Short one this week my friend, energy's a bit low on my end, but two kernel vulnerabilities landed that are too important to skip, so let's get into it.

Two old, nasty kernel bugs got public exploits this week. If you're running KVM or any kind of multi-tenant containers, this is a "patch today, not this weekend" situation.

GhostLock (CVE-2026-43499) is a 15-year-old use-after-free bug in the Linux kernel's futex/rtmutex subsystem. It lets an unprivileged local user grab root and escape containers on unpatched systems. This one's been sitting quietly since 2011, affects pretty much every major distro, and researchers have already shown a reliable exploit that gets root in about five seconds. It also breaks container isolation, so if you're self-hosting anything multi-tenant, take this seriously.

Januscape (CVE-2026-53359) is a 16-year-old use-after-free in KVM's shadow MMU implementation. It can let an attacker escape a guest VM and run code on the host, on both Intel and AMD systems. Cloud providers and anyone running untrusted workloads in virtualized environments are the biggest targets, but if you run KVM at home, it's worth checking your patch status too.

Two decade-plus-old bugs surfacing with working exploits in the same week is a good reminder that "old and stable" doesn't mean "safe to ignore."

📚 Worth reading from Linux Handbook

A Postgres instance on a remote server, port 5432 not exposed to the internet (rightly so). How to access it? The fix is SSH tunneling, and this tutorial walks through all three flavors with the actual commands and real use cases behind them.

• Local forwarding (-L) to reach a remote service, like that Postgres box, as if it were running on your own machine
• Remote forwarding (-R) to expose something local, like a webhook receiver on your dev machine, to the outside world through a VPS
• Dynamic forwarding (-D) to turn your SSH connection into a SOCKS proxy for encrypting your traffic on untrusted WiFi

If you've ever wanted to skip standing up a VPN just to reach one service, this is worth ten minutes of your time. Read the full guide.

Also recent, in case you missed them:

• I Like This Fuzzy Search Finder Better Than Find Command in Linux, a quick case for swapping find for fzf in your daily workflow
• These 11 Open Source Tools Completely Improved My Docker Workflow, a practical roundup if you're managing more than a couple of containers

💡Quick terminal tip

Most Linux users know how to extract archives, but tar includes several lesser-known options that can make working with archives safer and more efficient.

Before extracting an archive, inspect its contents:

tar -tf archive.tar.gz

This lists every file and directory inside the archive without extracting anything.

To avoid cluttering your current directory, extract the archive into its own automatically created folder:

tar -xf archive.tar.gz --one-top-level

If you prefer a custom directory name instead, specify it explicitly:

tar -xf archive.tar.gz --one-top-level=archive

Finally, you don't have to extract the entire archive. To restore only specific files or directories, list them after the archive name:

tar -xf archive.tar.gz path/to/file.txt docs/

This is particularly useful when working with large source archives or backups where you only need a handful of files.

🛠️ Tool discovery

Let's find your next favorite software in this section.

DarkMoon: AI-Powered Autonomous Penetration Testing Platform

DarkMoon is an open-source platform that runs full penetration tests using AI agents that plan, execute, and validate real exploits against a target, across web apps, Active Directory, and Kubernetes.

Why use it? Well, manual pentesting takes weeks and a proper consultant costs thousands a day, and Dark-Moon automates that entire loop, from recon to a structured, evidence-backed report, using 50+ integrated tools like Nuclei, sqlmap, and BloodHound under the hood.

It also runs a local privacy gateway that keeps your real IPs, hosts, and credentials from ever reaching the LLM provider. Good fit for DevSecOps pipelines, bug bounty workflows, or just testing your own homelab exposure before someone else does.

You can self-host it or purchase a plan from their website.

GitHub - ASCIT31/Dark-Moon: Autonomous AI pentesting engine, continuous offensive security across web, cloud, AD & Kubernetes. Agentic reasoning + real exploit execution deliver proof-based vulnerabilities. Privacy gateway: the LLM never sees your real IPs, hosts, creds or paths (deterministic placeholders rehydrated locally), nothing leaves your perimeter.

Autonomous AI pentesting engine, continuous offensive security across web, cloud, AD & Kubernetes. Agentic reasoning + real exploit execution deliver proof-based vulnerabilities. Privacy gatewa…

GitHubASCIT31

Dashy: Self-Hosted Dashboard for Homelab and Infrastructure Services

Dashy is an open-source, self-hosted dashboard that provides a unified homepage for accessing infrastructure services, applications, and development tools. It combines link management with service health monitoring, widgets, authentication, and extensive customization, making it a practical landing page for homelabs, self-hosted environments, and DevOps teams managing numerous services.

• 🚦 Service Health Monitoring: Displays real-time availability and status checks for configured applications and services.
• 📊 Rich Widget Ecosystem: Integrates dynamic widgets for self-hosted services, system information, and external APIs to create an operational dashboard.
• 🎨 Highly Customizable UI: Supports multiple themes, icon packs, custom CSS, configurable layouts, and a built-in visual configuration editor.
• 🔍 Fast Navigation: Includes instant search, keyboard shortcuts, multiple pages, and flexible launch options for quickly accessing services.
• 🐳 Easy Deployment: Runs via Docker, Docker Compose, or directly from source, with support for multi-architecture container images.

GitHub - lissy93/dashy: 🚀 A self-hostable personal dashboard built for you. Includes status-checking, widgets, themes, icon packs, a UI editor and tons more!

🚀 A self-hostable personal dashboard built for you. Includes status-checking, widgets, themes, icon packs, a UI editor and tons more! - lissy93/dashy

GitHublissy93

📰 Linux news that matters

• Apple has released version 1.0 of its open-source Container project, a Swift-based tool that runs OCI-compatible Linux containers inside lightweight virtual machines on Apple silicon Macs. The stable release introduces persistent Linux environments through the new container machine command, adopts TOML-based configuration, and adds capabilities such as host-to-container file copying while establishing a stable baseline for future development.
• The German state of Mecklenburg-Vorpommern is expanding its open-source strategy by rolling out a self-hosted Nextcloud platform across state and municipal administration, with a long-term target of more than 50,000 public-sector employees. The initiative replaces Microsoft SharePoint for collaboration, is operated on state-controlled infrastructure, and forms part of a broader digital sovereignty strategy that also includes OpenProject and a locally controlled AI assistant based on OpenWebUI while emphasizing open standards and European technologies.
• AWS has expanded its DevOps Agent with release management capabilities that automatically review code changes, validate dependency impacts and access controls, and execute functional verification in managed environments before software is deployed. The enhancement moves the agent beyond troubleshooting and operations into pre-production quality assurance, positioning it as an AI-assisted release engineer integrated into the software delivery lifecycle.
• Researchers at Noma Security disclosed GitLost, a prompt-injection technique that tricks GitHub Agentic Workflows into reading data from private repositories and publishing it in a public repository comment. The attack requires only a crafted GitHub Issue in a public repository when the organization's AI workflow has read access to private repositories, illustrating how natural-language instructions embedded in untrusted content can override the agent's intended behavior.

😂 Geek humor

💌 Keep on loving Linux Handbook

GitOps course is nearly ready. It should arrive next week.

Perfect time to become a Pro member and enjoy unlimited access to our eBooks, courses and in-depth tutorials.

Missed the previous editions? You can access the newsletter archives.

You may also contribute to Linux Handbook and share your experience and expertise with the community.

I like reading your messages, so just hit the reply button and share your thoughts 😄

There's a moment every Linux user eventually hits, you need to access something on a remote machine, but it's not exposed to the internet. Maybe it's a database running on port 5432, a local web app on port 3000, or a service hidden behind a firewall. The "obvious" solution is to punch a hole in the firewall and expose it. The *right* solution is SSH tunneling.

