Guilherme Bandeira Rondon on Guilherme Rondon

Intrusion detection in kube containers: uid invariants and kernel auditing

Tue, 27 Oct 2026 18:00:00 -0300

In the first post I made the cluster harder to attack, but nothing there tells me whether an attack happened. If a process escaped a container, I wouldn’t know.

This second post in the series is about detecting that escape, with two tools: a periodic check that relies on a rule left behind by user namespaces, and kernel auditing, which records events the instant they happen. The third post covers the traffic coming in from the internet.

From RBAC to AppArmor: six phases to harden k3s on a Raspberry Pi

Sun, 25 Oct 2026 20:00:00 -0300

In the post about the migration to Gitea I described how I got my projects’ builds working inside the cluster. To get there, I took a shortcut: the Gitea runner (the program that executes the CI workflows) got far more privileges than it needed.

the containerd socket, the file through which you give orders to the program that runs the containers on the node. Whoever can write to it can ask for a container running as root with the Pi’s whole disk mounted;
the directory holding the cluster’s images and data;
the admin kubeconfig, the credential that lets kubectl do anything: read passwords, create and delete any resource.

It worked, but any workflow from any repository had access to the whole cluster. All it takes is an npm ci that installs a compromised dependency: its script runs inside the job and only has to read the kubeconfig sitting right there.

My Site Went Down, and It Was My Neighbours' Fault

Thu, 10 Sep 2026 15:00:00 -0300

This wasn’t the first time. A few weeks earlier I’d noticed the site down one morning — no SSH, but the TX/RX lights blinking normally. I power-cycled it, everything came back fine, and as a precaution I turned on persistent logging on the homelab. I left it at that and moved on.

Then, the day before I started writing this post, the Raspberry Pi that hosts this site went down again, out of nowhere. The site returned a 502, SSH hung, and I did what’s usually my first attempt at a quick fix: pulled the power, expecting it to come back. It did — but the instability persisted, and after a few minutes I decided to log into the Pi remotely.

Behind Intercept Brasil's donation ask: hypotheses on cache, edge, and origin

Mon, 27 Jul 2026 14:00:00 -0300

I came across a sponsored post from Intercept Brasil asking for donations to reinforce the site’s security. According to the outlet itself, the story involving the leaked audio between Flávio Bolsonaro and banker Daniel Vorcaro went offline shortly after being published, and now they’re asking readers for money so it doesn’t happen again.

Split to double: what I learned bringing two solutions to a hackathon

Sun, 19 Jul 2026 20:00:00 -0300

Three weeks before haCARthon started, I was supposed to have my head buried in excerpts of Brazil’s Forest Code, validating queries against geo databases of Brazilian municipalities. Instead, I was on a video call trying to convince my four-person team to split into two.

It wasn’t an impulsive decision. It was the conclusion of an entire month immersed in a challenge I didn’t expect to enjoy this much.

R$15,000 was the hook I was missing

I was never much of a hackathon enthusiast. But this time the hook was direct: my partner, a UX/UI designer, got an email from PanicLobster — the event organizer — announcing that in a month haCARthon would take place, with a R$15,000 prize for each of the five winning teams. The incentive sparked my interest enough to go dig into the proposed challenges.

From raw electoral files to a dimensional model: building a data pipeline for Brazil's 2026 elections

Fri, 10 Jul 2026 14:00:00 -0300

In 2024, the election coverage I worked on depended on a very expensive third-party system, which went down right on the night of the count and nearly turned the coverage into a total loss. In 2026 the decision was different: instead of buying a ready-made solution, another developer and I built the pipeline in-house in about three months, with six small services and a single daily schedule.

The first post in this series told the story: three encounters with Brazil’s electoral data, and the third time the build was mine to lead. This post is that build — what the TSE (Brazil’s electoral authority, which runs every election and publishes the data behind it) actually publishes, how that data lands, and how it became a structured model an API could serve.

I gave Claude 12,732 memories. Here's what it noticed.

Mon, 06 Jul 2026 14:00:00 -0300

I put the memory system together, used it for a couple months, and then stopped to look at what it had actually accumulated.

The previous post describes how the three layers work: CLAUDE.md for static context, MemPalace for dynamic session memory, a knowledge graph for structured facts. MemPalace is not Claude’s built-in memory feature — it’s infrastructure I run myself, with memories stored in ChromaDB and SQLite on my machine and integration over MCP (Model Context Protocol), an open standard any compatible client can speak. If I swapped models tomorrow, everything it has accumulated would stay put.

