error is setting maximum prefix length too tightly. Signing a /22 with max length 22 feels like the conservative choice, and it is, right up until you need to announce a /24 out of that block for traffic engineering, to work around an issue, or to multi-home a portion of the space.
At that moment, the more specific announcement evaluates as invalid rather than not found, and networks doing ROV discard that route. They still hold the valid /22 covering it, so traffic doesn't vanish: it falls back to the /22 path, quietly defeating whatever traffic engineering or multi-homing the /24 existed to do. Where no valid covering route exists, the destination simply becomes unreachable from those networks.
The balanced approach is to set max length to the most specific prefix you realistically expect to announce, rather than either the exact current announcement or something permissively broad. Too tight breaks legitimate future announcements; too loose reduces the protection ROAs provide against a hijacker announcing a more specific route out of your space.
RPKI addresses a structural gap in BGP that went unfixed for decades, and enough of the internet now validates that having correct ROAs has become a practical requirement rather than a security nicety.
For operators announcing their own space, the work is modest: create ROAs through your RIR, set max prefix length with future announcements in mind, verify externally, and re-check whenever your routing changes. That's a small amount of ongoing attention against an outage mode that's entirely self-inflicted and entirely avoidable.
Thanks for reading! If your infrastructure runs its own BGP sessions, xTom offers IP transit alongside enterprise-grade dedicated servers, colocation, NVMe-powered KVM VPS through V.PS, shared hosting, and general IT services for whatever else your network needs.
Ready to discuss your infrastructure needs? Contact our team to explore the right solution for your projects.
Not if you're using your provider's IP addresses, since they sign the prefixes they announce. It becomes your responsibility if you bring your own address space and announce it over BGP yourself.
RPKI is the cryptographic framework and the signed Route Origin Authorizations it produces. Route Origin Validation is what a network does with that data: checking received announcements against published ROAs and applying policy, typically rejecting invalid ones.
No. It validates that the correct AS originated a prefix, which covers a large share of real incidents, but it doesn't verify the rest of the AS path. A leak that preserves the correct origin while routing traffic through an unintended network can still pass origin validation.
If it's too tight, any more specific announcement you make later evaluates as invalid and gets dropped by validating networks, which can be worse than having no ROA at all. Set it to the most specific prefix you realistically expect to announce.
Public RPKI validator tools let you look up any prefix and see its current validation state and the ROA behind it. Check from outside your own network, and allow time for validator caches to pick up newly published records.
Not mandatory in a formal sense, but enough large networks and internet exchanges now reject invalid routes that valid ROAs have become a practical requirement for reliable global reachability, and some peering policies reference it directly.
]]>xTom launches colocation and custom server services at Equinix NY2 in the New York metropolitan area.
]]>Equinix NY2 is located at 275 Hartz Way in Secaucus, New Jersey. xTom operates its network at the site under AS949, with upstream connectivity from Global Secure Layer.
The colocation service allows customers to house their own hardware at NY2. Customers requiring dedicated servers can discuss configurations with xTom based on their compute, storage and network requirements. IP transit and remote hands services are also available at the site.
Facility and network information is available on xTom's New York location page. Colocation and custom server enquiries can be submitted through the company's contact page.
]]>xTom opens an additional Frankfurt node at MK Netzdienste Datacenter, offering colocation, custom servers, VPS and IP transit.
]]>The facility is located at Wilhelm-Fay-Straße 23, 65936 Frankfurt am Main. It adds a second facility to xTom's Frankfurt presence, alongside Digital Realty FRA13.
Customers can place their own equipment at the new site through xTom's colocation service or request dedicated servers configured to their requirements. VPS is available for customers who need virtual servers, while IP transit provides bandwidth for customer networks.
Details of xTom's facilities and network in the city are listed on its Frankfurt location page. Customers can submit deployment requirements and service enquiries through the company's contact page.
]]>Anycast lets a single IP address be announced from many locations at once, routing users to the nearest one automatically. Here's how it actually works, where it's used, and what it takes to run it yourself.
]]>Anycast breaks that assumption entirely: the same IP address can be announced from data centers on different continents at the same time, and the internet's routing system quietly sends each visitor to whichever one is closest. It sounds like a trick, but it's a well-established technique that powers some of the most critical infrastructure on the internet, and understanding it makes a lot of modern network architecture click into place.
Anycast is a network addressing method where multiple, physically separate servers share the same IP address, and routers determine which one a given request actually reaches. Instead of one server owning an address, several do, each announcing it from its own location using BGP (Border Gateway Protocol), the routing protocol that decides how traffic moves between networks.
When a user's request goes out looking for that IP address, it doesn't get sent to a fixed destination. It follows whatever path BGP considers "closest," which in practice usually means the fewest network hops, not necessarily the shortest physical distance.
The user has no idea multiple servers exist behind that single address; from their side, it looks exactly like talking to one machine. This is fundamentally different from a CDN's typical approach of using DNS to hand out different IP addresses to different users; with Anycast, everyone gets the exact same address, and the network layer itself does the routing.
The mechanism relies entirely on how BGP already operates. Every server location (or "node") in an Anycast setup announces the same IP range to the internet's routers, using a technique that's otherwise unremarkable in BGP: multiple networks claiming they can reach a destination, and routers picking the best-looking path.
Here's the sequence in practice:
If one of those locations goes offline, its BGP announcement stops, and traffic that would have gone there automatically reroutes to the next-best location. No manual failover, no DNS changes, no propagation delay to wait out. That's the other major reason Anycast is so widely used: the "failover" is a routing table update, not an application-level event.
One detail that surprises people learning about Anycast for the first time: it works fine for connectionless protocols like DNS (which runs over UDP) but gets more complicated for stateful, connection-based protocols like a typical HTTPS session over TCP. If BGP routing changes mid-connection and a user's traffic suddenly gets routed to a different physical server than the one that started the TCP handshake, that connection can break, since the new server has no memory of the session.
In practice, BGP paths are usually stable enough during a single connection's lifetime that this isn't a constant problem, and large-scale Anycast CDN operators manage it further with techniques like consistent hashing and careful route engineering. But it's the reason Anycast is most reliably used for short-lived, stateless requests (DNS lookups, the initial connection to a CDN edge) rather than assumed to be a perfect fit for every kind of traffic without any additional engineering.
Anycast isn't a niche or experimental technique. It's the backbone of several systems most people rely on daily:
Public DNS resolvers. Services like Google's 8.8.8.8 and Cloudflare's 1.1.1.1 use Anycast so that a query sent from Tokyo and one sent from Berlin both hit a "local" server, even though it's technically the same address.
Root DNS servers. The internet's 13 root DNS server addresses are each Anycasted across hundreds of physical locations worldwide, which is the only reason the entire DNS system doesn't collapse under a single point of failure. What looks like 13 servers on paper is actually many hundreds of physical machines behind the scenes.
Content delivery networks (CDNs). CDNs use Anycast to route users to the nearest edge node without needing per-user DNS logic, though many also layer additional geo-DNS or latency-based routing on top for finer control.
DDoS mitigation. Because Anycast spreads incoming traffic across many locations automatically, a volumetric attack against one IP gets naturally distributed across every announcing location instead of overwhelming a single server. This "scrubbing" effect is one of the main reasons DDoS protection services rely on Anycast as a core part of their architecture, since it turns a concentrated attack into a distributed load problem across dozens of data centers at once.
In a standard unicast setup, one IP address maps to one server, in one location, full stop. If that server goes down, whatever's pointing at it, whether that's a DNS record or a hardcoded IP, needs to be updated or fail over manually (or through a separate health-check system) before traffic recovers.
Anycast shifts that responsibility down to the routing layer itself. The "failover" is really just BGP recalculating a path once a location stops announcing the address, which typically happens in seconds rather than the minutes a DNS TTL change might take. The trade-off is complexity: unicast is simple to reason about and debug, while Anycast requires understanding BGP behavior across potentially many networks you don't directly control.
It's worth distinguishing Anycast from GeoDNS, since they solve a similar-sounding problem differently. GeoDNS answers DNS queries with different IP addresses depending on where the query appears to originate, sending European users to a European IP and Asian users to an Asian IP.
Anycast, by contrast, hands out the exact same IP address to everyone, and routing (not DNS) decides where the traffic actually goes. GeoDNS is simpler to set up (no BGP, no ASN required) but depends on DNS resolvers reporting accurate location data, which isn't always reliable.
Anycast is more complex to operate but reacts to network conditions in real time rather than relying on DNS lookups that get cached and can go stale.
Setting up Anycast isn't something you configure on a single VPS. It requires:
For most individual websites and small applications, a straightforward unicast IP with a good hosting provider and, if needed, a CDN in front of it, is plenty. Anycast tends to matter most for services that are either latency-critical at a global scale (DNS, real-time APIs) or need serious resilience against distributed denial-of-service traffic.
If you're not running your own network infrastructure with an ASN already, using a CDN or DDoS protection provider that already operates Anycast infrastructure is a far more practical way to get its benefits than building it yourself. If you do have your own ASN and just want a lighter way to run the sessions, look for a provider that supports BGP on VPS plans rather than requiring dedicated hardware in every city, a middle ground between fully outsourcing to a CDN and building dedicated infrastructure everywhere.
Anycast is one of those pieces of internet infrastructure that works so well most people never think about it, right up until they need to understand why a DNS query "just works" no matter where in the world it's sent from. It's not something every project needs to run itself, but understanding how it works makes a lot of modern network architecture, from CDNs to DDoS protection, much easier to reason about.
Thanks for reading! If you're looking to run this yourself, xTom supports BGP and Anycast sessions on dedicated servers, colocation racks, and VPS plans across its eleven locations, bring your own ASN and prefixes, and xTom peers with you. Beyond that, xTom provides enterprise-grade dedicated servers, colocation services, and IP transit, while V.PS offers scalable, production-ready NVMe-powered VPS hosting perfect for any workload.
Not exactly. A load balancer distributes traffic among servers that are usually in the same location. Anycast distributes traffic among servers in different physical locations, based on network routing rather than a load balancer's own logic.
Technically yes, but it requires owning your own IP address space and running BGP sessions with multiple network providers, which is far more infrastructure than most small sites need. Most smaller projects get similar benefits more easily through a CDN or DDoS protection service that already runs Anycast on your behalf.
No. It routes based on BGP path preference, which usually correlates with geographic proximity but is really about network topology, not physical distance. A user could occasionally be routed to a location that isn't the geographically nearest one if that path scores better in BGP.
Routers pick one based on their own tie-breaking rules, which can vary by network. In practice, this rarely causes noticeable problems since both locations are, by definition, serving identical content.
Yes, in almost all real-world setups. Anycast requires announcing IP space over BGP, which means you need your own autonomous system number (ASN) and IP allocation, not something a typical shared hosting plan includes. You don't necessarily need dedicated or colocation hardware to run the session itself though; xTom, for example, supports BGP sessions on VPS plans in select locations, not just dedicated servers and colocation.
It can, but it requires more careful engineering than DNS-style Anycast, since a mid-connection routing change can break an active TCP session. Large Anycast CDN operators manage this with route engineering and consistent hashing; it's not something that works flawlessly out of the box for every protocol.
GeoDNS hands out different IP addresses based on a visitor's apparent location, using DNS. Anycast gives every visitor the same IP address and lets network routing, not DNS, decide which physical server they actually reach.
]]>Docker built the container ecosystem, but Podman has become a serious daemonless alternative. Here's how they actually differ, with real commands, and which one fits your setup.
]]>But Podman has been quietly maturing into a genuine alternative, especially for anyone who's ever been annoyed by Docker's background daemon, a licensing change for Docker Desktop, or a container crash that took down every other container on the same host with it. So which one should you actually be running on your server in 2026?
Docker popularized the modern container format starting in 2013, building on existing Linux kernel features (namespaces and cgroups) and wrapping them in a developer-friendly toolchain. It became so dominant that "container" and "Docker" were used interchangeably for years, and the image format it popularized eventually became the OCI (Open Container Initiative) standard that every other container tool, Podman included, now builds on.
Podman emerged later, developed by Red Hat as part of its broader containers ecosystem (alongside Buildah and Skopeo), specifically to address architectural concerns with Docker's daemon-based model. It's been the default container engine in Red Hat Enterprise Linux and Fedora for several years now, which has driven a lot of its real-world adoption outside of hobbyist self-hosting circles.
Docker is the container platform that popularized the format most of the industry still uses. It runs as a background daemon (dockerd) that manages images, containers, networks, and volumes, and you talk to it through the docker command-line client, which sends requests to the daemon over a Unix socket. Nearly every tutorial, Compose file, and CI pipeline on the internet assumes Docker, which is still its biggest practical advantage.
Podman is an open-source container engine developed by Red Hat, designed to be a drop-in replacement for most Docker commands. The core difference is architectural: Podman doesn't use a central daemon. Each container runs as a direct child process of the command that started it, managed through the conmon process monitor, which means there's no single background service that, if it crashes, takes every running container down with it.
Podman also supports rootless containers more thoroughly out of the box, letting you run containers without root privileges in a way that's genuinely production-ready rather than an afterthought bolted on later.
Architecture. Docker relies on a long-running daemon with root privileges by default. Podman is daemonless, running containers as regular processes under whichever user started them, using fork/exec rather than a client-server model.
Command compatibility. Podman was built to mirror Docker's CLI closely. Most docker commands work if you just type podman instead, and you can even create a shell alias (alias docker=podman) on many systems so existing scripts and muscle memory keep working.
Rootless by default. Docker added rootless mode later as an option; Podman was designed around it from the start, which matters if you're running containers on a shared or security-sensitive server, since a compromised rootless container can't escalate to root the way a compromised container under a root-owned daemon potentially could.
Compose support. Docker has native Docker Compose. Podman supports Compose files too, either through the separate podman-compose tool or Podman's own built-in Compose provider (podman compose), though compatibility isn't always perfect for more complex, multi-network setups.
Systemd integration. Podman can generate systemd unit files directly from running containers (podman generate systemd) or manage containers as native systemd services using Quadlet files, which makes it a natural fit if you already manage services with systemd rather than a separate orchestration layer.
Pods. Podman borrows the Kubernetes concept of a "pod," a group of containers that share network and storage namespaces, which can be useful if you're testing something that will eventually run on Kubernetes. It also supports podman generate kube to export a running pod as a Kubernetes YAML manifest directly.