I started using SSH tunnels out of necessity. I had a PostgreSQL database running on a remote server, and the sysadmin (correctly) refused to open port 5432 to the internet. Someone in the team mentioned that I could just "tunnel through SSH" to access it. I had no idea what that meant. Twenty minutes of reading later, I had it working and I've been using SSH tunnels regularly ever since for everything from accessing remote services to getting around restrictive networks.

I'll walk through what SSH tunneling actually is, how each type works, how I set them up, and importantly, what the risks are and how to stay on the right side of them.

What is SSH Tunneling?

SSH (Secure Shell) is usually thought of as a way to get a remote terminal. But SSH also has the ability to forward ports; it can take network traffic on one port and route it through the encrypted SSH connection to emerge somewhere else entirely.

That's SSH tunneling in a sentence: using an SSH connection as a secure pipe to route other traffic.

The traffic inside that pipe is encrypted by SSH, which means it gets the same protection as your terminal session. A service that has no encryption of its own, an old database, a plain HTTP admin panel, a Redis instance, suddenly gets full TLS-grade protection just because you're reaching it through SSH.

There are three types of SSH tunnels. Understanding which one solves your problem is most of the battle:

Local forwarding: -L tunnel forwards a port on your machine to somewhere the remote server can reach.
Remote forwarding: -R tunnel forwards a port on the remote server to something on your machine.
Dynamic forwarding: SOCKS proxy, -D tunnel turns the SSH connection into a proxy that routes any traffic through the remote.

Let's go through each one the way I actually use them.

Local Port Forwarding: Accessing Remote Services Locally

This is the one I use most. Local forwarding lets me open a port on my laptop and have traffic on that port come out on the remote server, as if I'm connecting from the server itself.

My exact use case: I needed to connect my local database client (DBeaver) to a PostgreSQL instance running on a remote server. Port 5432 was not open to the internet. SSH port 22 was.

ssh -L 5433:localhost:5432 username@remote-server.example.com

Breaking this down: -L tells SSH we're doing local forwarding, 5433 is the port I'm opening on my machine, localhost:5432 is where the traffic should go from the remote server's perspective, lhb@remote-server.example.com is the SSH server I'm tunneling through.

After running this, I opened DBeaver, pointed it at localhost:5433, and it connected to the PostgreSQL instance on the remote server, over an encrypted channel, as if the database were running locally.

The tunnel is active for as long as the SSH session stays open. When you exit, the tunnel closes. If you don't need an interactive shell, just the tunnel - add -N to suppress it:

ssh -N -L 5433:localhost:5432 username@remote-server.example.com

And if you want it to run in the background:

ssh -N -f -L 5433:localhost:5432 username@remote-server.example.com

-f sends the process to the background after authenticating. The tunnel stays open without occupying your terminal.

Here, I have used a Docker PostgreSQL container to show the SSH connection to the remote server.

Remote Port Forwarding: Exposing Your Local Machine to the World

Remote forwarding is local forwarding in reverse. Instead of bringing a remote service to me, I'm pushing something on my machine out to a remote server.

My use case for this: I was developing a webhook receiver locally. The service I needed to receive webhooks from (a payment processor) needed a public URL to send to. My development machine is behind NAT, with no public IP. I had a cheap VPS with a public IP. Remote forwarding solved it.

ssh -R 8080:localhost:3000 username@my-vps.example.com

Here, -R for remote forwarding, 8080 is the port that opens on the remote server, localhost:3000 is where traffic on that remote port gets forwarded, back to my machine, port 3000.

After running this, anyone hitting my-vps.example.com:8080 would have their request tunneled back to port 3000 on my laptop. My local dev server was now reachable from the internet, through an encrypted SSH connection. For the example I have setup the container for the vps as:

The VPS container is running for reverse tunneling for the requests that are coming.

curl from inside the container simulates the external request to the vps:8080 endpoint.

Python server verifying and logging the connected request from the internet that comes to the VPS and then to the localhost:3000

When to use this: Remote forwarding is incredibly useful for quick webhook testing, sharing a local demo with a client, or giving someone remote access to something on your internal network without setting up a VPN.

Dynamic Port Forwarding: SSH as a SOCKS Proxy

Dynamic forwarding is the most flexible of the three. Instead of forwarding a specific port to a specific destination, it creates a SOCKS proxy on your machine. Any application that supports SOCKS proxies can route all its traffic through your SSH connection and it will appear as if that traffic is coming from the remote server.

Command that can be used:

ssh -D 1080 -N yash@remote-server.example.com

This opens a SOCKS5 proxy on localhost:1080 on my machine. Any traffic I route through that proxy goes through the SSH tunnel and exits from remote-server.example.com.

I have used it as:

ssh -f -D 1080 -N \
  -i ~/ITSFOSS/REVIEW/SSH\ Tunneling/docker-demo/demo_key \
  -p 2223 -o StrictHostKeyChecking=no \
  vpsuser@localhost
ss -tlnp | grep 1080

Then I can setup the network proxy through the network settings as:

Then, you need to set up the SOCKS proxy through the network settings.

When to use this: When you are in a coffee shop with WiFi and want to encrypt all your browsing, you need to access something that's only reachable from a specific server (e.g., an internal admin panel that only allows connections from the VPS's IP), or you want to test how your website looks from the perspective of another geographic location.

Making Tunnels Persistent

Running long ssh -L ... commands every time is annoying. I put my common tunnels in ~/.ssh/config so I can activate them with a short alias:

Host db-tunnel
    HostName remote-server.example.com
    User yash
    LocalForward 5433 localhost:5432
    ServerAliveInterval 60
    ServerAliveCountMax 3

Host socks-proxy
    HostName my-vps.example.com
    User yash
    DynamicForward 1080
    ServerAliveInterval 60
    ServerAliveCountMax 3

Now activating the database tunnel is just:

ssh -N db-tunnel

And the SOCKS proxy:

ssh -N socks-proxy

The Risks And How to Handle Them

SSH tunneling is powerful, and like most powerful tools, it can cause problems if misused or misconfigured. This is the part most tutorials skip.

Risk 1: Unauthorized Tunnel Creation

The flip side of remote forwarding (-R) is that if someone has SSH access to your server, they can open tunnels out of it, potentially bypassing your network security controls. An attacker with a compromised SSH key could use your server as a relay to reach systems inside your network.

Mitigation: Restrict what SSH users can do. In /etc/ssh/sshd_config:

# Disable port forwarding for all users by default
AllowTcpForwarding no
GatewayPorts no

# Then allow it only for specific trusted users:
Match User deploy-user
    AllowTcpForwarding local

Use SSH keys (not passwords), enforce key-based auth only, and audit your ~/.ssh/authorized_keys files regularly.

Risk 2: Tunnel Misuse on Corporate/Managed Networks

Dynamic SSH tunneling (-D) is a common technique for bypassing network monitoring and content filters. On a corporate or university network, using a SOCKS proxy to route traffic through an external server may violate acceptable use policies, even if you have a legitimate reason.

I use it when I'm on untrusted public WiFi to protect my own traffic, which is reasonable. Using it to bypass your employer's security controls on company equipment is a different matter; read your acceptable use policy, and don't be surprised if your IT team can see that you're making an encrypted SSH connection to an external server even if they can't see inside it.

Risk 3: Exposing Tunnels Beyond Localhost

When you run -L 5433:localhost:5432, by default the tunnel binds to 127.0.0.1 on your machine, only you can use it. But if you bind it to 0.0.0.0, anyone on your local network (or beyond) can use that forwarded port to reach the remote service.

# DANGEROUS — binds to all interfaces
ssh -L 0.0.0.0:5433:localhost:5432 user@remote-server.example.com

Unless you specifically need to share a tunnel with other people on your network, always let the tunnel bind to 127.0.0.1 (the default). You can explicitly enforce this:

# Safe — explicitly binds to loopback only
ssh -L 127.0.0.1:5433:localhost:5432 user@remote-server.example.com

Risk 4: Keeping SSH Keys Secure

All of this relies on the security of your SSH keys. If your private key is stolen, your tunnels and everything behind them are compromised.

