Home on Preston Bernstein

A Clean ClamAV Scan Doesn't Mean the File Is Safe

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

A clean ClamAV scan means nothing matched a known signature. It does not mean the file is safe. I run a scan gate in front of my media-download pipeline: everything that lands from the download clients gets checked by a ClamAV daemon before it’s allowed into the library. For a long time I treated a clean verdict as the end of the question. It isn’t. ClamAV is a signature engine, and signature engines only catch what someone has already seen, fingerprinted, and shipped a rule for. Zero-days and packed or obfuscated executables walk right past it, and the gap is worse than it sounds because ClamAV is open source. Anyone can download the exact detection logic and test their malware against it before release. That’s not a hypothetical; researchers have measured samples built specifically to dodge open-source detectors evading ClamAV on the order of 70 to 85 percent of the time, without even needing inside knowledge of the engine.

Building a Self-Throttling Governor for Claude Max With No Published Ceiling

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

Anthropic will not tell you how many tokens or messages Claude Max 20x actually gives you, and I had to build a throttle for it anyway. I run several personal research projects on background schedules through claude -p, unattended fires that call Claude Code from cron and systemd timers while I’m not watching. Those fires draw from the exact same quota as the interactive Claude Code sessions I use to do actual work. If a background job burns the pool at 2pm, my 2:15pm session pays for it. I wanted those jobs to back off automatically as usage climbed, and hand back the room the moment I sat down to work. The problem is that Anthropic gives you nothing to calibrate that against.

Fifteen of Eighteen Root Causes I Was Sure About Were Wrong

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

Fifteen of eighteen root causes I proposed for four firing alerts turned out to be wrong. Four alerts were going off across my home infrastructure at once: a stuck download post-processing backlog, and three separate automation alerts tied to a video-discovery pipeline. My first instinct on each one was the usual instinct: form a theory fast, patch it, watch the alert clear. Instead I forced myself to generate every plausible root cause I could find, then attacked each one before touching anything. Eighteen candidates went in. Three survived. That refutation rate is the actual finding here, more than any single bug I fixed.

Gaming Desktop or Dedicated Compute Box: Idle Power Decides, Not Sticker Price

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

Idle power draw, not the price tag on a mini PC, is what actually decides whether a dedicated low-power compute box saves you money over running everything on a gaming desktop. A gaming desktop idles somewhere around 80-200W depending on the board, PSU, and how many drives are spinning. A purpose-built low-power box, the N100-class mini PCs and similar, idles at 10-15W. That gap is real and it’s large. Whether it means anything for your electricity bill depends entirely on one question: does buying the mini PC let the desktop actually power off or sleep when you’re not gaming? If the answer is no, the math falls apart, and I found that out the hard way while pricing hardware for my own setup.

It Took Nine Fixes to Stop a LightRAG Crash. The First Eight Were All Real Bugs

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

A bulk-reprocess job against one of my LightRAG instances crashed three times in one afternoon, and I shipped eight legitimate fixes before I found the actual cause. That same afternoon I’d also fixed a false-positive bug in the GPU broker that arbitrates my home GPU between gaming and local inference. The two bugs had nothing to do with each other. They just happened to land on the same day, which made it tempting at first to blame one on the other. I want to walk through the LightRAG crash specifically, because the honest version of this story is that most of my fixes were correct and still didn’t solve it.

Mini-ITX Is the Wrong Form Factor for a Quiet AI Home-Lab PC

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

The choice that matters most in this build is form factor, and the trendy answer is wrong for the job. Every “quiet home-lab PC” guide points at mini-ITX: small, tucked in a corner, low power draw. I already own an RTX 3060 and want a box around it that stays quiet, stays cool, and lets me swap the CPU, RAM, storage, and eventually the GPU without replacing the motherboard underneath them. Mini-ITX fails on all three requirements at once, and it took reading real bench data and practitioner threads, not case marketing copy, to see why.

My GPU Broker Kept Killing Inference Jobs for Games That Weren't Running

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

A Go service I run at home kept canceling in-flight LLM inference jobs because it thought a game had launched, and most of the time nothing had launched at all. The service is a broker that arbitrates my desktop’s single GPU between gaming, Plex transcoding, and local inference through Ollama. When it detects gaming or Plex activity, it force-cancels whatever inference request is running and unloads the model from VRAM, no exceptions, because in my house whoever is playing a game or watching something wins that argument. That priority order is correct. The detector deciding when to enforce it was not.