Image building. Docker builds images with docker build, using its own build engine (or BuildKit). Podman defers to Buildah for building images, which can be used directly for more granular control, or through the familiar podman build command for standard Dockerfile builds.
If you're following tutorials that assume Docker, working on a team that's standardized on it, or relying on tools and CI systems built specifically around the Docker API (some CI runners and IDE integrations assume dockerd is present), sticking with Docker avoids friction. The ecosystem advantage is real, and for a lot of self-hosted setups, that compatibility matters more than the architectural differences.
If you've been burned by a daemon crash taking down every container on a box, or you're hosting on a system where you want to avoid giving any process root access by default, Podman solves both problems directly. It's also a reasonable default if you're setting up a fresh server today and don't have existing Docker-specific tooling to migrate, particularly on RHEL-family distributions where it's already the system default.
Most major Linux distributions package Podman directly. On Debian or Ubuntu:
sudo apt update
sudo apt install podman
From there, most of your existing docker run commands will work unchanged with podman run. A basic rootless container looks identical to its Docker equivalent:
podman run -d --name webserver -p 8080:80 nginx
If you're using Compose files, install podman-compose and test your stack before committing to a full migration:
pip install podman-compose
podman-compose up -d
Not every Compose feature has full parity yet, particularly around complex multi-network configurations, so it's worth running your actual stack in a test environment before switching production workloads over.
For a straightforward migration, most of the work is swapping the binary, not rewriting configuration. Existing Dockerfiles work unchanged since both engines build OCI-compliant images. Existing volumes can generally be reused by pointing Podman at the same host paths. The main adjustments tend to be around networking, since Podman's rootless networking uses a userspace network stack (slirp4netns or pasta) by default, which behaves slightly differently from Docker's kernel-level bridge networking, particularly around inter-container DNS resolution and exposing ports below 1024.
Neither engine is objectively better in every situation. Docker still has the larger ecosystem and the most tutorials written around it; Podman offers a more security-conscious, daemonless design that fits well on a server you're hardening carefully, and it's increasingly the default rather than the alternative on several major Linux distributions. If you're not sure, there's nothing stopping you from installing both and testing your actual workload on each before deciding.
Thanks for reading! If you're looking for a solid place to run either one, xTom provides enterprise-grade dedicated servers, colocation services, while V.PS offers scalable, production-ready NVMe-powered VPS hosting perfect for any containerized workload.
Yes, they can coexist, though it's rarely necessary. Most people install one or the other rather than running both in production, since managing two separate container runtimes adds operational complexity without much benefit.
Yes, through podman-compose or Podman's built-in Compose support, though very complex Compose files, particularly ones using advanced networking features, may need small adjustments.
Podman's rootless-by-default design reduces the attack surface if a container is compromised, since there's no root-owned daemon process to escalate into. Docker can also run rootless, but it requires extra configuration to get there, and a lot of existing Docker deployments still run the daemon as root.
Yes. Both use the OCI (Open Container Initiative) image format, so images built for Docker run on Podman without modification, and images can be pulled from the same registries (Docker Hub, GitHub Container Registry, and others).
Either works well for a small server. If you want maximum compatibility with existing guides, use Docker. If you'd rather avoid a root daemon and prefer tighter systemd integration, Podman is worth the switch.
No. While Podman is the default on RHEL, Fedora, and CentOS Stream, it's packaged and fully supported on Debian, Ubuntu, Arch, and most other major Linux distributions.
Yes. Podman can generate systemd unit files from a running container, or you can define containers directly as Quadlet files, which systemd manages natively without a separate container orchestration layer.
]]>ntfy is a simple, open-source notification service you can run yourself. Here's how to self-host it, lock it down, and start sending push notifications straight to your phone from your own scripts and services.
]]>Email can technically do the job, but it's slow to check, easy to bury in a crowded inbox, and prone to landing in spam when it's sent from a script instead of a proper mail server. That's usually the point people start looking at dedicated push notification services instead, though the good ones tend to come with a monthly cost once you're sending more than a handful of alerts.
If you'd rather keep that entire pipeline under your own control, ntfy is worth a look. It's a small, open-source publish-subscribe notification tool you can self-host on your own server, simple enough to get running in under ten minutes, with enough depth underneath to grow into something more serious as you lean on it more.
ntfy (pronounced "notify") is an HTTP-based pub-sub notification tool. You send a message to a "topic" with a simple HTTP request, curl command, or one-line script, and anyone subscribed to that topic, usually through the ntfy mobile app, gets a push notification instantly. There's no account system required and no message queue to configure. A topic is just a name; if you know it, you can publish or subscribe to it.
Under the hood, ntfy is written in Go and ships as a single small binary or Docker image, which is part of why it's so easy to run on hardware that's already doing other things.
You can use the free hosted version at ntfy.sh without installing anything, but self-hosting it means your notifications never pass through a server you don't control, you're not relying on someone else's free-tier rate limits staying generous, and you can add access control, retention policies, and integrations that suit your own setup rather than a generic public service.
Set up a folder to keep your ntfy configuration and data separate from everything else on the server:
mkdir -p ~/ntfy/cache ~/ntfy/etc
cd ~/ntfy
Create a docker-compose.yml file with the following contents:
services:
ntfy:
image: binwiederhier/ntfy
command:
- serve
environment:
- TZ=UTC
volumes:
- ./cache:/var/cache/ntfy
- ./etc:/etc/ntfy
ports:
- "80:80"
restart: unless-stopped
Adjust the port mapping if you're planning to put ntfy behind a reverse proxy, which is the better long-term setup if you're exposing it to the internet rather than using it purely on a local network.
docker compose up -d
That's the whole installation. ntfy is now running and listening for requests. If you'd rather skip Docker entirely, ntfy also ships as a single Go binary with packages for most major Linux distributions, which can be a better fit for a lightweight VPS where you don't want to run a container runtime just for one small service.
If you want to reach your ntfy server from your phone over the internet, don't leave it on plain HTTP. Point a subdomain like ntfy.yourdomain.com at your server and put it behind a reverse proxy with a Let's Encrypt certificate. A minimal Caddy configuration looks like this:
ntfy.yourdomain.com {
reverse_proxy localhost:80
}
Caddy handles the certificate automatically. If you're using Nginx instead, a basic server block looks like this:
server {
listen 443 ssl;
server_name ntfy.yourdomain.com;
ssl_certificate /etc/letsencrypt/live/ntfy.yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/ntfy.yourdomain.com/privkey.pem;
location / {
proxy_pass http://localhost:80;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_buffering off;
}
}
Putting ntfy behind HTTPS also makes it easier to add authentication later without sending credentials in plain text.
Once it's running, sending a notification is a single command:
curl -d "Backup job finished" ntfy.yourdomain.com/backups
Anyone subscribed to the backups topic, through the app or a browser tab, gets that message immediately. To subscribe from a phone, install the ntfy app (available for Android and iOS), add your server's URL, and subscribe to the same topic name.
By default, anyone who knows your server's address and a topic name can publish or read messages on it, which is fine for a quick test but not something to leave running long term. Enable access control by adding an auth-file and auth-default-access setting to /etc/ntfy/server.yml:
auth-file: "/etc/ntfy/user.db"
auth-default-access: "deny-all"
Then create a user and grant access to specific topics from inside the container:
docker exec -it ntfy ntfy user add myuser
docker exec -it ntfy ntfy access myuser backups rw
This restricts publishing and subscribing to authenticated users on a per-topic basis, which matters as soon as you're running ntfy on anything reachable from the public internet.
The basic curl example is enough to get started, but ntfy supports several headers that make notifications far more useful in practice:
curl \
-H "Title: Backup Job" \
-H "Priority: high" \
-H "Tags: warning,skull" \
-d "The nightly backup to the offsite server failed." \
ntfy.yourdomain.com/backups
This adds a title, marks the message as high priority (which can trigger a different notification sound), and attaches emoji-mapped tags for quick visual scanning. From Python, the same thing looks like this:
import requests
requests.post(
"https://ntfy.yourdomain.com/backups",
data="The nightly backup to the offsite server failed.",
headers={"Title": "Backup Job", "Priority": "high", "Tags": "warning,skull"}
)
Because it's just an HTTP request, you can trigger it from a cron job, a systemd service's OnFailure directive, a CI/CD pipeline step, or any monitoring tool that can make a web request, which covers nearly everything.
ntfy tends to become the connective tissue between other self-hosted services once it's running. Uptime Kuma can send alerts through ntfy directly as a notification provider. Home Assistant has a community integration for sending automation alerts the same way. Even a simple systemd unit can be configured to fire a notification on failure without any extra tooling, since it only needs curl to work.
ntfy supports more than plain text alerts, which is worth knowing before you write it off as too simple for a given use case:
If notifications aren't arriving on your phone, check that the app is actually subscribed to the exact topic name your scripts are publishing to, since topic names are case-sensitive and a typo is the most common cause.
If you've enabled access control and requests start failing with a 403 error, confirm the user has been granted access to that specific topic, not just created.
If you're running behind a reverse proxy and the app can't connect at all, verify that WebSocket connections are allowed through your proxy configuration, since some default Nginx setups block the upgrade headers ntfy needs for real-time delivery.
Once ntfy is running, it becomes one of those small pieces of infrastructure you end up using everywhere: CI/CD pipeline results, uptime monitor alerts, cron job failures, even a doorbell script if you're feeling ambitious. It's lightweight enough to run alongside other services on a single small VPS without noticing the resource usage, and once you've wired a handful of scripts to it, the ten minutes of setup pays for itself the first time it wakes you up about something that actually mattered.
Thanks for reading! If you're looking for a reliable place to run ntfy and the rest of your self-hosted stack, xTom provides enterprise-grade dedicated servers and colocation services, while V.PS offers scalable, production-ready NVMe-powered VPS hosting perfect for any workload.
Yes. ntfy is open source under an Apache 2.0/GPLv2 license, and running your own instance costs nothing beyond the server it's running on.
No, but it makes life easier. Without one, you'd be connecting to your server by IP address, which works but won't have a valid HTTPS certificate unless you set one up separately.
Yes. The official ntfy app lets you add a custom server URL instead of using the default ntfy.sh, so you can point it at your own instance.
Yes. It supports message priorities, attachments, action buttons, and scheduled delivery, so it can handle more than basic "job finished" alerts if you need it to.
Yes. You can enable an auth file and set a default-deny access policy, then grant specific users read or write access to individual topics, which is worth doing for anything exposed to the public internet.
Yes. It's distributed as a single Go binary and has packages for most major Linux distributions, which works well if you'd rather not add a container runtime for one small service.
]]>SQLite runs as a single file with no server process at all, and it handles far more real-world workloads than people assume. Here's how it works, when it's genuinely enough, and how to migrate later if you outgrow it.
]]>It's on your phone, in your browser, inside countless desktop apps, embedded in cars and appliances, and it's a genuinely reasonable choice for a lot of self-hosted projects that people default to a full database server for instead.
SQLite is a relational database that doesn't run as a separate server process at all. Instead of connecting over a network to something like mysqld or postgres, your application reads and writes directly to a single file on disk. There's no username, no password, no port to open, and nothing to configure before you can start running SQL queries.
The entire database engine is a library linked directly into your application, which is why the SQLite project describes itself as "serverless," a database with no server at all rather than a database running on someone else's server.
Despite that simplicity, SQLite supports the vast majority of standard SQL: transactions, joins, indexes, triggers, views, and full ACID compliance (atomicity, consistency, isolation, durability). It's not a stripped-down toy database; it's a fully capable one that just happens to skip the client-server architecture entirely. It's also one of the most widely deployed pieces of software in existence, since it ships inside every major web browser, most mobile operating systems, and a huge share of desktop applications, almost always invisibly.
The core difference is architectural, not really about SQL feature support:
No server process. PostgreSQL and MySQL run as background services that your application connects to, usually over TCP even for local connections. SQLite is embedded directly into the application itself, reading and writing to one file through a C library that gets linked at compile or runtime.
No network layer. Because there's no server to connect to, there's no authentication, no network configuration, and no separate process to keep running and monitor. This also means there's no network-based attack surface to secure, since there's nothing listening on a port.
Concurrency. This is SQLite's real limitation. It handles many simultaneous readers well, especially in WAL (write-ahead logging) mode, but only one writer at a time can modify the database, which is fine for most small-to-medium workloads but becomes a bottleneck for applications with heavy concurrent write traffic.
Portability. A SQLite database is one file. Backing it up means copying that file; moving it to another server means copying that file there too, no export/import step required in between.
Data types. SQLite uses "type affinity" rather than strict typing, meaning columns will generally accept values of any type unless you've added explicit constraints. This is more flexible than PostgreSQL's strict typing but can occasionally surprise developers coming from a stricter database background.
By default, older versions of SQLite used a rollback journal for transactions, which locks the entire database file during writes and blocks readers at the same time. Modern SQLite deployments almost always enable WAL (write-ahead logging) mode instead, which writes changes to a separate log file first and lets readers continue accessing the main database file without blocking.
This single setting change is responsible for most of the concurrency improvements that have made SQLite viable for a much wider range of production use cases than it was a decade ago. Enabling it is a single command:
PRAGMA journal_mode=WAL;
Most modern frameworks and self-hosted applications that use SQLite enable this by default, but it's worth confirming if you're setting up a database connection manually.
A surprising number of self-hosted applications and small projects fit comfortably within what SQLite handles well:
Personal and small-team tools. Self-hosted apps used by one person or a small team rarely generate enough concurrent write traffic to hit SQLite's single-writer limit. Many popular self-hosted apps, including several widely used note-taking, bookmarking, and monitoring tools, default to SQLite for exactly this reason, and some don't offer any other option at all.
Read-heavy websites and blogs. If your application reads far more often than it writes, which describes most content sites, SQLite's read concurrency in WAL mode is more than sufficient, and static site generators or lightweight CMS platforms built around SQLite can comfortably handle significant traffic.
Local development and testing. Spinning up a full database server just to run tests adds friction and CI pipeline time. SQLite lets you test against something that behaves like a real relational database with zero setup, often using an in-memory database (:memory:) that disappears the moment the test finishes.