My key hygiene: Use ssh-keygen -t ed25519 for new keys, as Ed25519 keys are smaller, faster, and considered stronger than RSA-4096 for most use cases, always set a passphrase on private keys, use ssh-agent to avoid retyping the passphrase constantly while keeping the key protected at rest, never share private keys or put them in version control.

# Generate a new Ed25519 key with a passphrase
ssh-keygen -t ed25519 -C "yash@workstation" -f ~/.ssh/id_ed25519_tunnel

# Add it to ssh-agent so you don't retype the passphrase every session
ssh-add ~/.ssh/id_ed25519_tunnel
```

A Quick Reference: When to Use Which Tunnel

Wrapping Up

What I like about SSH tunneling is that it solves real problems without adding infrastructure. No VPN server to configure, no WireGuard keypairs to exchange, no nginx proxy rules to write. The SSH connection you already use for server access can also carry your database traffic, your webhook traffic, or your browsing traffic, all encrypted, all without opening extra firewall ports.

Local forwarding (-L) is the one I reach for most often, any time I need to access a service on a remote machine from a local client. Remote forwarding (-R) is what I use when I need to do the reverse: expose something local to the internet temporarily. Dynamic forwarding (-D) is the occasional privacy tool for when I'm not on a network I trust.

The risks are real but manageable: keep port forwarding locked down on your SSH servers, bind tunnels to localhost unless you have a specific reason not to, and treat your SSH keys with the same care you'd give a password.

The setup is one command. The maintenance is minimal. The usefulness compounds the more remote infrastructure you work with.

A good Linux user takes notes all the time. A better Linux user organizes them in a proper knowledge base.

From Obsidian to Tolaria, there are plenty of choices. You could explore some self-hosted knowledge base tools that may even help your team.

If your knowledge base grows bigger, you can plugin an AI and get answers from your personal notes.

Lately, we have been exploring AI... local AI mostly with open source models running on your machine and keeping the data private on your system.

For example, take this AI powered file sorter app. To a seasoned sysadmin, this could be a shell script but it could still fit someone's need I think.

Then there is agent based automation. So we took ZeroClaw and plugged it with Fizzy CLI to manage Kanban task board. Interesting times we live in.

I still find it amsuing that many new age developers are not familiar with even the basics of Linux command line. Our intro course is free so feel free to use it and share it with others.

Quick Introduction to Linux Command Line

Learn the basics of Linux commands in this short introductory course. Also contains videos.

Linux HandbookTed LeRoy

And for advanced Linux users, the systemd Playbook is a good way to make more out of systemd.

The systemd Playbook: Learn by Doing

Master systemd the practical way—one lab at a time.

Linux HandbookBhuwan Mishra

💡Quick terminal tip

Ever need to document a complex deployment, or share the exact errors a script threw with a teammate? Instead of manually copying and pasting from your terminal, you can record the entire session, both the commands you typed and their visual outputs to a single text file.

Launch a dedicated logging session using the built-in script command:

script sample.txt -T sample_time

Here, the sample_time file saves the timing information, needed to replay the content later.

From this moment on, your terminal behaves normally, but every keystroke, command, and output is quietly recorded in the background.

When your task is finished, simply exit the recording session:

exit

Now you have a perfect, chronologically ordered transcript (sample.txt) ready for documentation or debugging.

To replay the commands, use:

scriptreplay -B sample.txt -T sample_time

🛠️ Tool discovery

Let's find your next favorite software in this section.

WTF: Build a Personal DevOps Dashboard Inside Your Terminal

WTF (wtfutil) is an open-source terminal dashboard that aggregates operational data, development workflows, and personal productivity information into a single TUI interface. Instead of constantly switching between GitHub, Jira, Kubernetes dashboards, calendars, monitoring tools, and terminal windows, WTF presents everything through configurable modules arranged in a customizable grid layout.

GitHub - wtfutil/wtf: The personal information dashboard for your terminal

The personal information dashboard for your terminal - wtfutil/wtf

GitHubwtfutil

GoAccess: Real-Time Web Log Analytics Without Tracking Scripts

GoAccess is an open-source web log analyzer that provides real-time traffic analytics directly from web server logs. Unlike Google Analytics and similar services, it requires no JavaScript trackers, cookies, databases, or external services, making it a privacy-friendly choice for self-hosted environments. It runs in the terminal or generates live HTML dashboards, allowing administrators to monitor traffic, bandwidth usage, response times, errors, and suspicious activity directly from Apache, Nginx, Caddy, CloudFront, and other log sources.

GitHub - allinurl/goaccess: GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser. - allinurl/goaccess

GitHuballinurl

📰 Linux news that matters

• Podman 6.0 is here with some breaking and some interesting features. In cleaning, cgroups v1, iptables, CNI networking, slirp4netns, Intel Mac, and Windows 10 support are all dropped. BoltDB is gone and Podman auto-migrates to SQLite. Network isolation now defaults to enabled. New additions: AMD GPU support via --gpus, a podman machine os update command, and a patch for CVE-2026-57231 (host env var leakage via malformed image metadata)
• Microsoft's long-planned Secure Boot certificate rollover has reached its final stage as legacy certificates issued in 2011 begin expiring in June 2026, requiring systems to transition to newer 2023 certificate chains. The change is intended to maintain UEFI trust integrity and enable future security updates that protect against firmware attacks, bootkits, and supply-chain compromises.
• The Linux Foundation announced its intent to launch the Agent Name Service (ANS), an open standard that extends DNS to provide identity, verification, and discovery mechanisms for AI agents operating across organizations and platforms. ANS aims to create a federated trust layer that allows operators to verify who an agent represents, what permissions it has, and whether its software remains authentic, without relying on proprietary registries or centralized control.
• Linux 7.2 removes the final uses of the strncpy() function from the kernel after roughly six years of work and more than 360 patches spread across numerous subsystems. The API has long been discouraged because its semantics frequently lead to truncation bugs, non-terminated strings, and other memory-handling mistakes, prompting kernel developers to replace it with safer alternatives.
• AWS has released AWS Blocks in public preview, an open-source TypeScript framework that packages application code, local development environments, and AWS infrastructure definitions into reusable modules called "Blocks." The framework provides local Postgres, authentication, messaging, storage, and other backend services without requiring an AWS account, while generating production AWS infrastructure automatically during deployment.
• Vercel has released eve, an open-source framework that defines AI agents as directories containing Markdown instructions, skills, and TypeScript tools, allowing agents to be developed using a filesystem-first workflow. The framework ships with production-oriented capabilities such as durable execution, sandboxed compute, subagents, approvals, and workflow orchestration already integrated rather than requiring developers to assemble multiple infrastructure components.
• GitHub has started retiring GitHub Models, the free AI playground and API layer introduced in 2024, with new customers already blocked from accessing the service as of June 16, 2026. Existing users can continue using the playground, APIs, and hosted models for now, but GitHub has confirmed that the service is heading toward full retirement and is directing new projects toward Azure AI Foundry.

😂 Geek humor

💌 Keep on loving Linux Handbook

We are working on a few new courses. GitOps is the next in publishing queue followed by GNS3.

And if you like the LHB Linux digest, you can encourage others to subscribe to this newsletter. (From here)

Become a Pro member and enjoy unlimited access to our eBooks, courses and in-depth tutorials.

Missed the previous editions? You can access the newsletter archives.

You may also contribute to Linux Handbook and share your experience and expertise with the community.

I like reading your messages, so just hit the reply button and share your thoughts 😄

My Downloads folder is a crime scene. My home directo