No Embedding Server Survives a GPU Yield Gracefully. I Had to Build That Layer Myself

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

Every embedding server I tested handles a vanished GPU the same way: queue requests until a buffer fills, then reject them. Ollama does this. Text Embeddings Inference (TEI) does this. Infinity and llama.cpp do it too, with different buffer sizes and different error codes but the same shape. None of them pause a request and wait out a short GPU outage. They drop it, either immediately or once a queue limit is hit. I run one GPU at home across gaming, media transcoding, and every local model behind my personal tools, and a broker process decides who gets the card and when. That gap between reject-fast and wait-it-out is what forced me to build the missing layer myself.

Not Every Docker Container Belongs on the NAS

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

Family-facing and storage-coupled services stay on the NAS. Compute-heavy personal projects move to a separate host with real memory to spare. That’s the whole framework, and I only arrived at it after a Synology DS1522+ with 8GB of RAM spent months running roughly 35 Docker containers and periodically falling over under memory pressure. ContainerManager doesn’t fail loudly when it runs out of headroom. It stalls, swaps, and eventually kills something, and figuring out which container mattered enough to protect took longer than it should have.

Rebuilding a Home Network from the Modem Up, One Phase at a Time

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

I rebuilt my home network from the ISP modem outward instead of swapping in a new router and hoping the rest sorted itself out. The order was: modem into passthrough (a mode where the ISP box stops doing routing and just hands its public IP straight through), then a UniFi gateway and switch as the core, then Pi-hole DNS filtering running on a Raspberry Pi controller, then every downstream device reconnected one at a time. Bottom-up, slowest layer first, nothing skipped ahead of something it depended on.

Run One Observability Stack, Not One Per Repo

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

Run one shared Grafana and Prometheus stack for your whole home lab, not one per repo. I have around 30 GitHub repos and 15-20 always-on self-hosted services running mostly on one desktop plus a NAS, and I recently found two separate Grafana containers on that desktop, each spun up by a different project’s docker-compose file, each with its own dashboards nobody was cross-referencing. That’s the anti-pattern this post argues against, and it happened because “just add a Grafana container to the compose file” felt like the path of least resistance at the time.

RunPod Beats Gemini on Cost for My Vision Pipeline, and the Idle-Stop Feature It's Missing

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

I run vision-model inference for a personal image pipeline on RunPod GPUs instead of calling Google’s Gemini API, and the decision has nothing to do with accuracy. Gemini wins on accuracy. RunPod wins on cost, as long as I babysit it correctly, and the babysitting turned out to be the actual engineering problem. This is a companion piece to the estate-sale scanner series on this blog, one narrow decision about where the vision step runs, not a rewrite of that whole pipeline.

Shipping Fast Isn't the Same as Being Done: Auditing a CLI My Agent Pipeline Built in an Afternoon

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

Shipping fast is not the same as being done, and I had to learn that the expensive way with a CLI tool an agent pipeline built for me in one afternoon. The pipeline is one I built myself: I give it a one-line description of what I want, it writes a spec, runs that spec through seven parallel agents whose only job is to attack it from different angles, spins up parallel build agents against the hardened spec, runs a full code review pass, then smoke-tests the real thing before calling it done. For a small outreach-automation CLI (local SQLite state, a human approval gate before anything goes out, a GitHub-facing sourcing loop), that pipeline produced working software in an afternoon. It ran. It did the job I asked for. It was also not something I trusted enough to extend to a second platform without checking it first.

Three Failure Modes Wearing One Name: Running Concurrent Claude Code Agents Without State Drift

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

Running four or five Claude Code agents at once across separate repos felt like one problem: things drifting out of state while I wasn’t watching. It turned out to be three separate failure modes wearing one name, and each one needed a different fix. Worktree sprawl (leftover git checkouts an agent session opened and nobody closed) was mostly a feature I hadn’t turned on, not a missing tool. Deploy drift (a running service that no longer matches what an agent thought it built) was a problem I’d already solved once, for one project, and just needed to generalize. Wasted compute across my machines is the one piece nothing solved, and it’s still open. Treating all three as one complaint is exactly what kept me from seeing that only one of them was actually about drift.