Embedded and edge deployments. Anywhere you don't want to manage a separate database service, on a small VPS, in a container, on a Raspberry Pi, SQLite removes an entire moving part from your infrastructure, which also means one fewer service to monitor, patch, and back up separately.
Prototypes and MVPs. If you're not sure a project will get real traffic yet, starting with SQLite avoids over-provisioning infrastructure for a database server you might not end up needing, and it keeps local development frictionless while the schema is still changing frequently.
SQLite isn't the right choice for everything, and knowing the boundary matters:
High concurrent write volume. If multiple processes or many simultaneous users are writing to the database constantly, SQLite's single-writer model will eventually queue those writes and slow things down, even in WAL mode.
Multiple applications sharing one database. SQLite is built around a single application accessing its own file. If you need several separate services connecting to the same database over a network, you need a real database server that can manage concurrent client connections properly.
Very large datasets with complex querying. SQLite can handle databases in the tens of gigabytes without issue, and there are documented cases of it managing far larger datasets, but if you're running complex analytical queries against a genuinely large dataset with heavy joins, PostgreSQL's more sophisticated query planner and indexing options will scale further.
Built-in replication needs. If you need standard master-replica replication for redundancy or read scaling, that's native to PostgreSQL and MySQL in a way it isn't for SQLite, which relies on file-level backup or third-party tools for anything resembling replication.
Network access from remote clients. If something needs to query the database from a different machine over the network, SQLite isn't built for that use case at all; it assumes local file access.
One of the more persistent myths about SQLite is that choosing it locks you in. In practice, most frameworks that support SQLite also support PostgreSQL or MySQL through the same abstraction layer, meaning you can start on SQLite and migrate later if your write concurrency actually grows past what it can handle.
The migration itself is usually a matter of exporting the schema and data (most frameworks include tooling for this, or a straightforward .dump and reimport works for simpler schemas) and updating a connection string.
Starting with the simpler option and moving up when you have evidence you need to is a reasonable default, not a mistake, and it avoids paying the operational cost of a full database server before you actually need one.
Because the whole database is a single file, it's tempting to just copy it with cp, but that risks grabbing the file mid-write and ending up with a corrupted copy. SQLite's own backup mechanisms handle this safely:
sqlite3 mydb.sqlite ".backup 'backup.sqlite'"
This uses SQLite's online backup API, which safely copies the database even while it's actively being written to, and is the recommended approach over a raw file copy for anything beyond a quick manual snapshot.
SQLite gets overlooked because it doesn't look like a "real" database in the way a server process does, but that's exactly what makes it useful. For self-hosted tools, small applications, and anything that doesn't need heavy concurrent writes, it removes an entire service you'd otherwise need to install, secure, and maintain, while still giving you the full expressive power of SQL underneath.
Thanks for reading! Whether your app stays on SQLite or eventually grows into a full database server, it still needs somewhere solid to run. V.PS offers scalable, production-ready NVMe-powered VPS hosting that handles SQLite-backed apps just as well as it runs PostgreSQL, MySQL, or MariaDB, and xTom provides enterprise-grade dedicated servers, colocation, and more for workloads, SQLite or otherwise, that need dedicated resources.
For many small-to-medium sites, yes, particularly ones that are read-heavy. Several popular content management systems and self-hosted apps support SQLite in production for exactly this reason, especially once WAL mode is enabled.
Multiple readers can access a SQLite database simultaneously without issue, particularly in WAL mode. Writes are serialized, meaning only one write happens at a time, which is fine for lighter traffic but can become a bottleneck under heavy concurrent writes.
Since the entire database is a single file, backing it up is as simple as copying that file, ideally using SQLite's own .backup command or online backup API to avoid copying it mid-write.
It supports the core of standard SQL, including transactions and joins, but some advanced features and strict data typing differ. Most everyday queries work the same across all three.
It's usually manageable, especially if your application was built using a database abstraction layer or ORM. The SQL itself may need minor adjustments, but the underlying data model typically transfers with minimal changes.
Write-ahead logging (WAL) mode is a journaling mode that lets readers keep accessing the database while a write is in progress, instead of locking the whole file. It's a significant concurrency improvement over SQLite's older default journal mode, and most self-hosted apps that use SQLite enable it automatically.
It can, particularly for smaller teams or read-heavy applications, but it's not designed for high-concurrency, multi-writer workloads the way a dedicated database server is. Test your actual usage pattern before assuming either way.
]]>Every Linux system boots with the help of an init system, but the one running on your server today looks nothing like the one from a decade ago. Here's what actually separates traditional SysV init from systemd, and why it matters for how you manage services.
]]>systemctl status on a fresh server and wondered why it isn't service status or some old init script, you've bumped into one of the more debated shifts in Linux history. Init and systemd both do the same basic job: they get your machine from "just powered on" to "actually usable." How they go about it, though, is almost completely different, and that difference shapes how you troubleshoot boot problems, manage services, and think about the Linux boot process in general.
This article walks through what an init system actually is, how the older SysV init worked, what systemd changed, and how you can check and manage either one on a live server.
Every Linux (and Unix) system needs a first process. When the kernel finishes loading and mounting the root filesystem, it hands off control to a single program, and that program becomes PID 1. Whatever that program is, whether it's a decades-old shell script interpreter or a modern service manager, it's called the init system.
PID 1 has a few jobs that never change no matter which init system you're running. It starts all the other system services and daemons in the right order. It becomes the parent of any process whose original parent has already exited, which means it's responsible for "reaping" those orphaned processes so they don't pile up as zombies. And it stays alive for the entire life of the system, since if PID 1 dies, the kernel panics.
Historically, "init" referred to a specific program: System V init, often shortened to SysV init. These days, "init system" is more of a general term, and systemd is simply the init system most major distributions ship with by default.
SysV init traces back to Unix System V and was, for a long time, the standard init system across most Linux distributions, including older versions of Debian, Ubuntu, Red Hat, and CentOS. It works around the idea of runlevels, numbered states (0 through 6) that each correspond to a particular system configuration. Runlevel 0 means shutdown, runlevel 1 is single-user rescue mode, runlevel 3 is a full multi-user system without a graphical interface, runlevel 5 adds a GUI, and runlevel 6 triggers a reboot.
When the system enters a runlevel, init looks in the matching /etc/rc.d (or /etc/rcX.d) directory for a set of symbolic links pointing to shell scripts, then runs them in numeric order. Each of those scripts is a genuine shell script, often bash, that starts or stops a particular service by defining its own start, stop, and status logic. If you've wondered what other types of shells could be running a script like this, this is a good example of bash doing real system work, not just interactive typing.
That flexibility came at a cost. SysV init starts services sequentially: script two doesn't run until script one finishes, whether or not they depend on each other. On a machine with a dozen or more services, that adds up to a slow boot. Worse, init had no real concept of dependencies between services. If a database needed the network up first, that ordering had to be baked into filenames and symlink numbers by hand, and different distributions handled the details slightly differently, which made scripts hard to port.
systemd was introduced by Lennart Poettering and Kay Sievers around 2010, and Fedora was the first major distribution to adopt it, in 2011. Today it's the default init system on Ubuntu, Debian, Fedora, RHEL, and their downstream relatives like Rocky Linux and AlmaLinux. It's still PID 1 and still responsible for reaping orphans, so it satisfies the same basic definition of an init system, but the mechanics underneath are quite different.
Instead of shell scripts, systemd uses unit files: plain-text configuration files that declare what a service needs rather than scripting out how to start it. A typical .service unit might just list the executable to run, which user to run it as, and which other units it depends on. systemd reads those dependencies and builds a graph, then starts services in parallel wherever it can, only serializing the ones that genuinely need to wait on each other. That's the single biggest reason systemd boots faster than SysV init on most hardware.
Runlevels are replaced by targets, which are really just units that group other units together. multi-user.target roughly corresponds to the old runlevel 3, and graphical.target corresponds to runlevel 5, but targets are more flexible since a system can activate several at once and depend on each other. systemd also bundles functionality that used to live in separate tools: journald for centralized logging, socket and timer activation so services start only when needed, and tight integration with Linux namespaces and cgroups for tracking each service's processes. That cgroup integration is why systemd can reliably kill every process belonging to a service, even ones that fork children the original script never knew about.
For backward compatibility, systemd can still parse old SysV init scripts as a fallback, and distributions maintain service and other wrapper commands so muscle memory from the SysV era mostly still works. The official systemd documentation on freedesktop.org covers the full unit file syntax and manager behavior in detail if you want to go deeper than this article does.
Not everyone was thrilled about the switch, and it's worth mentioning briefly for balance. Critics have pointed out that systemd concentrates a lot of functionality, logging, device management, network configuration helpers, and more, into one project, which cuts against the traditional Unix philosophy of small tools that each do one thing. Some sysadmins also found early versions harder to debug than a plain shell script, since understanding a boot failure now sometimes means reading unit dependency graphs instead of just reading a script top to bottom.
That pushback is part of why alternatives like OpenRC and runit still exist and see real use, particularly on distributions such as Alpine Linux, Gentoo, and Void Linux. Both aim for simpler, more transparent init systems with less built-in scope than systemd, at the cost of some of the parallelization and unit-management features systemd offers out of the box. If you're running containers or minimal images, there's a decent chance you've already encountered one of these without realizing it.
If you're not sure what a given server is using, there are a couple of quick ways to check. The most reliable is to look at what process 1 actually is:
ps -p 1
If the output shows systemd in the CMD column, you're running systemd. On an older SysV-based system, you'd typically see init instead. You can also check directly:
readlink /proc/1/exe
This resolves the actual binary backing PID 1, which will point to something like /usr/lib/systemd/systemd on a modern distribution. Another option, if the systemctl binary exists on the box at all, is simply running systemctl with no arguments; if it returns a live list of units, systemd is managing the system, since the command won't function meaningfully otherwise.
Once you know you're on a systemd-based system, a handful of systemctl commands cover the vast majority of day-to-day service management. Checking a service's current state is the one you'll reach for most:
systemctl status nginx
Starting and stopping a service is straightforward too:
systemctl start nginx
systemctl stop nginx
systemctl restart nginx
Note that starting or stopping a service only affects its current running state; it won't survive a reboot on its own. To make a service come up automatically at boot, you enable it:
systemctl enable nginx
And to stop it from launching at boot without touching whether it's currently running, disable it:
systemctl disable nginx
For a quick sanity check across the whole system, systemctl list-units --type=service shows every loaded service unit and its state, and journalctl -u nginx pulls that service's logs straight out of the systemd journal, which is often faster than hunting through separate log files under /var/log.
Init and systemd both solve the same problem of turning a booting kernel into a working system, but they go about it in very different ways: one relies on sequential shell scripts and numbered runlevels, the other on declarative unit files, dependency graphs, and parallel startup. Knowing which one you're running, and how to check it, makes troubleshooting a stuck boot or a misbehaving service a lot less confusing.
Thanks for reading! If you're looking for reliable infrastructure, xTom provides enterprise-grade dedicated servers and colocation services, while V.PS offers scalable, production-ready NVMe-powered VPS hosting perfect for any workload. You can also explore IP transit, shared hosting, and general IT services for whatever your infrastructure needs.
Ready to discuss your infrastructure needs? Contact our team to explore the right solution for your projects.
Not exactly. "Init" is a general term for whichever program becomes PID 1 and manages system startup; systemd is one specific implementation of that role, alongside older ones like SysV init and alternatives like OpenRC. On most modern distributions, systemd is the init system, so in casual conversation people often use the terms interchangeably.
Mainly for speed and consistency. SysV init's sequential, shell-script-based startup couldn't take advantage of dependency information, so boots were slower than they needed to be, and every distribution handled runlevel scripts a bit differently. systemd's unit files and parallelized startup addressed both problems, which is why Fedora, Debian, Ubuntu, and RHEL all eventually adopted it as the default.
Most of the major ones do, including Ubuntu, Debian, Fedora, RHEL, and their derivatives like Rocky Linux and AlmaLinux. It's not universal, though; distributions like Alpine Linux, Gentoo, and Void Linux use OpenRC or runit instead, often because they prioritize a smaller footprint or a simpler init model.
Generally, yes. systemd includes compatibility shims that can parse traditional SysV init scripts, and most distributions keep the service command working as a wrapper around systemctl. That said, native unit files are the preferred approach going forward, since they integrate properly with dependency resolution, logging, and cgroup tracking.
The kernel treats the loss of PID 1 as a fatal, unrecoverable event and panics rather than trying to continue, which is exactly why the init system, whichever one it is, needs to stay running and stable for as long as the machine is up.
]]>Linux namespaces and cgroups are the two kernel features that make containers possible, one hides what a process can see, the other limits what it can use. Here's how they actually work under the hood.
]]>docker ps and wondered how a container manages to feel like its own little machine, with its own process list, its own network interface, its own hostname, the answer isn't magic and it isn't a virtual machine either. It's two Linux kernel features working together: namespaces and cgroups. One decides what a process can see. The other decides what it can use. Once you understand both, containers stop feeling like a black box and start looking like a clever combination of features that have been sitting in the kernel for years.
This article covers what namespaces and cgroups actually do, how they differ, and how you can peek at both on a running system.
A namespace wraps a global kernel resource so that a process (or group of processes) inside the namespace gets its own isolated view of that resource, separate from everything else on the machine. A process inside a PID namespace, for example, might think it's process 1, when on the host it's actually process 48213. It's not lying to itself; the kernel is genuinely presenting a different, scoped-down reality.
This idea has been part of Linux for a long time. According to the kernel's own documentation, namespaces were introduced incrementally starting around the 2.4.19 kernel with mount namespaces, and grew over the following decade to cover most of the resources a process might touch. The namespaces(7) man page is the most complete single reference if you want the details for each type.
There are seven namespace types in modern Linux, and it's worth knowing what each one isolates:
Namespaces are created with the clone(), unshare(), or setns() system calls, and a process can belong to a different combination of namespaces than its parent. That's really the whole trick: a container is just a regular Linux process that's been started inside a fresh set of namespaces instead of the ones its parent used.