Thousands of files with names like IMG_2048.jpg, Copy_of_final_FINAL_v3.pdf, and untitled(2).docx accumulated over years of telling myself I'd sort it out later. I never did.

I tried manual sorting. I tried renaming scripts. Nothing stuck because the real problem isn't laziness, it's that I don't know what half the files actually are without opening them first.

AI File Sorter takes a different approach. Instead of applying fixed rules, it reads your files, actually looks at images using a visual LLM, extracts text from documents, reads audio/video metadata and then suggests what each file is and where it should go. You review the suggestions before anything moves. Nothing happens without your approval.

With over 1,000 stars on GitHub and 16 releases since launch, this isn't an abandoned proof-of-concept. It's a cross-platform desktop app actively being developed, and version 1.8.0 just shipped with meaningful improvements to the visual model and local learning.

What AI File Sorter Actually Does

Let me be precise about this, because "AI file organizer" can mean very different things.
AI File Sorter does three related but distinct things:

Categorization - It analyzes each file (by name, extension, content, and folder context) and assigns it a category and optional subcategory. "Photography", "Work Documents", "Music", "Screenshots" - then creates the folders and moves files into them. You pick the categories or let the model suggest them freely.

Rename suggestions - For images, it uses a visual LLM to actually look at the picture and suggest a descriptive filename. IMG_2048.jpg might become sunset_over_lake.jpg. For documents, it reads the text content and proposes a cleaner name. For audio/video, it reads the embedded metadata tags and turns them into a consistent library-style name like 2024_artist_album_title.mp3.

Review before action - This one matters. None of the above actually happens until you see the suggestions in a review table, approve what you want, edit anything you don't like, and click confirm. Nothing is irreversible without your sign-off.

Getting It Running on Linux

I tested this on Ubuntu 24.04. The prebuilt .deb package from https://filesorter.app/
First, install the runtime prerequisites:

sudo apt update && sudo apt install -y \
  libqt6widgets6 libcurl4 libjsoncpp25 libfmt9 libopenblas0-pthread \
  libvulkan1 mesa-vulkan-drivers patchelf

Then download the latest released version deb file form https://filesorter.app/download/ and then install it:

After that install the package:

sudo apt install ./aifilesorter_*.deb

Once installed, launch it from your application menu or run:

aifilesorter

Choosing Your LLM Backend

This is the first real decision you make, and it shapes the whole experience. AI File Sorter supports several options:

Local models (no internet required): Gemma 3 4B IT, the new default for both text and visual analysis. Downloads once via the in-app Select LLM dialog. Gemma 1.1 7B, a solid local text-only choice for categorization. Mistral 7B, another built-in option with broader category language support. Your own GGUF, any compatible model you already have can be registered

Remote models (API key required): - ChatGPT, your own OpenAI API key, any model (gpt-4o-mini, gpt-4.1, etc.). Gemini, your own Google AI Studio key (gemini-2.5-flash, gemini-2.5-pro, etc.). Custom OpenAI-compatible endpoint, LM Studio, Ollama, or any local server you're already running

After that there is option to analyse the folder which starts the analysis and one by one parses the files from that folder and categorises it as follows:

A few things I noticed in the review: An old screenshot was correctly categorized as "Screenshots/Desktop UI" rather than as a generic "Image" and the images are structured under the folder as per the content and not just by name of the files.

It asks for your permission to proceed and turn the given randomly stuffed files into categorised, well-structured files. Now, after accepting the changes, you will be able to see the structured files in your Downloads folder:

In the Downloads, there are multiple folders created, like Images: which contains different folders like General, Logos and Photographs which are created with the help of categorization of aifilesorter.

Documents: which contain different documents categorized after the analysis by aifilesorter. The rename suggestions aren't always perfect. Some generic outdoor shots got overly generic names

Document Analysis: Reading the File, Not Just the Name

Document analysis uses the same LLM (text mode, no mmproj needed) to extract text from supported file types and generate a summary and filename suggestion. Supported formats include:

Plain text: .txt, .md, .rtf, .csv, .json, .yaml, .log, .html
PDF: built-in PDFium extractor (no pdftotext dependency needed)
Office formats: .docx, .xlsx, .pptx, .odt, .ods, .odp

For my test files, a .pdf result certificate got the Academic_record.pdf based on its opening paragraph. A .odt export from a bank statement was categorized as "Finance" correctly. An old HTML file from a downloaded web page got correctly identified as a web capture rather than a document.

GPU Acceleration: Vulkan, CUDA, and CPU Fallback

The app supports GPU acceleration via CUDA (NVIDIA) and Vulkan (AMD, Intel, NVIDIA). On Linux, the launcher script auto-detects available backends and prefers CUDA over Vulkan, falling back to CPU if neither is detected.

You can check and force backends with flags:

# Force CPU only
aifilesorter --cuda=off --vulkan=off

# Force Vulkan
aifilesorter --vulkan=on --cuda=off

Category Whitelists and Consistency Controls

One thing I appreciated after my first run: you can constrain what categories the model can pick. Under Settings → Manage category whitelists…, you create named lists of allowed categories.

On a re-run of my Downloads folder with a whitelist set to ["Work", "Personal", "Finance", "Software", "Media", "Archive"], the suggestions became noticeably more consistent. Files weren't spread across thirty micro-categories; they clustered into the buckets I actually wanted.

The docs recommend keeping whitelists to 15–20 entries so they don't overflow smaller local model context windows. For a tightly defined use case (organizing a project folder, sorting a media library), whitelists are the right tool.

Pair whitelists with "More Consistent" categorization mode for the strongest uniformity across a batch.

What Works Well

The review-first workflow is the right design. Nothing moves until you approve it. This sounds obvious, but a lot of "automatic" organizers just move your files and hope for the best. The review table with inline editing gives you real control.

Visual analysis on images is genuinely useful. Calling a local 4B model to look at actual pixel content and suggest a descriptive name is the thing that separates this app from any rename-by-rules script. It won't always be perfect, but it's directionally right far more often than filename heuristics.

It runs entirely offline. No data leaves your machine when using local models. Images, filenames, document text, all processed locally. For people sorting sensitive files, this matters.

The 1.8.0 screenshot-awareness is a real improvement. UI screenshots no longer get misclassified as generic photos. The app adds specific prompt guidance for dashboards, forms, mockups, and terminal captures.

The undo feature works. Edit → Undo last run reverses the moves on a best-effort basis. Combined with dry-run mode, the safety net is solid for cautious users.

What to Be Aware Of

Analysis time scales with folder size and model. Processing a 500-file folder with visual analysis on every image takes meaningful time on CPU. Plan for it, don't run this right before you need your machine for something else.

Legacy Office formats (.doc, .xls, .ppt) are not supported. Only the modern Office XML formats (.docx, .xlsx, .pptx) and OpenDocument equivalents are handled. Old binary formats need converting first.

The visual model needs two GGUF files. The main model and the mmproj projector. If you download one and forget the other, image analysis is silently disabled. The app will prompt you to open the Select LLM dialog, but it's easy to miss if you're not looking.

Rename suggestions on images aren't always specific. A generic outdoor photo might get a generic descriptive name. The model does its best with what it can see, but "mountain_landscape.jpg" is only marginally better than "IMG_2048.jpg" if you have fifty of them. The categorization accuracy is stronger than the rename precision.

Conclusion

AI File Sorter is doing something meaningfully different from rename scripts and rules-based organizers. Reading actual image content with a visual LLM, extracting document text, reading audio metadata and then letting you review everything before a single file moves, is the right design for a tool that touches your files.