Tuning LightRAG Ingestion Concurrency Against a Rate-Limited Gemini API

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

Feeding a few hundred books into LightRAG through Gemini taught me that concurrency tuning is the wrong first lever, and the rate-limit table you’d normally tune it against doesn’t exist anymore anyway. I run a personal knowledge-graph project that ingests close to a thousand book-length documents through LightRAG (HKUDS), using Gemini for entity extraction and embeddings behind a LiteLLM proxy. The corpus is entity-dense enough that the LLM merge phase dominates ingestion time, and early runs kept marking documents FAILED with no obvious cause in the LightRAG logs. This post covers what I found chasing that down: the actual concurrency knobs, why Gemini’s rate limits are a moving target now, and the one setting that mattered more than any of it.

What a $364 Claude Code Session Taught Me About Running Agents Unattended

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

A single Claude Code session in my home lab cost $364. I found it on my own /usage report, not from a billing alert, and it was enough to make me stop and read the full week behind it instead of writing it off as one bad run.

What If Two Independently-Built Agent Suites Reviewed Each Other's Code?

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

The idea is this: run two coding-agent orchestration suites that share none of the same prompts, config, or instruction derivation, and make them review each other’s pull requests the way two engineers with different judgment catch each other’s mistakes. Suite A opens a PR. Then suite B, built from scratch with no visibility into how A was built, reviews it cold. Suite A reads the review, decides what’s real, and applies fixes. The loop can repeat from there. I thought of this on my own, then went and checked whether it already existed somewhere, because that’s usually the fastest way to find out if an idea is obvious or overlooked.

Why the XPS 17 Offload Box Runs Proxmox, Not Plain Ubuntu

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:02:27 +0000

Proxmox VE won the decision, and the reason is simple: five separate workloads sharing one box is exactly the situation where isolation stops being a nice-to-have. I had an old Dell XPS 17 sitting around and a growing list of services that needed a new home. Instead of buying dedicated hardware, I closed the lid, racked the laptop, and pointed five different stacks at it. Picking the OS underneath that decision took longer than I expected, because the obvious answer (plain Ubuntu Server plus Docker Compose, matching every other machine I run) turned out to be the wrong one for this specific job.

A Native Hugo Image Pipeline: WebP, LQIP Blur-Up, and Mermaid Diagrams

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 18:00:00 +0000

This site had no image pipeline until this week. Every image in every post loaded at its original file size and format, usually a multi-megabyte PNG screenshot, with no responsive sizing and no loading placeholder. Diagrams worked through exactly one path: a Blowfish theme shortcode you had to remember to wrap your diagram in by hand, with no way to drop a diagram into a plain fenced code block the way you would in a GitHub README or almost anywhere else that renders Markdown. I fixed both problems in the same pass, because they share a mechanism: Hugo render hooks, which let a site override how the built-in Markdown renderer turns one specific element — an image, a code block — into HTML.

Deciding What Fits: Inside My Resale-Clothing Monitor

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 16:36:57 +0000

My resale-clothing monitor’s hardest problem isn’t finding new listings. It’s deciding which ones match my taste well enough to interrupt me about, and the design leans hard toward false positives over false negatives in a way I can defend today but haven’t stress-tested. This is part 3 of a series; part 1 covers the shared architecture, and part 2 covers a sibling project, an estate-sale scanner, that runs on the same foundation.

Deciding What's Worth a Saturday: Inside My Estate-Sale Scanner

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 16:36:57 +0000

My estate-sale scanner’s real job is deciding which of a week’s new listings are worth a Saturday drive, and the interesting part isn’t the scraping. It’s how the system scores unlabeled photos, and an asymmetric feedback loop that treats a bad sale and a good sale as very different kinds of evidence. This is part 2 of a series; part 1 covers the shared architecture and GPU constraints behind this and a second project.

Scrape, Score, Alert: The Pattern Behind Two Home-Lab Vision Pipelines

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 16:36:57 +0000

Two personal tools I’ve built, an estate-sale scanner and a resale-clothing monitor, run on the exact same architecture: scrape listings, score every photo with a local vision model, surface only the ones worth my attention. This post covers that shared foundation, one SQLite-only pipeline and one shared GPU, and the two decisions in it I’m still not fully sure were right. Two follow-ups go deep on how each project decides what actually counts as a match: Deciding what’s worth a Saturday for the estate-sale scanner, and Deciding what fits for the resale monitor.