Namespaces solve visibility, but they don't solve resource contention. Nothing stops a process in its own PID and network namespace from consuming every CPU cycle and every byte of memory on the box. That's where control groups, better known as cgroups, come in.
cgroups were merged into the mainline kernel around version 2.6.24, and they let you organize processes into hierarchical groups and then apply limits, prioritization, and accounting to those groups as a whole. Instead of tracking resource usage per process, you can say "this group of processes gets 2 CPU cores and 512MB of RAM, total," and the kernel enforces it.
cgroups expose their controls through a virtual filesystem, typically mounted at /sys/fs/cgroup. Each controller (CPU, memory, block I/O, and others) shows up as files you can read and write directly, though in practice most people interact with cgroups through systemd or a container runtime rather than editing those files by hand. If your workflow already touches systemd unit files for service management, it's worth reading how init and systemd differ since systemd is what actually creates and manages cgroup hierarchies on most modern distributions.
There are two versions of cgroups in circulation, and it trips people up more than it should.
cgroups v1 gives each resource controller its own separate hierarchy. You could have memory limits organized one way and CPU limits organized a completely different way, which made combining them for a single application awkward and led to inconsistent naming between controllers.
cgroups v2, which the kernel documentation describes in detail, consolidates everything into a single unified hierarchy. All controllers attach to the same tree of groups, the control files are named consistently, and features like pressure stall information (a way to see how much a group is being throttled) were added along the way. Most current distributions default to cgroups v2 now, though you'll still find v1 on older systems and in some legacy container setups.
Put the two together and you get almost everything a container runtime needs. Docker, LXC, and the container layer underneath Kubernetes all follow roughly the same pattern: start a process in a fresh set of namespaces so it can't see other processes, other network interfaces, or the host filesystem, then drop that process into a cgroup so it can't starve the rest of the system of CPU or memory.
Neither piece does this alone. A process with its own namespaces but no cgroup limits is isolated but can still exhaust shared resources. A process under cgroup limits but with no namespace isolation can still see and potentially interfere with every other process on the host. Containers work because both mechanisms apply at once, and the runtime just automates the setup that you could otherwise do by hand with tools like unshare and cgcreate.
It's worth being clear that none of this is virtualization in the traditional sense. There's no hypervisor and no separate kernel; every container on a host shares that one kernel. That's a large part of why containers start in milliseconds and virtual machines take longer, but it also means a kernel-level vulnerability can, in principle, affect every container on the host. Namespaces and cgroups give strong isolation, but it's isolation within one kernel, not a hard security boundary the way a VM's hypervisor provides.
This is the part that's easy to try yourself on any Linux box, no containers required.
To see which namespaces a process belongs to, check /proc/[pid]/ns:
ls -la /proc/1/ns
That directory lists a symlink for each namespace type (pid, net, mnt, uts, ipc, user, cgroup), each pointing to an inode number. Two processes sharing the same inode number for a given namespace type are, in fact, in the same namespace; different numbers mean different namespaces.
If you'd rather see everything at once, the lsns command gives you a readable table of every namespace currently in use on the system, what type it is, how many processes belong to it, and the command that started it:
lsns
Running that on a host with a couple of Docker containers active makes the isolation concrete. You'll see one set of PID and network namespaces for the host itself, and separate ones for each container, all coexisting on the same kernel.
For cgroups, you can look at a process's current group membership through /proc/[pid]/cgroup, and browse the actual controllers and limits under /sys/fs/cgroup. On a v2 system, something like this shows you the current memory limit for a given cgroup:
cat /sys/fs/cgroup/mygroup/memory.max
If none of this is unfamiliar territory and you're comfortable poking around a shell already, you might enjoy a closer look at what Bash actually is and how it compares to the other types of shells in Linux, since the terminal commands above are really just Bash talking to the kernel through /proc and /sys.
Namespaces and cgroups are two separate kernel features solving two separate problems, isolating what a process can see and limiting what it can use, and together they're the foundation nearly every container runtime is built on. Once you can find them in /proc and /sys/fs/cgroup yourself, the whole container ecosystem stops feeling like a mystery.
Thanks for reading! If you're looking for reliable infrastructure, xTom provides enterprise-grade dedicated servers and colocation services, while V.PS offers scalable, production-ready NVMe-powered VPS hosting perfect for any workload. You can also explore IP transit, shared hosting, and general IT services for whatever your infrastructure needs.
Ready to discuss your infrastructure needs? Contact our team to explore the right solution for your projects.
Not exactly. Namespaces and cgroups are kernel primitives; a container is a higher-level concept built on top of them by a runtime like Docker or LXC, which also adds things like image layers, networking configuration, and a defined filesystem root.
No. Both are built into the kernel itself. You can create namespaces with unshare and manage cgroups directly through the /sys/fs/cgroup filesystem without any container runtime at all, though runtimes make the process far more convenient.
Because each container has its own PID namespace. A process that appears as PID 1 inside a container is a normal, higher-numbered process on the host; the container just can't see the host's numbering scheme.
Generally not. Containers share a single host kernel, so a serious kernel vulnerability can affect every container on that host. Virtual machines run separate kernels under a hypervisor, which gives a stronger isolation boundary, at the cost of more overhead per instance.
cgroups v1 still works and plenty of systems run it, but it's effectively legacy at this point. cgroups v2 is the default on current major distributions and is where new kernel features are being added, so new deployments should generally target v2 unless something specific requires v1.
]]>Bash isn't the only shell on Linux. Here's a breakdown of the most common shell types, sh, bash, dash, zsh, ksh, csh/tcsh, and fish, what each is actually built for, and how to check or switch which one you're running.
]]>A shell is a command line interpreter. It's the program that sits between you and the operating system, reading the commands you type, figuring out what you mean, and asking the kernel to do the actual work. When you type ls or cd /var/log, you're not talking to the operating system directly; you're talking to the shell, and the shell translates that into system calls the kernel understands.
"A shell" is a concept, not a single piece of software, similar to how "a browser" describes a category that includes Chrome, Firefox, and Safari. Each one renders web pages, but they're built differently and behave differently in the details. Shells work the same way: each one interprets commands, but the syntax, features, and behavior can vary quite a bit from one to the next, which is exactly why it's worth knowing which one you're actually using.
sh refers to the original Bourne shell, written by Stephen Bourne at Bell Labs in the 1970s, and it's the shell the POSIX standard is modeled after. On most modern Linux systems, /bin/sh isn't literally the historical Bourne shell anymore; it's usually a symlink to a smaller, POSIX-compliant shell like dash. The name stuck around as shorthand for "the basic, portable shell," and scripts that start with #!/bin/sh are generally expected to avoid any syntax that isn't part of the POSIX spec.
Bash, short for "Bourne Again Shell," is the shell most Linux distributions have shipped as the default for decades, which is a big part of why "shell" and "bash" get used interchangeably. It was written by Brian Fox for the GNU Project as a free replacement for the Bourne shell, and according to the official GNU Bash manual, it implements the IEEE POSIX shell specification while adding its own extensions, things like command history, tab completion, associative arrays, and more capable scripting logic than the original Bourne shell offered. If you want a deeper look at bash specifically, we've covered that in more detail in our piece on what bash actually is and how it works.
Dash is a minimal, fast shell that many Debian-based distributions use as the actual target of the /bin/sh symlink, precisely because it starts up faster and uses fewer resources than bash. It sticks closely to POSIX and skips most of bash's interactive conveniences, which makes it a good fit for running system startup scripts where speed matters more than features.
Zsh builds on bash-like syntax and adds a lot of quality-of-life features on top: richer autocompletion, easier theming, and a large ecosystem of frameworks like Oh My Zsh for customizing it further. It's been the default interactive shell on macOS since Catalina, and plenty of Linux users switch to it for the same reasons, even though bash usually remains available underneath for scripts.
The Korn shell was developed at Bell Labs in the early 1980s and introduced several features that later showed up in bash, including command history and improved scripting constructs. It's less common as a default shell today, but it still turns up in some enterprise Unix environments and older scripts that were written before bash became the standard.
The C shell uses syntax that looks more like the C programming language, which some users find more intuitive and others find awkward for scripting. Tcsh is an enhanced version with better interactive features like command completion. Neither is common as a default shell on Linux today, but they still show up on some BSD systems and in certain legacy scripts.
Fish is built specifically for interactive use, with syntax highlighting, autosuggestions, and sane defaults out of the box rather than requiring a bunch of configuration to get there. The tradeoff is that it's less POSIX-compliant than the others, so scripts written for bash or sh often need adjustments to run correctly under fish.
None of these are "wrong" choices; they trade off differently between speed, interactive features, compatibility, and how closely they stick to the POSIX standard. A sysadmin writing a script meant to run on almost any Unix-like machine might deliberately target sh for portability, while a developer who lives in the terminal all day might prefer zsh or fish for the day-to-day conveniences.
This isn't just semantics. If you write a script starting with #!/bin/bash and it uses bash-specific features like arrays or [[ ]] conditional syntax, that script can break or behave unexpectedly if it's actually executed by a different shell, such as dash, which is what sh points to on many Debian-based systems. This is a genuinely common source of "it worked on my machine" bugs when moving scripts between servers or containers.
It also matters when you're troubleshooting. If a command behaves strangely, the shell you're in, along with its configuration files and environment variables, is one of the first things worth checking, well before you start suspecting the operating system itself. On a server, the shell your account launches into is often set up during initial provisioning, alongside other system-level settings that get configured when the machine boots up.
Before troubleshooting anything shell-related, it helps to know what you're actually running. There are a couple of quick ways to check.
The simplest is to run:
echo $SHELL
This prints the path to your default login shell, something like /bin/bash or /usr/bin/zsh. Keep in mind this shows your configured default, not necessarily the shell process currently running if you've launched something else on top of it.
For the shell that's actually active right now, try:
ps -p $$
This shows the process running in your current session, which is more reliable if you've switched shells temporarily. You can also check /etc/passwd for your account's assigned login shell, which is what runs by default whenever you log in.
If you decide you want to try a different shell, either just for a session or as your permanent default, both are straightforward.
To try a shell temporarily, just type its name and hit enter, like running zsh or fish directly from your current session. This starts a new shell process on top of your existing one, and typing exit drops you back to where you started.
To change your default login shell permanently, use the chsh command:
chsh -s /usr/bin/zsh
You'll need to log out and back in for the change to take effect, and the path needs to match wherever that shell is actually installed on your system, which you can confirm with which zsh or by checking /etc/shells for the list of shells your system recognizes as valid options.
| Shell | Known for | Best fit for |
|---|---|---|
| sh | The original POSIX-standard shell | Scripts that need to run portably across almost any Unix-like system |
| bash | The default interactive shell on most Linux distributions | General day-to-day use and scripts that need broad compatibility |
| dash | A minimal, fast, POSIX-compliant shell | Running system startup scripts where speed matters more than features |
| zsh | Bash-like syntax with richer autocompletion and theming | Interactive daily use, especially with frameworks like Oh My Zsh |
| ksh | An early shell that influenced many of bash's features | Enterprise or legacy Unix environments |
| csh/tcsh | C-like syntax, with tcsh adding better interactive features | Legacy scripts and some BSD systems |
| fish | Syntax highlighting and autosuggestions out of the box | Interactive use, though less POSIX-compliant for scripting |
Bash gets most of the attention, but it's one entry in a much wider family of Linux shells, each built with different priorities around speed, portability, or interactive convenience. Knowing the differences between sh, bash, dash, zsh, ksh, csh, and fish helps you pick the right one for the job and troubleshoot faster when a script behaves differently than you expect.
Thanks for reading! If you're looking for reliable infrastructure, xTom provides enterprise-grade dedicated servers and colocation services, while V.PS offers scalable, production-ready NVMe-powered VPS hosting perfect for any workload. You can also explore IP transit, shared hosting, and general IT services for whatever your infrastructure needs.
Ready to discuss your infrastructure needs? Contact our team to explore the right solution for your projects.
They're not the same thing. The terminal (or terminal emulator) is the window or application that displays text and passes your keystrokes along; the shell is the program running inside it that actually interprets your commands. You could open the same terminal application and run bash, zsh, or fish inside it; the terminal itself doesn't change.
Most Linux distributions, including Ubuntu, Debian, and Fedora, use bash as the default interactive shell for user accounts, though system scripts often run under a lighter shell like dash for speed. It's worth checking your specific distribution's defaults, since some, like Kali or certain Arch-based setups, ship with zsh instead.
It depends on what you're optimizing for. Bash is the safest default for compatibility since it's available on nearly every Linux and Unix system you'll connect to, which matters a lot for scripts. Zsh or fish are worth considering if you spend a lot of time typing commands interactively and want more built-in conveniences, since neither is guaranteed to be present on a server you don't control.
Yes, and it's common. Having bash, zsh, and fish all installed at once causes no conflicts; you simply choose which one to launch interactively or set as your default login shell with chsh. Scripts also specify their own interpreter via the shebang line at the top of the file, so different scripts on the same system can rely on different shells without issue.
"Better" depends on what you're optimizing for. Zsh offers more built-in interactive features like richer autocompletion and easier customization through frameworks like Oh My Zsh, while bash has broader compatibility and is nearly guaranteed to be present on any Linux or Unix system you connect to. For scripting that needs to run reliably across many machines, bash (or plain POSIX sh) is usually the safer bet.
Bash is the command-line shell and scripting language that runs behind most Linux (and more) systems and servers. Here's what it does, where it came from, and how to start using it.
]]>Bash stands for "Bourne Again Shell," and it's both a command interpreter and a scripting language for Unix-like operating systems. When you open a terminal window and type a command like ls or cd, you're talking to Bash. It reads what you typed, figures out what you meant, and hands it off to the operating system to actually execute. In that sense, Bash acts as the middleman between you and the Linux kernel, translating human-typed commands into system calls.
It's also a full scripting language in its own right. You can string commands together, add variables, write loops, define functions, and save all of it into a file that runs on its own. That dual role, interactive command line tool and scripting language, is a big part of why Bash became so widely used.
Bash is developed as part of the GNU Project, and it's free software, which means anyone can use, study, and modify it without paying licensing fees. That openness played a real role in how far it spread.
Bash was written by Brian Fox and released in 1989 as a free replacement for the original Bourne shell, which had been the standard Unix shell since the late 1970s. The Bourne shell (often called sh) was solid, but it wasn't open source, and the Free Software Foundation wanted a shell that people could freely use, share, and improve as part of the broader GNU operating system effort.