The local-first approach is a genuine differentiator. My images, documents, and filenames stayed on my machine throughout. No API key, no cloud, no data leaving my hard drive.

The 1.8.0 improvements to the visual model (Gemma 3 4B IT as default, better screenshot detection, local learning from your approved reviews) make this a noticeably better version than what shipped a few months ago. It's not a finished, polished SaaS product; it's an actively developed open-source desktop app with rough edges, but for the specific problem of "I need to make sense of this chaotic folder of files," it works.

I am loving to use local AI. It started with using AI for knowledgebase and now for file sorting. I got to keep exploring 😄

I spent time evaluating these across personal homelab setups, team documentation workflows, and AI-augmented note-taking, filtering down to 11 tools that solve real problems that cloud-only solutions like Notion and Confluence leave unaddressed.

There's a reason self-hosted knowledge bases are surging in interest right now: local AI integration. Tools like Claude (via MCP), Ollama-backed local LLMs, and RAG pipelines mean you can now ask your own knowledge base questions in natural language, without sending your private notes to a third-party server. The difference between a knowledge base that supports Markdown on disk and one that locks you into a proprietary format is now the difference between AI-queryable and AI-blind.

Short on time? Jump to the comparison table below, or use the headers to find your fit.

At a Glance: All 11 Tools Compared

Here's a quick overview before the full breakdowns.

Now let's go through each one.

Outline - Best Team Knowledge Base with Native Claude/MCP Integration

Outline is a fast, Markdown-based team wiki and knowledge base that has quietly become the go-to self-hosted alternative to Notion/Confluence for small-to-medium teams - and its Model Context Protocol (MCP) support now lets you connect Claude directly to your Outline wiki to search, read, and write documents through natural language.

Who it's best for: Engineering teams and small companies who want a clean, fast, team-accessible wiki that doesn't require a Confluence subscription - especially teams that want Claude or other AI assistants to be able to query the wiki directly.

Quick Setup:

git clone https://github.com/vicalloy/outline-docker-compose.git
cd outline-docker-compose
cp scripts/config.sh.sample scripts/config.sh
# update config file: vim scripts/config.sh
make install  # Create a docker-compose config file and start it. Initializing the oidc-server(add oidc client for outline and create a superuser).

You will be asked to set up the username and the password for the authentication. Once you set all the things, you will see the outline running on localhost:8888 as below:

The Claude/MCP integration is the headline feature here. With the Outline MCP server, Claude can search your wiki, fetch document contents, and even create or update documents.

Verdict: The most AI-forward self-hosted team wiki available today. If your team uses Claude and wants the AI to actually know what's in your internal docs, Outline's MCP integration makes that real.

BookStack - Best Self-Hosted Wiki for Simple, Structured Team Documentation

BookStack is a self-hosted documentation platform organized around a physical book metaphor: Books → Chapters → Pages. It's opinionated in the best way, the structure makes sense immediately, and there's virtually no setup overhead for the end user.

Who it's best for: Small teams, IT departments, and homlab operators who need a clean, no-frills internal wiki for SOPs, runbooks, and project docs and don't want to spend time configuring the tool itself before using it.

Quick Setup:

#docker compose file
services:
  bookstack:
    image: lscr.io/linuxserver/bookstack:latest
    container_name: my_bookstack
    environment:
      - PUID=1000
      - PGID=1000
      - APP_URL=http://localhost:6875
      - APP_KEY=[key]
      - DB_HOST=my_bookstack_db
      - DB_USER=bookstack
      - DB_PASS=yourpassword
      - DB_DATABASE=bookstackapp
    volumes:
      - ./bookstack_app_data:/config
    ports:
      - 6875:80
    restart: unless-stopped
    depends_on:
      - bookstack_db

  bookstack_db:
    image: lscr.io/linuxserver/mariadb:latest
    container_name: my_bookstack_db
    environment:
      - PUID=1000
      - PGID=1000
      - MYSQL_ROOT_PASSWORD=yourpassword
      - TZ=Etc/UTC
      - MYSQL_DATABASE=bookstackapp
      - MYSQL_USER=bookstack
      - MYSQL_PASSWORD=yourpassword
    volumes:
      - ./bookstack_db_data:/config
    restart: unless-stopped

You need to set the parameters as per your requirements, then after docker compose up you will see the application running on localhost:6875. You just need to generate one APP_KEY then you can replace the same and run the compose file.

You will see a simple minimalist view which represents the books, chapters and pages. Export formats: Markdown, HTML, PDF, Plain Text, ZIP (portable backup of an entire Book or shelf).

Verdict: The most production-ready, plug-and-play wiki on this entire list. If your team has been putting off setting up internal documentation because every option felt complex, BookStack removes that excuse.

Wiki.js - Best Self-Hosted Wiki for Developer Teams

Wiki.js is a modern, Node.js-based wiki platform with multiple storage backends, including Git sync - meaning your documentation can live as Markdown files in a Git repository, automatically synced both ways. This makes it trivially easy to point AI tools at your docs.

Who it's best for: Developer teams who want their documentation to live in Git alongside their code and want a clean web UI on top without giving up version history, PRs, or `git blame` for docs.

Quick Setup:

services:
  db:
    image: postgres:15-alpine
    environment:
      POSTGRES_DB: wiki
      POSTGRES_PASSWORD: wikijsrocks
      POSTGRES_USER: wikijs
    volumes:
      - db-data:/var/lib/postgresql/data
    restart: unless-stopped

  wiki:
    image: ghcr.io/requarks/wiki:2
    depends_on:
      - db
    environment:
      DB_TYPE: postgres
      DB_HOST: db
      DB_PORT: 5432
      DB_USER: wikijs
      DB_PASS: wikijsrocks
      DB_NAME: wiki
    ports:
      - "3000:3000"
    restart: unless-stopped

volumes:
  db-data:

After running the compose, you will be able to see the application running:

After the initial setup of the email and password, you will get to see different features like search engines, API access, authentication, storage, analytics and many more.

Verdict: The best choice for engineering teams who want their wiki to behave like their code, in Git, reviewable, version-controlled, and introspectable by any AI tool that can read a repo.

Obsidian - Best Personal Knowledge Base with AI Plugin Ecosystem

Obsidian stores your notes as plain Markdown files on disk, which sounds simple, but it means you have the most AI-friendly knowledge base possible. Every local LLM (via Ollama), every AI agent (including Claude via MCP), and every search tool can work directly with your notes without any export step.

Who it's best for: Researchers, writers, developers, and knowledge workers who want a powerful personal knowledge base with bidirectional links, a graph view, and access to the richest AI plugin ecosystem of any PKM tool available.

Quick Setup:

services:
  obsidian:
    image: lscr.io/linuxserver/obsidian:latest
    container_name: obsidian
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
    volumes:
      - obsidian-config:/config
    ports:
      - 3000:3000
      - 3001:3001
    restart: unless-stopped
    shm_size: "1gb"

volumes:
  obsidian-config:

After setting up your obsidian will be running on localhost:3000

It supports many open source and community plugins and the graph view is one of the most promising features. Through these plugins, like obsidian-mcp you can expose your Obsidian vault to Claude desktop.

Verdict: The most AI-ready knowledge base because it's the most file-system-friendly. Your notes are just Markdown. Claude can read them via MCP. Ollama can embed them for RAG. If AI augmentation of your personal knowledge base matters, start here.

AFFiNE - Best All-in-One Knowledge Base with Built-In AI Copilot

AFFiNE is an open-source, self-hostable Notion alternative that combines documents, databases, and an infinite whiteboard canvas - with a built-in AI Copilot that supports Claude, OpenAI, and Gemini models, configurable from the admin console of your self-hosted instance.

Who it's best for: Teams and individuals who want the Notion all-in-one experience (notes + projects + databases + visual thinking) but want to self-host their data and plug in their own AI provider, including Claude.

Quick Setup:

name: affine
services:
  affine:
    image: ghcr.io/toeverything/affine:${AFFINE_REVISION:-stable}
    container_name: affine_server
    ports:
      - '${PORT:-3010}:3010'
    depends_on:
      redis:
        condition: service_healthy
      postgres:
        condition: service_healthy
      affine_migration:
        condition: service_completed_successfully
    volumes:
      # custom configurations
      - ${UPLOAD_LOCATION}:/root/.affine/storage
      - ${CONFIG_LOCATION}:/root/.affine/config
    env_file:
      - .env
    environment:
      - REDIS_SERVER_HOST=redis
      - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${DB_DATABASE:-affine}
      - AFFINE_INDEXER_ENABLED=false
    restart: unless-stopped

  affine_migration:
    image: ghcr.io/toeverything/affine:${AFFINE_REVISION:-stable}
    container_name: affine_migration_job
    volumes:
      # custom configurations
      - ${UPLOAD_LOCATION}:/root/.affine/storage
      - ${CONFIG_LOCATION}:/root/.affine/config
    command: ['sh', '-c', 'node ./scripts/self-host-predeploy.js']
    env_file:
      - .env
    environment:
      - REDIS_SERVER_HOST=redis
      - DATABASE_URL=postgresql://${DB_USERNAME}:${DB_PASSWORD}@postgres:5432/${DB_DATABASE:-affine}
      - AFFINE_INDEXER_ENABLED=false
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy

  redis:
    image: redis
    container_name: affine_redis
    healthcheck:
      test: ['CMD', 'redis-cli', '--raw', 'incr', 'ping']
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

  postgres:
    image: pgvector/pgvector:pg16
    container_name: affine_postgres
    volumes:
      - ${DB_DATA_LOCATION}:/var/lib/postgresql/data
    environment:
      POSTGRES_USER: ${DB_USERNAME}
      POSTGRES_PASSWORD: ${DB_PASSWORD}
      POSTGRES_DB: ${DB_DATABASE:-affine}
      POSTGRES_INITDB_ARGS: '--data-checksums'
      # you better set a password for you database
      # or you may add 'POSTGRES_HOST_AUTH_METHOD=trust' to ignore postgres security policy
      POSTGRES_HOST_AUTH_METHOD: trust
    healthcheck:
      test:
        ['CMD', 'pg_isready', '-U', "${DB_USERNAME}", '-d', "${DB_DATABASE:-affine}"]
      interval: 10s
      timeout: 5s
      retries: 5
    restart: unless-stopped

After setting up, your application will be running on localhost:3010

You can also manage AI integration through the settings by providing API_KEY and necessary URLs.

Verdict: The most feature-complete open-source Notion alternative, and the only one with a genuinely integrated AI Copilot you can point at Claude. For teams migrating from Notion who want to keep their AI features, this is the path.

SiYuan Notes - Best Privacy-First Knowledge Base with Local-First Architecture

SiYuan is a block-based, local-first personal knowledge management system with a built-in SQLite index, which means you get powerful block-level cross-referencing and database-like queries entirely on your own machine, with no mandatory cloud connection.

Who it's best for: Privacy-conscious individuals and power users who want deep block-level relational linking, a clean self-contained app, and the option to self-host their own sync server without any third-party cloud involvement.

Quick Setup:

version: "3.9"
services:
  siyuan:
    image: b3log/siyuan
    command: ["--workspace=/siyuan/workspace/", "--accessAuthCode=siyuanrocks"]
    ports:
      - 6806:6806
    volumes:
      - siyuan-data:/siyuan/workspace
    restart: unless-stopped

volumes:
  siyuan-data:

After running the setup you need to enter the authcode that you have set in the configuration in this case: siyuanrocks

You can also get the AI features through the API_KEY of ChatGPT, Claude, DeepSeek, and other models that support the OpenAI interface.

Verdict: The most technically sophisticated privacy-first PKM on the list. The SQL-queryable block database is genuinely unique; no other tool on this list lets you run relational queries across your notes like this.

Logseq - Best Knowledge Base for Networked Thought and Graph-Based Thinking

Logseq is a local-first, outline-based knowledge tool built around the concept of networked thought, every bullet point is a block that can be referenced from anywhere, and a graph view visualizes the connections between all your notes. Like Obsidian, it stores everything as plain Markdown (or Org-mode) files on disk.

Who it's best for: Researchers, academics, writers, and deep thinkers who work with connecting ideas across many notes, anyone who has found flat note apps limiting and wants to see how their knowledge relates to itself.

Quick Setup:

services:
  logseq:
    image: ghcr.io/logseq/logseq-webapp:latest
    ports:
      - "3001:80"
    restart: unless-stopped

After deploying the setup, the Logseq will be available at localhost:3001

Whiteboard and flashcards are one of the promising features from Logseq.

Verdict: The best choice for people who think in connections rather than linear documents. If you've ever wanted to see how all your research relates to itself, the graph view will immediately make sense. Pair it with Ollama and the Smart Search plugin for local AI querying.

AppFlowy - Best Open-Source Notion Alternative with Growing AI Features

AppFlowy is an open-source, local-first Notion replacement built in Flutter, with a modular architecture designed from the ground up for customization and self-hosting. Its AI integration is under active development, with integrations for local models (Ollama) and cloud providers being added in 2024-2025.

Who it's best for: Teams and individuals who want a Notion-like interface (documents, databases, kanban boards, calendars) with full local ownership and the ability to deploy their own sync server and are willing to accept that AI features are still maturing.

Quick Setup:

# clone repo
git clone https://github.com/AppFlowy-IO/AppFlowy-Cloud.git
cd AppFLowy-Cloud

# copy .env file
cp deploy.env .env

# change ports
NGINX_PORT=80
NGINX_TLS_PORT=443

docker compose up -d

docker compose ps

After the setup, if there is an error of a port already in use, try changing the ports and running the application again.

Verdict: The most Notion-like experience in the open-source world, with local-first data ownership. The AI integrations are genuinely there, just earlier-stage. If you want to own your Notion replacement and watch it grow, AppFlowy is the right bet.

Trilium Notes - Best Self-Hosted Tool for Deep Hierarchical Personal Knowledge

Trilium Notes is a hierarchical personal knowledge base with an unusual superpower: scripted automation via built-in JavaScript note scripts. Notes can contain runnable JS that queries and manipulates other notes, making it a programmable knowledge system, not just a static wiki.

Who it's best for: Power users and developers who want maximum flexibility in how their knowledge is organized and automated, including those who want to build custom AI integrations directly into their notes via JavaScript.

Quick Setup:

services:
  trilium:
    image: zadam/trilium:latest
    container_name: trilium-notes
    restart: unless-stopped
    ports:
      - "50081:8080" # Mapping to an alternative port to avoid conflicts with other apps
    volumes:
      - trilium_data:/home/node/trilium-data
    environment:
      - TRILIUM_PORT=8080

volumes:
  trilium_data:

After the setup the Trilium will be running on localhost:50081

It has a hierarchical structure of notes and also has the feature of canvas notes where you can add shapes, arrows and colors to your notes.

Verdict: The most programmable personal knowledge base on the list. If you've ever wanted your notes to run code and call an AI API on their own, Trilium (via TriliumNext) is the only tool on this list that does that natively.

Anytype - Best Local-First Knowledge Base with Offline-First Architecture

Anytype is a privacy-focused, object-based personal knowledge tool built on a peer-to-peer protocol (Any-Sync). Everything is stored locally first and synced peer-to-peer; there's no central server that holds your data. Even when using Anytype's network for sync, data is end-to-end encrypted before leaving your device.

Who it's best for: Privacy-focused individuals who want a Notion-like structured knowledge system with the strongest possible data sovereignty guarantees and are comfortable with a younger, still-maturing product.

Quick Setup:

Unlike the other projects this one needs you to download the Desktop app through their website: https://anytype.io/

Any experience gallery is one of the features they provide to experience different configurations created by some users for easy workflow management.

Verdict: The strongest privacy guarantee of any tool on this list, peer-to-peer, E2EE, and self-hostable right down to the sync layer. For users who treat data sovereignty as a non-negotiable, Anytype is the pick, even if it means waiting for AI features to land.

Joplin - Best Open-Source Notes App with Portable Encryption and Sync

Joplin is a mature, battle-tested open-source note-taking app that strikes the best balance between data portability, privacy, and accessibility across platforms. It syncs to virtually anything: Nextcloud, WebDAV, Dropbox, OneDrive, S3 and has Joplin AI and AI plugin support for LLM integration.