The memory stack under the AI workflow: CLAUDE.md, MemPalace, and a knowledge graph

Sat, 04 Jul 2026 16:00:00 -0300

The first post in this series was about the practice — how I structure prompts, iterate in short cycles, and delegate mechanical work while keeping judgment on my side. This one is about the infrastructure underneath that practice: the three-layer memory system that makes it work across sessions, projects, and weeks.

None of these layers is technically complex. The value comes from how they fit together.

The problem with AI memory (briefly)

Language models have no persistent memory. Every session starts blank. That’s fine for a one-off question, but if you’re using AI as a serious development tool, it creates friction: re-explaining project structure, re-establishing conventions, correcting the same behavior you already corrected last week.

Three elections, three encounters with Brazil's electoral data — and the third time, it was mine to lead

Fri, 03 Jul 2026 10:00:00 -0300

Election night, 2024. The screen we’d spent months building to cover vote counting across Brazil goes dark — not our servers, not our code. A third-party .NET system, running on a machine we handed over but never had access to, buckles under the exact load it was bought to handle.

Using AI and soccer match data to build my own commentator

Mon, 29 Jun 2026 16:00:00 -0300

Somewhere in the middle of those code sessions, I had a simpler thought: if I, as a software developer, could make sense of that same stream — typed events, timestamped, player names, statistics attached — why couldn’t an LLM?

It was from that premise that I started this project.

Building for the World Cup: real-time fan narration and automated editorial

Wed, 24 Jun 2026 21:30:00 -0300

A goal is scored at a World Cup match. Sixty seconds later, a push notification lands on a fan’s phone — with the player’s name, the minute, and a line of narration. No journalist wrote it. No one pressed send. The system just knew.

The AI workflow nobody shows you: structure, memory, and real trade-offs

Mon, 22 Jun 2026 14:00:00 -0300

There’s a difference between using AI and using AI well. The second requires you to think about what you’re doing — not just in the prompt you write, but in the structure you build around the tool.

I’ve been developing this practice over the past few months, both at work and in personal projects. What I’ve learned isn’t about which model is best or which tool has the most features. It’s about how to organize context so that AI is consistently useful — not just in the first session, but in the tenth.

From GitLab to Gitea: how my homelab CI/CD went from 3.4 GB to 100 MB

Sun, 21 Jun 2026 17:00:00 -0300

One of my repositories has a commit history that reads like a story in three acts. The first is about personal ambition. The second is about a Raspberry Pi that went silent in the middle of the night . The third is about finding the right tool for the right load.

Act I: GitHub Actions with a self-hosted runner

The starting point was simple: I wanted CI/CD running on the Pi, builds happening locally, automated deployments. The natural choice was to keep using GitHub Actions — but with a self-hosted runner in the cluster.

Traefik as ingress on k3s: from local routing to public access without cert-manager

Sun, 21 Jun 2026 09:00:00 -0300

When I started setting up my homelab on a Raspberry Pi 4B, one of the first questions was: how do I make multiple services running on the cluster each respond on their own domain, without opening a different port for each one?

I already knew the answer — I remembered working with EKS on AWS in the past, where ingress was a separate component that needed to be installed and configured. On k3s, it comes included, name and all: Traefik.

Gitea on Raspberry Pi: the story of how GitLab took down my homelab

Sat, 20 Jun 2026 09:00:00 -0300

It was a Friday night and I was proud of what I had just built. I had just brought up GitLab Community Edition on my Raspberry Pi 4B — a long-held dream of having a complete development environment entirely under my own control. Git, CI/CD, registry, all in a small box sitting on the shelf.

I went to sleep.

Saturday morning, I opened the terminal to push something and found… silence. The Raspberry Pi wasn’t responding. SSH timeout. No ping. I walked over to the shelf, looked at the slowly blinking green LED, and understood: GitLab’s memory footprint — likely a slow leak compounded by background jobs competing for CPU — had starved every other service on the node until the kernel had no choice but to intervene. The Pi had rebooted, and without enough headroom to bring everything back up, it just sat there.

Who am I?

Fri, 19 Jun 2026 09:00:00 -0300

There’s a memory I carry with a lot of fondness: sitting on a bench at my technical school, graph paper on the desk, pen in hand — no computer in sight. The teacher had written a snippet of C code on the blackboard and the task was simple: trace the execution. Variable by variable, call stack by call stack, by hand.

That hooked me instantly — and changed the way I think about everything.

About

Mon, 01 Jan 0001 00:00:00 +0000

Software engineer who solves problems and simplifies processes. For nearly 10 years I have designed and built backend, data and distributed systems grounded in analysis and fundamentals, to deliver resilience, quality and efficiency. Today I also bring AI into production work.

Let's talk

Mon, 01 Jan 0001 00:00:00 +0000

Opportunities, projects, a question about a post, or just a chat about backend, data and AI.