The name itself is a pun: "Bourne Again Shell" nods to both the shell it replaced and the idea of being reborn as free software. Fox built Bash to be compatible with the Bourne shell's syntax, so existing scripts would mostly still work, while also pulling in useful features from other shells of the era like the Korn shell (ksh) and the C shell (csh). That combination of backward compatibility and added functionality is a big reason Bash caught on so quickly once Linux distributions started shipping it as the default.
Today, Bash remains the default shell on most major Linux distributions, and it was among the very first tools Linus Torvalds ported over when he started building Linux in the early 1990s.
It's worth pausing on why Bash gets described as both a shell and a language, because that distinction trips people up.
As a shell, Bash is what you interact with every time you type a command interactively. It handles things like tab completion, command history (pressing the up arrow to recall a previous command), and job control, which lets you pause, background, or kill running processes without closing your terminal. Bash is just one member of a wider family of shells though; if you want to see how it stacks up against sh, zsh, dash, and others, our piece on the different types of shells in Linux breaks that down further.
As a language, Bash lets you write scripts: plain text files full of commands, conditionals, and loops that run from top to bottom just like any other program. This is where automation lives. Instead of typing the same ten commands every time you deploy an application or back up a database, you write them once into a .sh file and run that file whenever you need it.
A few core capabilities show up again and again in day-to-day Bash use, and they're worth understanding even at a high level.
Piping and redirection let you chain commands together and control where their output goes. The pipe symbol (|) takes the output of one command and feeds it as input to the next, so you can, for example, list files and immediately filter that list for a specific name. Redirection operators (> and >>) send output to a file instead of your screen, which is handy for logging.
Variables and environment variables let scripts store and reuse values, whether that's a file path, a username, or a configuration setting. Functions let you group a set of commands under a name so you can call them repeatedly without rewriting the same lines.
Loops and conditionals (for, while, if) give Bash scripts actual logic, letting them make decisions or repeat actions based on conditions, which is what turns a list of commands into a genuine program.
Job control lets you manage multiple running processes from a single terminal session, sending tasks to the background with & or bringing them back with fg, which matters a lot when you're managing long-running processes on a remote server.
Bash isn't the only shell out there. Zsh, fish, ksh, and dash all serve similar purposes, and some distributions default to a different one depending on their goals; Debian and Ubuntu, for instance, use dash for system scripts because it's faster to start, even though Bash remains the interactive default for users. macOS switched its default interactive shell to zsh a few years back, though Bash is still available and widely used.
What keeps Bash relevant despite the competition is its near-universal availability. If a Linux system exists, there's a very good chance Bash is installed on it, which makes it a safe choice when you're writing scripts meant to run across different environments. It's also tightly connected to how the rest of a Linux system starts up and manages processes; if you're curious how a shell like Bash fits into the bigger picture of how a system boots and runs services, our article on init versus systemd is a good next read.
Before writing or running scripts, it's worth confirming which version of Bash you're working with, since some newer syntax and features only work on more recent releases. Open a terminal and run:
bash --version
This prints the version number along with some copyright information. If you just want the version number by itself, you can check the built-in variable instead:
echo $BASH_VERSION
Most modern Linux distributions ship with Bash 5.x, though older systems or minimal container images sometimes still run 4.x. If you're managing your own server or a virtual machine, checking this once at setup can save you a headache later when a script uses a feature your installed version doesn't support.
Getting started with a Bash script takes just a few steps. First, create a new text file and give it a .sh extension, something like hello.sh. At the top of the file, add what's called a shebang line, which tells the system which interpreter to use:
#!/bin/bash
echo "Hello from bash!"
That first line, #!/bin/bash, points to the location of the Bash executable so the script knows what to run it with. Below that, you can add any commands you'd normally type into the terminal.
Save the file, then make it executable with:
chmod +x hello.sh
From there, you can run it with:
./hello.sh
You should see "Hello from bash!" printed to your terminal. From that simple starting point, you can build out real scripts with variables, loops, and conditionals to automate anything from server maintenance to deployment pipelines. Bash scripting is genuinely one of those skills that pays off quickly if you're spending any real time on the command line, since even a handful of small scripts can save hours of repetitive typing.
Bash has stuck around since 1989 for good reason: it's free, it's everywhere, and it does exactly what a shell needs to do without much fuss. Whether you're running a single command or automating an entire deployment process, understanding the basics of Bash makes working on Linux systems a lot more comfortable.
Thanks for reading! If you're looking for reliable infrastructure, xTom provides enterprise-grade dedicated servers and colocation services, while V.PS offers scalable, production-ready NVMe-powered VPS hosting perfect for any workload. You can also explore IP transit, shared hosting, and general IT services for whatever your infrastructure needs.
Ready to discuss your infrastructure needs? Contact our team to explore the right solution for your projects.
Bash stands for "Bourne Again Shell." The name is a play on words referencing the original Bourne shell it was designed to replace, and the idea of that shell being reborn as free software under the GNU Project.
No. Bash is a shell and scripting language that runs on Linux and other Unix-like systems; it isn't the operating system itself. Linux is the kernel, and Bash is one of several possible shells you can use to interact with it, though it happens to be the default on most distributions.
Not strictly, since many tasks can be done through a graphical interface. But if you're managing servers, working with cloud infrastructure, or doing anything that benefits from automation, learning basic Bash commands and scripting will make you significantly more efficient.
Bash is the interpreter itself, the program that reads and executes commands. A Bash script is a text file containing a sequence of those commands, saved so it can be run as a single program rather than typed manually each time.
Yes. Windows Subsystem for Linux (WSL) lets you run a real Linux environment, including Bash, directly on Windows. There are also standalone tools like Git Bash that provide a Bash-like environment without a full Linux installation.
]]>There's no single best place in the world to host your servers, but there is a best place for your project. Here's how location shapes speed, compliance, and reliability, and how to pick the right one.
]]>So is there a single best location for hosting? The honest answer is no, and anyone who tells you otherwise is probably trying to sell you a specific region. The more useful answer is that the right location depends on a handful of factors you can actually reason about, and once you understand them, the choice gets a lot less mysterious.
Let's walk through what location really changes, then get practical about how to choose.
The reason there's no universal best spot is simple: hosting serves wildly different goals. A game server for players in Sydney has nothing in common with a compliance-bound database for a German company, which has nothing in common with a low-latency trading box that needs to sit next to a financial exchange in Tokyo.
Each of those has a clearly correct answer. None of them is the same answer. So instead of hunting for one perfect city, you're really matching a location to the thing you're trying to do. That reframing is the whole trick.
Four things shift when you move your servers around the map. Get a feel for these and most decisions make themselves.
Latency is the delay between a request leaving your user's device and a response coming back. The biggest single factor is distance, because data still has to physically travel, and even light in a fiber cable has a speed limit. As a rough rule, signals move through fiber at around two-thirds the speed of light, which works out to roughly 1 millisecond of latency for every 100 kilometers, each way.
That sounds tiny until you stack it up. A user in London hitting a server in San Jose is looking at a round trip of well over 130 milliseconds before the server even does any work. For a static page, fine. For a chatty application that makes dozens of sequential calls, or anything real-time, that delay compounds into something users feel.
The takeaway: the closer your server sits to the people using it, the snappier everything feels. Distance is the cost you pay in milliseconds.
Here's where a lot of people get caught out. Two cities can be the same distance from your users and still deliver very different performance, because what matters isn't the straight-line distance, it's the route the traffic actually takes.
A well-connected data center sits near major Internet Exchange Points and peers directly with lots of networks, so your traffic takes a short, direct path. A poorly connected one might route your packets halfway across a continent and back before they reach their destination. This is why cities like Amsterdam, Frankfurt, Tokyo, and Singapore show up again and again in hosting maps: they're dense interconnection hubs where networks meet, so traffic in and out tends to be fast and well-peered.
If you want to see this for yourself rather than take a provider's word for it, a looking glass lets you check the real network path and round-trip time from a given location back to your part of the world. It's one of the most honest ways to compare two facilities.
Where your data physically lives decides which laws apply to it. If you handle personal data from people in the European Union, the GDPR shapes how and where you can store it, and hosting inside the EU often makes compliance simpler. Other regions have their own rules about data residency, government access, and privacy.
This is the factor people forget until it bites them. Cost and latency can be optimized later; a legal requirement to keep certain data in a certain country is not negotiable. If you operate in a regulated industry or serve a specific market, sort this out before you think about anything else.
Prices vary by region, sometimes a lot, driven by local electricity costs, real estate, taxes, and how competitive the market is. A rack in one metro can cost noticeably more than an equivalent setup elsewhere. Hardware availability and the specific services on offer also differ from one location to the next. None of this should override a hard latency or compliance need, but when two locations are otherwise close, cost is a fair tiebreaker.
With those factors in mind, here's a practical way to land on a decision without overthinking it.
Run through those five steps and you'll usually find the choice was never really about the single best city. It was about the best fit for your specific traffic, rules, and budget.
Sometimes the honest answer is that no single location works, because your users are genuinely spread across the globe or you can't afford a regional outage to take you offline.
In that case, you spread out on purpose. A common pattern is to run servers in two or three regions, say one in North America, one in Europe, and one in Asia Pacific, and route each user to the nearest one. This cuts latency for everyone and gives you redundancy, so a problem in one region doesn't take down the whole service. Content delivery networks take this idea further by caching static assets at the edge, close to users, while your core application still lives in a chosen home region.
Multi-region setups add complexity around data synchronization and cost, so they're not the default for every project. But for global audiences or services that can't go dark, distributing across locations beats trying to crown one winner.
There's no single best location for hosting, and chasing one is a distraction. The better move is to match a location to your project: host near your users, respect the laws that apply to your data, favor well-connected facilities, and spread across regions when one site can't cover everyone. Decide in that order and the "best" location reveals itself.
Picking the right region only pays off if the infrastructure underneath it is solid. xTom runs facilities across Asia Pacific, North America, and Europe, with dedicated servers and colocation in major interconnection hubs, scalable NVMe-powered KVM VPS through V.PS, IP transit for networks that want their own routing, shared hosting for simpler projects, and a range of general IT services to round it out.
Ready to discuss your infrastructure needs? Contact our team to explore the right location and setup for your project.
Yes. The farther data has to travel between your server and your users, the higher the latency, and the slower pages feel. Network quality and peering matter too, but for most sites, hosting closer to your main audience is one of the easiest performance wins available.
In most cases, near your users, because distance is the biggest driver of latency. That said, a location close to a major interconnection hub often gives you both, since those hubs tend to sit in or near large population centers and offer excellent peering. When forced to choose, prioritize proximity to your audience.
Data sovereignty means the data you store is subject to the laws of the country it physically sits in. If you handle regulated or personal data, rules like the GDPR may require you to keep it within a specific region. Sort out these requirements before optimizing for speed or cost, since legal obligations aren't something you can engineer around later.
If your users are spread across multiple continents, or you can't tolerate a regional outage, then yes, a multi-region setup lowers latency for everyone and adds redundancy. For a project with a single regional audience, one well-chosen location is usually simpler and plenty.
There's no single winner, but cities like Amsterdam, Frankfurt, Tokyo, Singapore, and the major US metros are known for dense interconnection and strong peering. The practical way to compare is to test real round-trip times from your users' networks rather than relying on reputation alone.
]]>Getting your own IP addresses can mean going straight to a Regional Internet Registry for next to nothing, or paying to lease or buy space on the open market. Here's how each route works, what it costs, and which one actually fits your situation.
]]>It's a fair question, and the honest answer is that there's more than one path. You can go straight to the source and request space directly, which costs almost nothing but tends to take a while. Or you can pay for it on the open market, either by leasing addresses month to month or buying them outright. Each route trades off cost, speed, and how much control you walk away with.
Let's walk through all three, starting with the free and patient option, then moving into the paid routes.
Before picking a route, it helps to know who hands these things out. No single company owns the internet's address space. At the top sits IANA, the Internet Assigned Numbers Authority, which carves the global pool into large chunks and distributes them to five regional bodies called Regional Internet Registries, or RIRs.
Those five registries each cover a part of the world: ARIN for North America, RIPE NCC for Europe, the Middle East, and parts of Central Asia, APNIC for the Asia-Pacific region, LACNIC for Latin America, and AFRINIC for Africa. If you want a deeper look at how this whole system is structured, we've covered it in our guide to what a Regional Internet Registry is.
Which registry matters to you depends on where your organization is legally based. That's the front door for the free route, so let's start there.
The cheapest way to get your own addresses is to request them directly from your registry. There's a twist, though: this route behaves completely differently for IPv6 than it does for IPv4.
This is where the "free" part really holds up. To get space directly, your organization usually becomes a member of its RIR. In the RIPE region that membership makes you a Local Internet Registry, or LIR. It isn't literally free; RIPE NCC charges a one-time sign-up fee plus an annual service fee, which in 2026 works out to roughly €1,000 to join and €1,800 a year. But once you're in, your first IPv6 allocation, typically a /32, comes at no extra charge and with very little paperwork. RIPE generally just wants a simple statement that you plan to deploy it within the next year.
If full membership feels like overkill, end users can also get provider-independent IPv6 space through a sponsoring LIR, which is lighter and cheaper than running your own registry account.
The reason IPv6 is so painless is supply. There's an almost unimaginable number of IPv6 addresses, so registries are happy to hand them out. The catch is adoption: plenty of the internet still leans on IPv4, so IPv6-only deployments can hit compatibility gaps. If you're weighing the two, our breakdown of IPv4 vs IPv6 goes through the practical differences.
IPv4 is a different story. The world ran out of fresh IPv4 addresses years ago. ARIN's free pool ran dry back in September 2015, and the other registries followed. So you can't simply ask for a brand-new block and get one.
What you can do is join the IPv4 waiting list. When addresses get returned, reclaimed, or revoked for non-payment, registries redistribute them to organizations waiting in line. It costs nothing beyond your membership fees, but the constraints are real. The wait is long; at RIPE, members typically sit on the list somewhere between 12 and 24 months. The block is small, too: RIPE hands out a single /24, which is 256 addresses, while ARIN's waitlist tops out at a /22 and lets you elect a smaller size down to a /24. Eligibility is limited as well, since ARIN won't add you to the list if you already hold a /20 or more. And there's a holding period: addresses from ARIN's waitlist can't be transferred to anyone else for five years.
So the free route is genuinely cheap, but it rewards patience and suits organizations that can plan months ahead. If you need addresses now, you're looking at the paid market.