Who it's best for: Users switching from Evernote or OneNote who want an open-source, self-hostable replacement with broad platform support, end-to-end encryption, and enough extensibility to add AI features via the plugin system.

Quick Setup:

services:
  postgres:
    image: postgres:16
    volumes:
      - ./data/postgres:/var/lib/postgresql/data
    restart: unless-stopped
    environment:
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_DB=${POSTGRES_DATABASE}
    networks:
      - joplin_network

  joplinsync:
    image: joplin/server:latest
    depends_on:
      - postgres
    ports:
      - "22300:22300"
    restart: unless-stopped
    environment:
      - APP_PORT=22300
      - APP_BASE_URL=${APP_BASE_URL}
      - DB_CLIENT=pg
      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
      - POSTGRES_DATABASE=${POSTGRES_DATABASE}
      - POSTGRES_USER=${POSTGRES_USER}
      - POSTGRES_PORT=5432
      - POSTGRES_HOST=postgres
    networks:
      - joplin_network

networks:
  joplin_network:

After giving the necessary parameters in your .env or values in specific parameters, the Joplin server will run at localhost:22300.

It has a plugin named Jarvis (Joplin Assistant Running a Very Intelligent System), which is an AI note-taking assistant for Joplin, powered by online and offline LLMs (such as OpenAI's ChatGPT or GPT-4, Hugging Face, Gemini, Universal Sentence Encoder). For the Desktop application, you can download it from the official link.

Verdict: The safest choice for Evernote/OneNote migrants who value data portability above all else. The plugin ecosystem and AI integration make it more capable than it looks, and the sync flexibility means it fits into virtually any existing self-hosted stack.

Final Recommendation

If you need a team knowledge base with AI today, use Outline. Its MCP integration for Claude is production-ready, its Markdown export keeps you unlockedin, and the managed cloud tier means you can start without infrastructure. After that, pick based on your primary use case:

• Team documentation: Outline (AI-first, MCP/Claude) or BookStack (simple, structured)
• Developer teams wanting Git-backed docs → Wiki.js (Markdown in Git, then any AI agent can query it)
• Personal knowledge + AI plugins: Obsidian (plain files + Ollama/Claude MCP) or Logseq (graph-first with local AI)
• Notion replacement with built-in AI Copilot: AFFiNE (Claude/OpenAI/Gemini configured in admin)
• Privacy-first with maximum data sovereignty: SiYuan (local-first, SQL-queryable) or Anytype (E2EE P2P sync)
• Programmable personal knowledge base: TriliumNext (JavaScript scripting in notes, call AI APIs directly)
• Evernote migrators: Joplin (ENEX import, E2EE sync, AI plugin available)

If you have any of the self-hosted knowledge base tools not listed here, feel free to drop them in the comments!

I manage my project boards in Fizzy, Basecamp's clean, opinionated kanban tool, and I got tired of the same ritual: open the browser, navigate to the board, drag a card, close the tab, back to work, repeat. The board lives in one app, my actual work lives somewhere else, and that context switching chips away at focus more than I'd like to admit. So I decided to fix it. Here's what I did.

What I built

Before going through this, I need you to know what Fizzy CLI and ZeroClaw is:

Fizzy CLI fixes half of that problem. It's an official command-line tool that lets you create cards, post comments, search your board, and manage attachments entirely from the terminal, no browser required. The other half of the problem gets solved by ZeroClaw.

ZeroClaw is an open-source agent runtime written in Rust, a single binary you install and configure. It connects to 30+ channels (Telegram, Discord, Matrix, email, or just your CLI), and is genuinely provider-agnostic: it talks to Anthropic, OpenAI, Gemini, Ollama, Groq, and about twenty other LLM backends, all from the same TOML config file. Everything runs on your machine, with your keys. This guide walks you through installing Fizzy CLI, authenticating it, and wiring it up to a running NanoClaw agent so you have end-to-end control of your boards from the terminal and from any messaging app.

Once you wire Fizzy into ZeroClaw as a shell tool, you can message your agent "add a card titled fix the auth bug to my backlog" and it just does it - from your phone, from Telegram, from wherever you happen to be.

I ended up installing Fizzy CLI, authenticating it, and wiring it to a ZeroClaw agent, and in this post I'm walking through exactly what I did, including the parts that didn't go smoothly.

What I used

• A Linux machine - I ran this on Ubuntu 22.04 LTS; Arch and Fedora should work fine too
• An active Fizzy account with at least one board created
• A Fizzy personal access token - get it from Profile → API Tokens in the Fizzy web UI
• One of: a free Gemini API key from Google AI Studio, or Ollama running locally with a model pulled (e.g., ollama pull qwen2.5:7b)

Installing Fizzy CLI

The fastest path on Linux is the official install script - it detected my architecture, pulled the right binary, and verified checksums automatically. I just ran:

curl -fsSL https://raw.githubusercontent.com/basecamp/fizzy-cli/master/scripts/install.sh | bash

Complete the installation process, it will prompt for the PAT, generate it from your personal fizzy profile and enter it when prompted.

If you're on Arch Linux or Omarchy, it's available in the AUR:

yay -S fizzy-cli

Once the installer finishes, confirm the binary is on your PATH:

fizzy --version

You should see the version string printed cleanly. If your shell says command not found, the binary likely landed in ~/.local/bin - make sure that's in your PATH.

export PATH="/home/USERNAME/.local/bin:$PATH"

Exploring the Basic Commands

First I ran this to confirm my identity and grab my account slug:

fizzy identity show

It will show all the identity information along with your slug id , use that id and run the following command:

fizzy board list --account "slug id"

Here is a list of boards with their names. As I have more accounts, I need to mention the account ID for commands.

Try more commands like:

# List cards on your default board
fizzy card list

# View details of a specific card
fizzy card show 2

# Search across your board
fizzy search "authentication bug"

# Add a comment to a card
fizzy comment create --card 42 --body "Reproduced on staging."

It will display the cards, a specific card, searching across the board, etc.

Also, if you use jq the output will be in formatted so that you can clearly make sense of the results.

fizzy card list --account "id" | jq

Installing ZeroClaw

ZeroClaw ships as a single Rust binary. When the install script asked me whether I wanted a prebuilt binary or a source build, I went with prebuilt - it was done in seconds:

curl -fsSL https://raw.githubusercontent.com/zeroclaw-labs/zeroclaw/master/install.sh | bash

When it finishes, confirm it's available:

When it finishes, confirm it's available:

zeroclaw --version

ZeroClaw has no runtime dependencies. No Docker, no Node.js, no Python. The binary is self-contained.

Running the Onboarding Wizard

ZeroClaw's config lives at ~/.zeroclaw/config.toml. Running the onboarding wizard creates it for you:

zeroclaw onboard

The wizard walked me through four things:

• LLM provider - which model backend to use
• API key or endpoint - your credentials for that provider
• At least one channel - the built-in cli channel works for now; you can add Telegram or Discord later
• Agent alias - a name for your agent entry in the config

For the LLM provider step, enter gemini and paste your Google AI Studio API key when prompted. If you're using Ollama locally, choose ollama instead, the wizard will ask for your model name (e.g., qwen2.5:7b) and leave the endpoint at the default http://localhost:11434.

There is vast support for various channels:

Then there will be an option to select a memory backend, select the appropriate one as per your need:

the model_provider field on your agent is the only place you specify which LLM to use in your ~/.zeroclaw/config.toml . Swapping from Gemini to Ollama to Groq is a one-line change.

Registering Fizzy as a Shell Tool

ZeroClaw's shell tool lets the agent run any command on your machine. To give it access to fizzy, add a tool entry to your config and give the agent permission to use it:

Add "fizzy" at commands in config, it will look like this:

allowed_commands = [
    "git",
    "npm",
    "cargo",
    "ls",
    "cat",
    "grep",
    "find",
    "echo",
    "pwd",
    "wc",
    "head",
    "tail",
    "date",
    "df",
    "du",
    "uname",
    "uptime",
    "hostname",
    "python",
    "python3",
    "pip",
    "node",
    "free",
    "fizzy"
]

One thing that caught me off guard: Fizzy has to be explicitly listed in allowed_commands or ZeroClaw's security layer blocks it, even if you've defined the tool entry. I learned this the hard way after getting a "Command not allowed by security policy" error.