GitHub's Agents Tab Puts Claude and Codex in the Repo UI. It's a Separate Bill From Claude Code.

contact@prestonbernstein.com (Preston Bernstein) — Mon, 10 Aug 2026 12:30:00 +0000

GitHub’s per-repo Agents tab is a mission-control surface, live since January 26, 2026, where GitHub-hosted coding agents pick up issues and turn them into PRs without anyone opening a terminal. Copilot’s own agent lives there by default, and Claude and Codex are selectable alongside it as “picked” third-party agents. The tab is part of Agent HQ, the umbrella GitHub announced on October 28, 2025, meant to give every agent vendor one shared surface inside Issues, PRs, and Actions instead of a pile of separate integrations. My read after digging into how it actually works: this is a real product, not a rebrand of anything Anthropic ships, and it solves a narrower slice of my workflow than local Claude Code already covers. Whether I keep reaching for it once the novelty wears off is the part I genuinely don’t know yet.

Step-by-Step Guide to Creating a Secure Docker Compose Script with VPN Integration

contact@prestonbernstein.com (Preston Bernstein) — Mon, 01 Jul 2024 22:01:16 +0000

Introduction
#

Docker containers share the host’s network stack by default. Any service you run is only as private as the connection it’s running on, unless you put something in front of it. Routing a container’s traffic through a VPN container fixes that: requests leave through the VPN, not your raw connection, and the container’s real IP stays hidden.

Privacy

contact@prestonbernstein.com (Preston Bernstein) — Mon, 01 Jan 0001 00:00:00 +0000

Responsibility of Contributors
#

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Purus, donec nunc eros, ullamcorper id feugiat quisque aliquam sagittis. Sem turpis sed viverra massa gravida pharetra. Non dui dolor potenti eu dignissim fusce. Ultrices amet, in curabitur a arcu a lectus morbi id. Iaculis erat sagittis in tortor cursus. Molestie urna eu tortor, erat scelerisque eget. Nunc hendrerit sed interdum lacus. Lorem quis viverra sed

Home on Preston Bernstein

A Clean ClamAV Scan Doesn't Mean the File Is Safe

Building a Self-Throttling Governor for Claude Max With No Published Ceiling

Fifteen of Eighteen Root Causes I Was Sure About Were Wrong

Gaming Desktop or Dedicated Compute Box: Idle Power Decides, Not Sticker Price

It Took Nine Fixes to Stop a LightRAG Crash. The First Eight Were All Real Bugs

Mini-ITX Is the Wrong Form Factor for a Quiet AI Home-Lab PC

My GPU Broker Kept Killing Inference Jobs for Games That Weren't Running

No Embedding Server Survives a GPU Yield Gracefully. I Had to Build That Layer Myself

Not Every Docker Container Belongs on the NAS

Rebuilding a Home Network from the Modem Up, One Phase at a Time

Run One Observability Stack, Not One Per Repo

RunPod Beats Gemini on Cost for My Vision Pipeline, and the Idle-Stop Feature It's Missing

Shipping Fast Isn't the Same as Being Done: Auditing a CLI My Agent Pipeline Built in an Afternoon

Three Failure Modes Wearing One Name: Running Concurrent Claude Code Agents Without State Drift

Tuning LightRAG Ingestion Concurrency Against a Rate-Limited Gemini API

What a $364 Claude Code Session Taught Me About Running Agents Unattended

What If Two Independently-Built Agent Suites Reviewed Each Other's Code?

Why the XPS 17 Offload Box Runs Proxmox, Not Plain Ubuntu

A Native Hugo Image Pipeline: WebP, LQIP Blur-Up, and Mermaid Diagrams

Deciding What Fits: Inside My Resale-Clothing Monitor

Deciding What's Worth a Saturday: Inside My Estate-Sale Scanner

Scrape, Score, Alert: The Pattern Behind Two Home-Lab Vision Pipelines

GitHub's Agents Tab Puts Claude and Codex in the Repo UI. It's a Separate Bill From Claude Code.

Step-by-Step Guide to Creating a Secure Docker Compose Script with VPN Integration

Introduction #

Privacy

Responsibility of Contributors #

Introduction
#

Responsibility of Contributors
#