There are two flavors of paying for IPv4: renting it or owning it. Both pull from what's called the secondary market, since registries no longer sell from a fresh pool.
One thing both routes share is that getting the addresses is only half the job. To actually use them on the public internet, the routes to your block have to be announced using BGP, the protocol that tells the rest of the internet where your addresses live. That usually means having your own Autonomous System Number, or ASN, plus an upstream provider willing to carry your announcements through IP transit. If you lease through a hosting provider that already announces the space for you, this part is handled on your behalf.
Leasing means renting address space: you pay a monthly fee while someone else keeps ownership. It's the faster, lower-commitment option, which makes it popular with startups, short-term projects, and anyone bridging toward IPv6.
Lease rates have stayed steadier than purchase prices over the years. As of 2026, most blocks in the RIPE and ARIN regions lease for roughly $0.30 to $0.50 per IP per month, with APNIC space running higher, often above $0.60, because supply there is tighter. A /24 of 256 addresses tends to land somewhere in the rough neighborhood of $80 to $150 a month, though the exact figure depends on block size, region, and the reputation of the addresses.
Marketplaces like IPXO and IPv4.Global connect holders of unused space with people who want to lease it. Reputation matters more than people expect here; if a block was previously used by a spammer and landed on blocklists, your mail and traffic can suffer, so it's worth checking a block's history before you commit. You can look up who a block is registered to and its current status using an RDAP lookup, and we built a free RDAP client for exactly that.
The downside of leasing is that you never own the asset. Stop paying and the addresses go back. For a lot of businesses that's a perfectly fine trade for the flexibility.
Buying gives you the addresses outright. Since registries don't sell from a fresh pool anymore, a purchase is really a transfer: ownership of an existing block moves from the seller to you, recorded officially through your RIR's transfer process, such as ARIN's section 8.3 transfer.
In 2026, IPv4 sells for roughly $20 to $45 per address depending on block size and region. Larger blocks like a /16 have actually dropped below $20 per IP, while smaller and more in-demand /24s sit at the higher end. Buying a single /24 outright, then, runs somewhere in the rough range of $9,000 to $12,000 as a one-time cost.
What you get for that is permanent control, no recurring lease fees, and an asset you can resell or even lease out yourself later. What you take on is a significant upfront cost, responsibility for the block's reputation, and a transfer process where you'll need to meet your registry's policies and justify the need. Brokers handle the paperwork and escrow for a cut, which is worth it for most first-time buyers.
Buying makes the most sense when you have long-term, stable address needs and you'd rather own the space than carry an ongoing bill.
Pulling it all together, here's a sensible way to approach it.
Start by figuring out what you actually need. How many addresses, and IPv4, IPv6, or both? A handful of IPv6 addresses for a modern deployment is a very different ask from a /22 of IPv4 for a hosting fleet. Be honest about your timeline too, because that single factor often decides the route for you.
If you can wait and you mostly need IPv6, go straight to your RIR. Identify your region's registry, become a member or work through a sponsoring LIR, and request your allocation. You'll have IPv6 quickly, and you can park yourself on the IPv4 waiting list at the same time.
If you need IPv4 soon and want flexibility, lease it. Pick a reputable marketplace, or a hosting provider that includes address space, check the reputation of any block before you commit, and confirm how the addresses will be announced.
If you need IPv4 for the long haul and want to own it, buy through a broker or directly from a seller, and budget for the transfer process through your RIR.
Whichever route you take, make sure you can actually route the space. That means sorting out your ASN, BGP, and an upstream willing to carry your announcements before the addresses are any use. If you're getting the space bundled with hosting or transit, your provider usually takes care of all of that.
Obtaining your own IP addresses comes down to a trade between time and money. The free route through a Regional Internet Registry costs little beyond membership and gets you IPv6 quickly, but IPv4 means a long wait for a small block. Leasing gets you IPv4 fast without a big upfront spend, at the cost of ongoing fees and no ownership. Buying hands you permanent control and resale value, but it asks for real money up front and a bit of paperwork. None of them wins across the board; the right one depends on your timeline, your budget, and how much you want to own.
If you'd rather skip the registry queues and routing headaches altogether, xTom can provide the infrastructure with address space already sorted. We offer enterprise-grade dedicated servers and colocation, scalable NVMe-powered KVM VPS through V.PS, IP transit to carry your announcements, shared hosting, and a full range of general IT services to round things out.
Ready to discuss your infrastructure needs? Contact our team to find the right setup for your project.
More or less, for IPv6. Once you're a member of your Regional Internet Registry, your first IPv6 allocation comes at no extra charge beyond membership fees. IPv4 is harder; you can join your registry's waiting list at no extra cost, but you'll wait a year or two for a small block. Truly free IPv4 on the open market no longer exists.
As of 2026, most blocks in the RIPE and ARIN regions lease for roughly $0.30 to $0.50 per IP per month, with APNIC space running higher. A /24 of 256 addresses lands around $80 to $150 a month, depending on block size, region, and the reputation of the addresses.
About $20 to $45 per address in 2026, depending on block size and region. Larger blocks cost less per IP, while smaller /24s cost more. A single /24 works out to roughly $9,000 to $12,000 as a one-time purchase.
If you want to announce the space yourself on the public internet, then yes, you'll generally need your own ASN and a BGP setup, along with an upstream provider to carry your announcements. If you lease addresses through a hosting provider that announces them for you, you don't need your own ASN.
Leasing is renting: lower upfront cost, monthly fees, no ownership, and easy to scale up or down. Buying is owning: high upfront cost, no recurring fees, full control, and the option to resell later. Leasing suits short-term or uncertain needs; buying suits long-term, stable ones.
Look up its registration and history first. An RDAP lookup shows who a block is registered to and its status, and you can check whether the addresses appear on any blocklists.
The one covering where your organization is legally based: ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for the Asia-Pacific region, LACNIC for Latin America, and AFRINIC for Africa.
]]>IPv4 prices went through one of the sharpest corrections on record in 2025, and 2026 is showing the first real signs of a turnaround. Here's what the latest market data says an IP address actually costs this year, and what's driving the numbers.
]]>When people talk about paying for IP addresses, they're almost always talking about IPv4. IPv6 is so abundant that registries effectively give it away; once you're a member of your registry, an IPv6 allocation usually comes at no extra charge. There's no meaningful resale market because there's no scarcity. If you want the background on why the two protocols behave so differently, our explainer on IPv4 vs IPv6 covers it.
IPv4 is the opposite. There are only about 4.3 billion addresses, the free pools at the registries are exhausted, and roughly 3.9 million unallocated addresses are left worldwide, mostly sitting in the APNIC and AFRINIC regions. Practically speaking, the only way to get IPv4 now is the secondary market: buying or leasing existing space from whoever already holds it. That scarcity is the whole reason a price exists at all. So for the rest of this article, "IP address prices" means IPv4 prices.
Pricing depends heavily on the size of the block you're after, the region it's registered in, and the reputation of the addresses. As a rough guide, here's where the market sits in 2026 based on data from IPv4.Global, the largest IPv4 marketplace, alongside lease figures tracked by platforms like IPXO.
| Block size | Addresses | Approx. purchase price per IP | Approx. lease per IP / month |
|---|---|---|---|
| /24 | 256 | $28 to $40 | $0.38 to $0.50 |
| /22 | 1,024 | $22 to $30 | $0.38 to $0.48 |
| /20 | 4,096 | $21 to $30 | $0.35 to $0.45 |
| /16 | 65,536 | $13 to $22 | $0.30 to $0.40 |
A couple of things stand out. First, the per-address price drops as blocks get larger, which is normal, but the gap has stretched to an unusual degree (more on that in a moment). Second, leasing has stayed remarkably stable while purchase prices swung wildly.
To put that in real money: buying a single /24 outright runs somewhere around $7,000 to $9,000 as a one-time cost, while leasing the same block lands near $100 to $130 a month. A /20 leases for roughly $1,500 to $1,800 a month. If the slash notation is unfamiliar, our guide to IPv4 vs IPv6 block sizes breaks down how many addresses each prefix holds.
Region matters too. ARIN-registered space has historically commanded a 5 to 15% premium over RIPE addresses, mostly because of where buyers want their traffic to appear, while APNIC purchase prices tend to run lower. Leasing flips that for APNIC, where tight supply pushes lease rates above $0.60 per IP per month. The differences come down to which Regional Internet Registry governs the block.
The 2026 numbers only make sense against the backdrop of what just happened, and it's a genuinely dramatic arc.
Rewind to late 2023. At that point, big blocks were the expensive ones. IPv4.Global data showed /16 and larger blocks trading near $52 per address, while smaller /20 to /24 blocks changed hands closer to $36. That 44% premium for large blocks was historically odd, and the reason was specific: hyperscale cloud operators were hoarding large, contiguous blocks to expand their infrastructure, and their appetite dragged prices up to levels that couldn't last.
That demand held until around July 2024, then the floor gave way. By the second half of 2024, the premium had evaporated entirely and blocks of every size were trading at roughly the same $33 per address. The convergence surprised plenty of people who'd treated the large-block premium as permanent.
It didn't stop at convergence. Through 2025, large blocks fell off a cliff. A /16 that started the year near $33 per address dropped below $13 by the fourth quarter, with some bulk deals clearing under $10. That's a contraction of more than 60% in a single year, and a ten-year low. In May 2025, the /16 slipped under $20 per address for the first time since 2019, which became the headline marker of how far things had fallen. Mid-size blocks followed the slide, with /17 to /19 ending the year near $16 and /20 to /21 near $21.
Here's the part that matters most, though: demand never actually broke. Transaction volume stayed strong throughout the decline. In July 2025, IPv4.Global recorded 98 transactions in the month against a typical average of 73, a 32% jump, even as prices were sinking. When price falls but volume rises, that's not a market collapsing. It's a market repricing to a new level, with a broader base of buyers stepping in.
Small blocks, the /22 to /24 range, told a completely different story through all of this. They dipped, but only modestly, and by mid-2025 they were trading at more than double the per-address rate of /16s. The old pattern, where buying big got you a steep discount, didn't just narrow; it reversed into an extreme.
The reason is who's buying. Small blocks have a wide, steady, practical buyer base: regional ISPs, hosting providers, and businesses that need a targeted slice of addresses for a specific project. That demand shows up month after month regardless of what the giant blocks are doing. On top of that, cloud platforms like AWS and Azure now charge for IPv4 usage, which pushes companies to buy their own space on the secondary market and bring it to the cloud through BYOIP programs. That's a structural floor under small-block prices that simply doesn't exist for /16s.
One of the clearest lessons in the 2025 data is how differently leasing and buying behaved. While purchase prices for large blocks were losing 60% of their value, lease rates barely moved, holding in a $0.38 to $0.50 per IP per month band across most RIPE and ARIN blocks. That stability is exactly why a lot of businesses treat leasing as the lower-risk option.
The trade-off is straightforward. Leasing means predictable monthly costs, no big upfront spend, and the freedom to scale up or down, but you never own the asset. Buying means a large one-time cost and responsibility for the block's reputation, in exchange for permanent control and an asset you could resell or lease out later. The wild swings on the purchase side are precisely what make leasing feel safe, and the steadiness of leasing is part of what puts a floor under small-block purchase prices.
Whichever way you go, owning or leasing the addresses is only useful if you can route them. That means having an Autonomous System Number, announcing the space with BGP, and an upstream provider carrying your routes through IP transit, unless you're getting the space bundled with hosting that handles all of that for you.
A handful of forces are shaping the numbers this year. On the supply side, legacy holders like universities, telecoms, and restructured companies spent 2024 and 2025 monetizing address space they weren't using, which flooded the large-block market and drove those prices down. At the same time, the hyperscale cloud buyers who'd propped up large-block pricing largely stepped back.
On the demand side, a new category showed up: AI infrastructure. GPU clusters and the data centers behind them need IPv4 for management networks, API endpoints, and customer-facing services, and that demand barely existed during the last big buying cycle. Broadband buildouts are adding pressure too; the US BEAD program, a roughly $42 billion push to expand rural coverage, is expected to lift IPv4 demand by 10 to 20% as providers build the networks that deliver those connections. Reputation also moves prices at the margins, with clean, well-documented blocks commanding a 10 to 15% premium over space with a spotty history. Before you commit to any block, it's worth checking its registration and reputation, which you can do with an RDAP lookup.
Hanging over all of it is IPv6. Adoption keeps creeping forward, and every network that goes IPv6-native is one that needs a little less IPv4. That doesn't crater prices overnight, but it does cap how high they can realistically climb over the long run.
Based on the first four months of 2026, the market looks like it found its floor. January brought record transaction volume and a wave of new buyers. February held steady and even ticked up for some block sizes. March delivered a measurable price increase across the board, and April confirmed it with broad demand spread across block sizes rather than concentrated in one corner.
IPv4.Global's own projection, published in June 2026, expects a gradual recovery through year-end: large /16+ blocks climbing from their $10 to $13 lows toward $15 to $22 per address, medium blocks landing in the $18 to $30 range depending on size, and small /22 to /24 blocks holding firm around $30 to $36, with ARIN space at the higher end. None of that is a return to the 2022 peak, and it's a projection rather than a promise, but the direction has clearly shifted from "how far will it fall" to "how fast will it recover." If AI infrastructure demand accelerates, the recovery could move faster than those figures suggest.
IPv4 prices in 2026 are best understood as a market coming out of a steep correction. Large blocks lost more than 60% of their value in 2025 before bottoming out near ten-year lows, small blocks held firm and now cost more per address than the big ones, and leasing stayed steady through all of it at roughly $0.40 per IP per month. Early 2026 data points to a measured recovery, driven by steady operational demand, a new wave of AI infrastructure buyers, and tightening supply. For anyone budgeting for address space this year, the headline is that timing and block size matter more than they have in a long while.
If you'd rather not navigate the secondary market and registry transfers yourself, xTom can provide the infrastructure with address space already handled. We offer enterprise-grade dedicated servers and colocation, scalable NVMe-powered KVM VPS through V.PS, IP transit to carry your announcements, shared hosting, and a full range of general IT services to round things out.
Ready to discuss your infrastructure needs? Contact our team to find the right setup for your project.
It depends on block size and region, but as a rough guide, expect roughly $28 to $40 per address for a small /24 block and $13 to $22 for a large /16. Per-address prices fall as blocks get bigger. A single /24 of 256 addresses works out to somewhere around $7,000 to $9,000 to buy outright, or about $100 to $130 a month to lease.
Large blocks fell more than 60% over the year, mainly because legacy holders started selling off unused address space at the same time that hyperscale cloud operators, who had been the biggest buyers of large blocks, stepped back from the market. More supply plus less demand at the top end pushed prices to ten-year lows.
Small blocks have a broad, steady base of buyers, including hosting providers and businesses bringing their own addresses to cloud platforms, so demand stays consistent. Large blocks depend on a much smaller set of big buyers, and when those buyers stepped back, large-block prices fell faster. By mid-2025, small blocks were trading at more than double the per-address rate of the largest blocks.
It depends on your time horizon. Leasing costs roughly $0.38 to $0.50 per IP per month and avoids a big upfront spend, which suits short-term or variable needs. Buying costs more up front but has no recurring fees and gives you a resellable asset, which suits long-term, stable requirements. Lease rates stayed steady even while purchase prices swung sharply, so leasing is often the lower-risk choice.
Yes. ARIN-registered addresses typically carry a 5 to 15% premium over RIPE space on purchases, while APNIC purchase prices tend to run lower. For leasing, APNIC often costs more, above $0.60 per IP per month, because supply there is tighter.
The early 2026 data suggests prices have bottomed out and begun a gradual recovery, helped by strong demand and new buyers from AI infrastructure. Most market observers expect modest increases through year-end rather than a sharp spike, though projections are not guarantees and prices vary widely by block.
No. IPv6 is plentiful enough that there's no real resale market, and a first IPv6 allocation usually comes at no extra cost beyond your registry membership fees. The pricing pressure that affects IPv4 simply doesn't apply to IPv6.
]]>A point of presence (PoP) is the physical spot where one network meets another and hands off traffic, and it quietly shapes how fast your sites and apps feel. Here's what a PoP actually is, what lives inside one, and how to check a provider's PoP footprint before you commit.
]]>PoPs are everywhere in networking, and they shape real things like latency, reliability, and how close your servers can get to the people using them. But the term gets used loosely, so it helps to slow down and look at what a PoP really is, what sits inside one, and why it matters when you're choosing where to host. Let's break it down.
At its simplest, a point of presence is a physical location where a network connects to other networks and to the wider internet. It's the spot where traffic gets handed off between different parties. If you connect to the internet through an ISP, the place where your traffic enters that ISP's network is a PoP. If a provider sells you transit or colocation, the facility where their routers live and interconnect with everyone else is also a PoP.
The term goes back further than the internet as we know it. After the court-ordered breakup of the Bell telephone system in the United States, a point of presence was the location where a long-distance carrier could hand traffic off into the local phone network. The core idea stuck around: a PoP is a boundary, a meeting point where one network ends and another begins. The technology underneath has changed a lot since the days of phone switches, but the concept has aged well.
These days, when a hosting or transit provider talks about their PoPs, they usually mean the cities and facilities where they have networking gear installed and connected. A provider with PoPs in Frankfurt, Tokyo, and San Jose has a physical footprint in all three, with equipment ready to carry your traffic and exchange it with other networks nearby.
A PoP isn't a single machine; it's a collection of networking hardware living inside a data center, often in leased rack space. The exact contents vary, but most PoPs share a similar cast of equipment.
You'll typically find routers, which are the devices that decide where traffic goes next and speak BGP to the rest of the internet. There are switches that move traffic around locally within the facility. There's cabling and cross connects, the physical links that join a provider's gear to other networks in the same building, including internet exchange points where many networks meet to swap traffic directly. And depending on the operator, there may be servers too, whether for caching, DNS, monitoring, or actual customer workloads.
The data center wrapped around all of this supplies the boring but important stuff: power, cooling, physical security, and fire suppression. A PoP only works because the facility keeps the lights on and the temperature steady around the clock.
One thing worth clearing up early: a PoP and a data center aren't quite the same thing. A data center is the building. A PoP is a network's presence inside that building. A single large facility can host PoPs for dozens of different networks, all sitting in their own cages and cabinets, interconnecting with each other. So when xTom announced its point of presence at Global Switch in Singapore, that meant installing networking equipment inside that facility and lighting up connectivity there, not building the data center itself.
To see why PoPs matter, it helps to picture how your data travels. When you load a page, your request leaves your device, reaches your ISP's nearest PoP, and from there hops across one or more networks until it arrives at the server holding the content. Each of those hops adds a little time. The fewer and shorter the hops, the snappier everything feels.
This is where a provider's PoP footprint starts to matter for you directly. If a network has PoPs close to your users, traffic can stay local instead of taking a long detour across continents. Networks that interconnect at a lot of locations can also lean on peering and IP transit to find efficient routes, which tends to mean lower latency and fewer surprises during congestion.
It's the same logic that makes a content delivery network (CDN) effective. A CDN spreads cached copies of your content across many PoPs, often called edge locations, so a visitor in Sydney gets served from somewhere nearby rather than from an origin server on the other side of the world. The PoP is the building block that makes that closeness possible.
PoPs also feed into redundancy. A network with presence in multiple cities can keep traffic flowing if one site or one upstream link has trouble, because there are other paths available. A single PoP is a single point of failure; several well-connected PoPs are a safety net.
If you're picking where to host servers or buy transit, the PoP question is worth a few minutes of homework. Here's a practical way to go about it.
Start by finding out where the provider's PoPs actually are. Most serious operators publish a list of their locations, and you want those locations to line up with where your users or your other infrastructure live. A provider with great coverage in Europe doesn't help much if your audience is in Southeast Asia.
Next, check the provider in PeeringDB, a free public directory that lists networks, the facilities they're present in, and the internet exchanges they connect to. It's one of the most honest signals you'll find, because networks maintain their own records there and other operators rely on them. A network that peers at well-known exchanges like DE-CIX in Frankfurt, AMS-IX in Amsterdam, or LINX in London is interconnecting where a lot of traffic already flows.
Then test the path yourself. A quick traceroute (or tracert on Windows) from your location to the provider's network shows you the hops your traffic takes and roughly how long each leg adds. Many providers also run a public looking glass, a web tool that lets you run pings and traceroutes from their PoPs back toward you, so you can measure latency from the other direction before you sign up.
Finally, think about redundancy and not just raw speed. Ask whether the provider has more than one PoP in the regions you care about, and whether they buy transit from multiple upstreams. Multihoming across providers is standard practice for anything you can't afford to have go dark.
Put those steps together and you get a clear picture: where the network lives, who it connects to, how fast it reaches you, and how well it holds up when something breaks.
A point of presence is a small idea with a big footprint. It's just the spot where networks meet, but those meeting points decide how close your infrastructure can get to your users, how many hops your traffic takes, and how gracefully things hold up when a link fails. Once you start noticing PoPs, you start seeing them behind almost every conversation about latency, transit, and reach.
If you're choosing where to put your infrastructure, having a provider with a well-connected PoP footprint makes a real difference. xTom offers enterprise-grade dedicated servers and colocation across global data centers, along with IP transit for networks that need direct, well-peered connectivity. For scalable compute, V.PS provides NVMe-powered KVM VPS hosting built for production workloads, and if you want to get started quickly there's shared hosting too. You can browse the full range of xTom services to see what fits.
Ready to discuss your infrastructure needs? Contact our team to explore the right solution for your projects.
A data center is the physical building that supplies power, cooling, and security. A point of presence is a particular network's gear and connectivity inside that building. One data center can hold PoPs for many different networks at once, so the two terms describe different layers of the same setup.
More or less, yes. A CDN edge location is a point of presence where the CDN caches content close to users. The wider term PoP covers any network meeting point, while edge location is the CDN-specific flavor of the same idea.
A PoP close to your visitors shortens the physical distance their traffic has to travel and reduces the number of network hops along the way. Both of those cut latency, so pages and apps feel faster. A provider with PoPs near your audience, and good peering at those PoPs, will generally outperform one that routes everything through a distant hub.
Most providers publish a list of their locations on their site, and you can cross-check that against PeeringDB to see which facilities and internet exchanges they connect to. Running a traceroute to their network, or using their public looking glass, lets you measure the actual latency and routing from your own location before committing.
It depends on your reach and your tolerance for downtime. A single PoP can be plenty for a regional project on a budget, but if your users are spread across regions, or you can't afford outages, presence in multiple well-connected locations gives you both lower latency for distant users and a fallback path when something fails.
]]>Losing data on a Linux server is painful, and it's almost always preventable. This guide walks you through setting up automatic Linux backups using tools like rsync, cron, and tar, so your data is protected without you having to think about it.
]]>rm -rf, a failed drive — any of these can wipe out hours, days, or even months of work in seconds. The fix isn't complicated, though: a well-designed automatic backup strategy means that when something goes wrong (and eventually, something will), you're restoring from last night's backup rather than starting from scratch.
This guide covers how to set up automated Linux backups using tools that come standard on most distros. No paid software required, no vendor lock-in, just solid, time-tested methods you can set up in an afternoon.
The problem with manual backups is simple: people forget to do them. Or they do them inconsistently. Or they back up the wrong directories. Automation removes the human element from a task that really shouldn't depend on humans remembering to do it.
Beyond just running the backup, automation also lets you schedule backups during off-peak hours, rotate old backups to save disk space, and get notified if something fails. That's a lot harder to pull off reliably if you're doing it by hand.
Before jumping into scripts, it helps to know which tools you're working with and why they're suited for the job.
rsync is probably the most widely used backup tool on Linux. It copies files efficiently by only transferring what has changed since the last run, which makes incremental backups fast even over a network. It supports SSH out of the box, so you can back up to a remote server securely without any extra setup.
tar is the traditional Unix archiver. It bundles files and directories into a single archive (usually compressed with gzip or bzip2), which makes it easy to move backups around or store them as snapshots. Unlike rsync, tar creates a complete copy of everything in one file rather than a mirrored directory structure.
cron is the Linux job scheduler. It's what ties everything together by running your backup scripts on a schedule, whether that's nightly, hourly, or weekly.
Duplicati and BorgBackup are worth mentioning as well. Both are open-source tools that handle deduplication, encryption, and remote storage more elegantly than raw rsync or tar scripts. If you want a more feature-complete solution, either of these is worth exploring. But for this guide, we'll focus on the built-in tools since they work everywhere.
Here's a practical rsync command that backs up a directory to a remote server over SSH:
rsync -avz --delete /var/www/ user@backup-server:/backups/www/
Breaking that down: -a enables archive mode, which preserves permissions, timestamps, symlinks, and ownership. -v is verbose output so you can see what's happening. -z compresses data during transfer. --delete removes files on the destination that no longer exist on the source, keeping the backup in sync.
If you're backing up locally (for example, to a second drive mounted at /mnt/backup), just swap the destination:
rsync -av --delete /var/www/ /mnt/backup/www/
For remote backups, it's worth setting up SSH key authentication so the script can connect without prompting for a password. Without that, automated scripts will fail silently.
Rather than running rsync directly from cron, it's cleaner to write a shell script that handles the logic, logging, and any error handling you want.
Here's a starting point:
#!/bin/bash
# Configuration
SOURCE="/var/www /etc /home"
DEST="user@backup-server:/backups/$(hostname)"
LOG="/var/log/backup.log"
DATE=$(date +"%Y-%m-%d %H:%M:%S")
echo "[$DATE] Backup started" >> "$LOG"
for DIR in $SOURCE; do
rsync -az --delete "$DIR" "$DEST" >> "$LOG" 2>&1
if [ $? -ne 0 ]; then
echo "[$DATE] ERROR: Failed to back up $DIR" >> "$LOG"
fi
done
echo "[$DATE] Backup complete" >> "$LOG"
Save this as something like /usr/local/bin/backup.sh and make it executable:
chmod +x /usr/local/bin/backup.sh
Test it manually before adding it to cron:
/usr/local/bin/backup.sh
Check the log file afterward to make sure everything ran correctly.
Once your script is working, cron handles the scheduling.
Open the crontab editor as root:
crontab -e
To run the backup every night at 2 AM, add:
0 2 * * * /usr/local/bin/backup.sh
Cron syntax follows the format: minute, hour, day of month, month, day of week. The asterisk means "every" for that field. If you want to run it more frequently, say every six hours, you'd write:
0 */6 * * * /usr/local/bin/backup.sh
Crontab Guru is a handy tool for generating and verifying cron expressions if you're not confident in the syntax.
Running the same rsync command every night works, but you'll eventually end up with only one copy of your data, and it'll always reflect the most recent state. If a file gets corrupted or accidentally deleted and you don't notice for a few days, your backup will be corrupted too.
Backup rotation solves this by keeping multiple dated snapshots. Here's an approach using tar to create timestamped archives alongside your rsync backup:
#!/bin/bash
BACKUP_DIR="/mnt/backup"
SOURCE="/var/www"
DATE=$(date +"%Y-%m-%d")
ARCHIVE="$BACKUP_DIR/www-$DATE.tar.gz"
# Create a compressed archive
tar -czf "$ARCHIVE" "$SOURCE"
# Delete archives older than 30 days
find "$BACKUP_DIR" -name "*.tar.gz" -mtime +30 -delete
The find command at the end handles cleanup automatically. You can adjust +30 to however many days of history you want to retain, keeping in mind the disk space implications.
File backups alone aren't enough if you're running a database. MySQL/MariaDB and PostgreSQL both need to be dumped properly to get a consistent, restorable backup.
For MySQL/MariaDB:
mysqldump -u root -p"$DB_PASSWORD" --all-databases | gzip > /backups/mysql-$(date +%F).sql.gz
For PostgreSQL:
pg_dumpall -U postgres | gzip > /backups/postgres-$(date +%F).sql.gz
These commands can be added to the same backup script and scheduled via cron alongside your file backups. Store the database password securely, ideally in a restricted file with chmod 600, rather than hardcoding it in the script.
Knowing a backup ran is as important as actually running it. You can configure cron to email you on failure by adding a MAILTO variable at the top of your crontab:
MAILTO=you@yourdomain.com
0 2 * * * /usr/local/bin/backup.sh
This only works if your server has a mail transfer agent configured (like Postfix). For a simpler approach, you can add a curl call inside your backup script to hit a webhook service like Healthchecks.io, which will alert you if a scheduled job stops checking in.
Keeping backups on the same server you're backing up isn't a real backup strategy; if the server fails, you lose both. At minimum, backups should go to a separate machine, a different location, or a cloud storage bucket.
rsync works great over SSH to a remote server. If you want to push to cloud storage, tools like rclone act as a bridge between your Linux server and services like AWS S3, Backblaze B2, or even SFTP destinations, using the same rsync-style syntax you're already familiar with.
A common pattern is the 3-2-1 rule: keep three copies of your data, on two different media types, with one copy offsite. It's a good target to work toward as your backup setup matures.
A backup that you've never restored from is just a backup you hope works. Schedule regular test restorations, even if it's just restoring a single file to verify the archive isn't corrupted. For tar archives:
tar -tzf /backups/www-2025-06-01.tar.gz | head -20
This lists the contents without extracting, letting you confirm the archive is intact. For a full test, restore to a temporary directory:
tar -xzf /backups/www-2025-06-01.tar.gz -C /tmp/restore-test/
Doing this even once a month will save you from the unpleasant surprise of discovering your backups were quietly failing for weeks.
Automated backups don't have to be complicated. With rsync, tar, and cron, you can have a working backup system in place within an hour, one that runs silently in the background and gives you real peace of mind. Start simple, test your restores, and add rotation and offsite storage as you go.
Whether you're running a small project or managing production infrastructure, xTom has the right solution to keep your workloads running reliably. We offer enterprise-grade dedicated servers, colocation services, IP transit, shared hosting, and a full range of IT services and solutions. For fast, scalable VPS hosting with NVMe storage, V.PS is a great fit for any workload, from dev environments to production deployments.
Ready to discuss your infrastructure needs? Contact our team to explore the right solution for your projects.
There's no single answer, but rsync is a great default for most use cases because it's fast, handles incremental transfers well, and works over SSH without any additional software. For more advanced needs like deduplication and encryption, BorgBackup is worth considering.
It depends on how much data you can afford to lose. For production servers, nightly backups are a reasonable baseline; for databases or frequently changing files, hourly or even more frequent snapshots might make sense. The key is matching your backup frequency to your recovery point objective (RPO).
Yes, and it's a good idea. Using rsync over SSH, you can push backups from your VPS to any remote server you have SSH access to. Just set up SSH key authentication first so the process can run unattended.
At minimum, back up /home, /etc, /var/www (or wherever your web files live), and your database dumps. The /etc directory is especially important since it holds your system and application configuration. You generally don't need to back up /tmp, /proc, /sys, or /dev.
Check your log files after each run and, more importantly, do test restores regularly. Listing the contents of a tar archive or restoring a file to a temporary directory confirms the backup is intact and restorable, not just present on disk.
Use backup rotation: automatically delete archives older than a set number of days using a find command with -mtime. Combine this with rsync for live mirrors and tar for point-in-time snapshots, and you'll keep storage manageable while retaining meaningful history.
A content delivery network (CDN) is a globally distributed system of servers that delivers web content to users faster by serving it from a location close to them. This article explains what CDNs are, how they work under the hood, and when you actually need one.
]]>CDNs are one of those foundational pieces of internet infrastructure that most people interact with dozens of times a day without realizing it. If you've ever streamed a video, downloaded a software update, or loaded a news article quickly from the other side of the world, you've almost certainly been served by a CDN. Understanding how they work isn't just useful trivia; it's practical knowledge for anyone building or managing anything on the web.
A CDN is a geographically distributed network of servers that work together to deliver internet content, such as web pages, images, videos, JavaScript files, and stylesheets, to users more efficiently.
The core idea is simple: instead of every visitor fetching content from a single origin server (say, one located in Dallas), a CDN places copies of that content on servers spread across many locations worldwide. When someone in Tokyo requests your website, they get it from a server in Tokyo, not one in Dallas. That cuts down the physical distance the data has to travel, which directly reduces latency and improves load times.
Those distributed servers are called edge servers or Points of Presence (PoPs). The closer a PoP is to the end user, the faster the content arrives.
The main mechanism behind a CDN is caching. When a user requests a piece of content, the CDN checks whether it already has a cached copy on the nearest edge server. If it does, it serves that copy directly. If it doesn't, the edge server fetches the content from the origin server, caches it locally, and then delivers it to the user. Subsequent requests for the same content from nearby users get served from the cache, without touching the origin server at all.
This is controlled by cache headers, specifically Cache-Control and Expires headers sent by your origin server. These tell the CDN how long to hold onto a cached copy before refreshing it from the source.
CDNs use intelligent routing to direct users to the best available edge server. The two most common methods are:
Anycast routing assigns the same IP address to multiple servers in different locations. When a user makes a request, the network automatically routes them to the topologically closest server. This is how many large CDN and DNS providers operate.
DNS-based routing uses the CDN's own DNS resolver to return different IP addresses depending on where the user is located. When your browser looks up a domain, the CDN's DNS responds with the IP of the nearest PoP.
CDNs are excellent at serving static content, which includes anything that doesn't change between users: images, fonts, CSS files, JavaScript bundles, videos, and downloadable files. These can be cached indefinitely (or until you update them) and served at full speed from the edge.
Dynamic content is trickier. Personalized pages, API responses, and anything generated on the fly can't simply be cached and reused. Modern CDNs have evolved to handle this through techniques like edge computing, where lightweight logic runs directly on the CDN's edge servers to handle some dynamic requests without going all the way back to your origin.
One underappreciated benefit of a CDN is how much traffic it absorbs before it ever reaches your origin server. If your site gets a spike in traffic, or even a DDoS-style flood of requests, the CDN's edge layer takes the brunt of it. Your origin server only needs to handle cache misses and dynamic requests, not every single page view.
When a CDN sits in front of your site, it handles the TLS handshake at the edge. This means the encryption and decryption overhead happens close to the user, reducing connection setup time, especially for visitors far from your origin.
Most CDNs support modern protocols like HTTP/2 and HTTP/3 (QUIC), even if your origin server only speaks HTTP/1.1. This translates to multiplexed requests, header compression, and faster connection establishment for end users.
CDNs act as a shield between the public internet and your origin. Because they're built to handle enormous volumes of traffic across many servers, they can absorb and filter out distributed denial-of-service attacks more effectively than a single server ever could. This isn't their only purpose, but it's a significant operational benefit.
Many CDN providers bundle WAF capabilities, allowing you to filter malicious traffic, block known attack patterns, and enforce rate limits before requests reach your application.
Getting started with a CDN doesn't require deep infrastructure changes. Here's how the process generally works:
1. Choose a CDN provider. Major options include Cloudflare, Fastly, Amazon CloudFront, and Bunny.net, among others. Each has different pricing models, PoP coverage, and feature sets.
2. Point your DNS to the CDN. You'll update your domain's DNS records to route traffic through the CDN's network. With some providers this is as simple as changing your nameservers; with others you add a CNAME record pointing to the CDN's hostname.
3. Configure your cache rules. Tell the CDN what to cache, for how long, and what to pass through to your origin. Most providers have sensible defaults, but you'll want to tune these for your specific application, especially if you have a mix of static assets and dynamic pages.
4. Set cache-control headers on your origin. The CDN reads these to know how long cached content is valid. For static assets that rarely change, a long max-age (days or weeks) is fine. For HTML pages, a shorter TTL or conditional caching might make more sense.
5. Invalidate the cache when you deploy. When you push a new version of your site or update static files, you need to tell the CDN to clear its cached copies. Most providers offer instant cache purging via API or dashboard.
Not every project needs one on day one, but there are clear signals that it's time to consider adding a CDN to your stack.
You should think about a CDN if your users are geographically spread out and you're seeing latency complaints from certain regions. If your site serves a lot of large static assets, the bandwidth savings alone can justify the cost. If you're running a site that gets irregular traffic spikes (e-commerce launches, media coverage, etc.), the offload protection is genuinely valuable. And if uptime is a priority, a CDN adds a redundancy layer that helps absorb failures at the origin.
On the other hand, if you're running a small internal tool used by people in a single city, or a prototype not yet in production, a CDN is probably overkill at that stage.
A CDN doesn't replace a well-configured origin server; it complements one. How your underlying infrastructure is set up still matters a great deal. A slow, underpowered origin will still cause slowdowns on cache misses and for any dynamic content that bypasses the cache entirely.
This is where your hosting foundation comes in. Whether you're running a VPS, a dedicated server, or a colocated setup, the performance characteristics of your origin directly affect the user experience that your CDN delivers. A CDN can dramatically reduce how often users hit your origin, but when they do, you want that origin to be fast.
It's also worth noting how CDNs interact with IP transit. CDN providers maintain their own high-capacity network backbones and private peering agreements. When you use a CDN, your content often travels across private networks rather than the public internet, which contributes to the speed and reliability improvements users experience. Understanding IP transit can help you reason about why this matters if you're building infrastructure at scale.
Third-party CDN services are the default choice for most teams, and for good reason: they're quick to set up, managed for you, and backed by global infrastructure that took years and serious capital to build. But there's a subset of use cases where running your own CDN-like infrastructure makes sense, and it's worth understanding what that actually involves.
If you're running a large platform with significant, predictable traffic, the per-bandwidth costs of commercial CDN providers can add up fast. At scale, owning your delivery infrastructure can be more economical. Similarly, if you have strict data sovereignty requirements, specific compliance needs, or want full control over how your content is cached and routed, a self-hosted setup gives you options that a third-party provider might not.
Media companies, large SaaS platforms, game distribution networks, and telecommunications providers often operate their own CDN infrastructure for exactly these reasons.
Building a CDN-like system from scratch means assembling several components yourself. At a high level you need:
Geographically distributed servers. The whole point is edge proximity, so you need servers (or VMs) in multiple regions. This typically means either leasing space in data centers around the world or using a colocation provider with a footprint in your target regions.
A caching layer. Software like Varnish Cache or Nginx with its proxy caching module are the most common choices for handling caching at the edge. Both are well-documented and widely used in production.
A routing mechanism. You need a way to send users to their nearest edge node. Anycast routing (which requires BGP and your own IP address space) is the cleanest approach, but it has real operational complexity. A simpler alternative is GeoDNS, where your authoritative DNS server returns different records depending on the user's location. Services like PowerDNS support this natively.
An origin pull mechanism. Your edge nodes need to know how to fetch content from your origin when they don't have a cached copy, and how long to hold onto it.
Cache invalidation and management. When content changes, you need a way to purge cached copies across all your edge nodes. This is usually handled via an API call that triggers a purge across your fleet.
Monitoring and health checks. A CDN that silently fails at an edge node and routes users to a cold origin defeats the purpose. You need visibility into cache hit rates, node health, and latency across locations.
Running your own CDN isn't just a one-time setup task; it's ongoing infrastructure you're responsible for. That means patching, monitoring, capacity planning, and dealing with edge node failures. You also won't have the same global PoP coverage as a major commercial provider unless you're willing to invest significantly in server deployments across many regions.
For most teams, the answer is to use a commercial CDN and focus engineering effort elsewhere. But for the teams where cost, control, or compliance make self-hosting worth it, the tooling is mature and the path is well-trodden. Starting with a handful of strategically placed edge nodes in your highest-traffic regions, rather than trying to match a commercial provider's footprint from day one, is usually the pragmatic way to approach it.
Web hosting is where your actual website files and application logic live, typically on an origin server. A CDN is a separate layer that sits between your origin and your users, caching and delivering content from edge locations closer to them. Most sites use both; hosting provides the origin, the CDN accelerates delivery.
Yes, with some nuance. Static assets on a dynamic site (images, CSS, JS) are still cached and served efficiently by a CDN. Truly dynamic, user-specific content usually can't be cached, though modern CDNs offer edge computing features that can handle some dynamic logic at the edge without reaching the origin.
Indirectly, yes. Google uses page speed as a ranking signal, and CDNs can significantly reduce load times, particularly for users far from your origin server. Faster pages also reduce bounce rates, which matters for engagement metrics.
Most CDN providers are built for high availability across many redundant edge nodes. A failure at one PoP typically fails over to another automatically. However, if a provider has a major outage (it happens), traffic can fall back to your origin, which may become overwhelmed if it isn't sized to handle the full load. This is worth factoring into your architecture planning.
They overlap but aren't the same. A reverse proxy sits in front of your origin server and forwards requests to it, optionally caching responses. A CDN is essentially a globally distributed reverse proxy network. All CDNs act as reverse proxies, but not all reverse proxies are CDNs.
Yes, and some organizations do exactly that. The typical approach involves deploying caching servers (usually Nginx or Varnish) in multiple geographic locations, using GeoDNS or Anycast routing to direct users to the nearest node, and building a cache invalidation mechanism to push updates across the fleet. The tradeoff is operational overhead: you're taking on the responsibility of managing, patching, and monitoring that infrastructure yourself. It tends to make sense for large platforms with high, predictable traffic volumes where per-bandwidth CDN costs are significant, or where data sovereignty or compliance requirements make third-party providers a poor fit.
Cache invalidation is one of the genuinely tricky parts of CDN management. When you update content on your origin, cached copies on edge servers don't automatically refresh until their TTL expires. Most CDN providers offer cache purge APIs so you can manually invalidate specific URLs or entire directories immediately after deploying changes. For static assets, a common pattern is to append a version hash to filenames (e.g., app.a3f4bc2.js) so each new version is treated as a completely new file and the old one expires naturally.
CDNs are one of the most practical tools in modern web infrastructure. They reduce latency for users around the world, take load off your origin servers, improve resilience under traffic spikes, and add a useful security layer in front of your application. Understanding how they work, from edge caching to request routing to TLS termination, helps you configure them properly and make smarter decisions about your overall stack. And if you're at the scale where building your own CDN infrastructure starts to make sense, the same principles apply; you're just operating the edge nodes yourself.
If you're building out infrastructure to support a CDN-backed architecture, or exploring self-hosted edge caching with servers in multiple regions, xTom has you covered. xTom offers enterprise-grade dedicated servers, colocation services, and IP transit for teams that need serious network performance and control. For scalable, NVMe-powered VPS hosting, V.PS is built for production workloads of all sizes. If you need shared hosting to get started quickly, that's available too at vps.hosting. You can browse the full range of xTom services here.
Ready to discuss your infrastructure needs? Contact the xTom team to explore the right solution for your projects.
]]>