Then add the new entry in the config:

[tools.shell.fizzy]
description = "Manage Fizzy kanban boards via the Fizzy CLI"
command     = "fizzy"
allowed_args = ["board", "card", "comment", "search", "commands"]

[agents.assistant]
model_provider = "gemini-cli"
risk_profile   = "supervised"
tools          = ["shell.fizzy"]

Follow the similar steps for ollama setup too.

Check once the parameters as per your model are selected. Whichever path you followed, the wizard ends with a quick live chat to confirm your agent is working. You'll see a prompt like:

Confirming the Agent Responds

Whichever path you followed, Gemini or Ollama, start the agent to confirm everything is working:

zeroclaw agent

You should get a CLI chat prompt. Type a test message:

Hello, are you there?

If it responds, you're done. If you are using a local LLM and see an error like model requires more system memory than is available, your chosen model is too large for the free RAM currently available. Fix it by pulling the 1B model instead and updating your config:

ollama pull llama3.2:1b
# Then edit ~/.zeroclaw/config.toml and set: model = "llama3.2:1b"

If it responds, your LLM backend is wired up correctly. Total setup time is about five minutes. Once the agent responds, you're ready to wire in Fizzy.

Verifying the Fizzy Integration

I asked the agent something simple to confirm the wiring:

Use the fizzy shell tool to run: fizzy card list

ZeroClaw called fizzy card list, parsed the JSON output, and summarized my cards in natural language. In supervised mode it asked for approval first - I pressed Y, and it worked.

One tip I'd pass on: be explicit in your prompt. "List the cards on my board" can confuse the agent into doing a web search instead. Saying "use the fizzy shell tool to run..." removes the ambiguity entirely.

From there, you can do things like:

Create a card titled "Review auth middleware" on my board.
Add a comment to first card saying I'll look at this after the release.
Search for anything related to "database migration".

What to Explore Next

We have covered how to setup and get started with Fizzy CLI with ZeroClaw agent, but you can explore more things like:

Per-repo board context: Create a .fizzy.yaml in any project directory with a board field. When you're inside that directory, fizzy card list will default to that project's board automatically, no flags needed.

Swap the model: If Gemini starts hitting rate limits or you want to try something faster, add a second provider entry and change the model_provider alias on your agent.

Add a second agent: ZeroClaw supports multiple [agents.*] entries pointing at different providers. You could run a lightweight Ollama model for quick card operations and route heavier reasoning tasks to Gemini, all from the same ZeroClaw instance.

Wrapping Up

What I like most about this setup is the flexibility. ZeroClaw doesn't care which LLM I use. I started with Ollama locally, hit tool-calling limitations with smaller models, and switched to Gemini's free tier without touching anything except two lines in the config.

The context switching problem is what motivated all of this, and I think this setup genuinely solves it. Having Fizzy in the terminal is one improvement. It took me an afternoon to get everything right. The time it saves should compound from here.

Do visit the repos and try it yourself!

I have thousands of notes. Obsidian vaults, random Markdown files, half-finished research documents, meeting notes from three years ago. And for the longest time, they just sat there, searchable by filename, searchable by keyword, but never actually understood.

Then one evening I thought, What if I could just ask my notes a question?

You might be thinking the ChatGPT already does that, but it does not have access to your local workspace. You need to upload all the files you want to discover, not a cloud service that makes me wonder what happens to my data.

Instead, I thought of using just a small AI model, completely running on my own machine. I thought that it could handle these situations, which could read my notes and answer questions about them.

I tried it. It worked. And I have not stopped using it since. No GPU required, no monthly subscription, no data leaving my machine.

The problem with the huge pile notes (and how AI fixes it)

Here is the honest truth: most knowledge management systems fail not at storing information, but at retrieving it. You spend time writing the note. You tag it. You organize it. And then, three weeks later, you cannot find it because you cannot remember what you called it or which folder you put it in.

Traditional search is keyword-based. It finds notes that contain the word "containerization", but it cannot answer "how do I deploy a container in a restricted environment?" by synthesizing your notes on Docker, your notes on firewalls, and that one Markdown file you wrote during a workshop.

That synthesis is exactly what a local AI model can do.

The technique is called RAG (Retrieval-Augmented Generation). The AI does not memorize your notes. Instead, it reads them at query time, pulls the most relevant chunks, and uses them as context to generate an answer.

Think of it as giving the AI your notes as a reference book every time you ask a question.

What I used in this setup

A fully local setup with three components:

• Ollama: Runs LLM models locally on your CPU (or GPU if you have one)
• A lightweight embedding model: Converts notes into searchable vectors
• AnythingLLM (or Open WebUI): UI that connects your notes to the model

Everything runs on the local machine. The notes never leave the computer. The model does not even need an internet connection once it is downloaded.

Choosing the right model

This is the part most guides get wrong. They recommend a 7B parameter model. You try to run it on your laptop, and it takes 90 seconds to answer a simple question.

For a knowledge base assistant that runs comfortably on a CPU, even a mid-range one, the sweet spot is Phi-3 Mini (3.8B parameters from Microsoft) or Gemma 2B (from Google). Both are surprisingly capable for question-answering tasks, and they run well with 8 GB of RAM.

You can also refer to this article for information about models running on CPU.

My recommendation: phi3:mini, it is fast, accurate, and was specifically fine-tuned for instruction-following tasks like Q&A. It is the model I use for my own notes.

Part 1: Setting up Ollama

Ollama is the engine that lets you run LLMs locally. It is a single binary, and the installation is one command.

Step 1: Install Ollama

curl -fsSL https://ollama.com/install.sh | sh

Once installed, verify it is running:

ollama --version

Ollama starts a background service automatically. You can check its status:

systemctl status ollama

Step 2: Pull the model

Now download the model. For the CPU-friendly, low-resource setup I recommend:

ollama pull phi3:mini

This will download about 2.3 GB. Grab a coffee. If you have more RAM available (16 GB+) and want slightly better answers, you can also try:

ollama pull gemma2:2b

To verify the model is installed and working, test it immediately:

ollama run phi3:mini "Explain what the ITIM subject is all about."

If you see a coherent response, the model is working. We can move on.

Part 2: Setting up AnythingLLM as the notes interface

AnythingLLM is a self-hosted, open-source application that lets you upload documents, point it at a folder, and query them through a clean chat interface. It handles the chunking, embedding, and retrieval pipeline so you do not have to set up a vector database yourself.

Step 1: Install AnythingLLM via Docker

docker pull mintplexlabs/anythingllm

Create a directory to store AnythingLLM's data (your note indexes will live here):

mkdir -p ~/.anythingllm

Now run it:

docker run -d \
  --network=host \
  --cap-add SYS_ADMIN \
  -v $HOME/.anythingllm:/app/server/storage \
  -e STORAGE_DIR="/app/server/storage" \
  --name anythingllm \
  mintplexlabs/anythingllm

Verify the container is running:

docker ps | grep anythingllm

Now open your browser and navigate to: http://localhost:3001

You will see the AnythingLLM setup wizard.

Step 2: Connecting AnythingLLM to the local Ollama model

During setup, AnythingLLM will ask you to choose an LLM provider. Select Ollama from the list.

• Ollama Base URL: http://localhost:11434
• Model: Select phi3:mini from the dropdown (it will auto-detect your installed models)

For the embedding model, which converts your notes into searchable vectors, stay within Ollama and choose:

ollama pull nomic-embed-text

nomic-embed-text is tiny (274 MB), fast, and produces excellent embeddings for English-language text. It is purpose-built for document retrieval, exactly what we need.

Part 3: Importing the notes

Let's move to connect knowledgebase with AI.

In AnythingLLM, a workspace is a scoped knowledge base. Think of it like a project folder; you can have one workspace for your work notes, one for personal research, one for a specific book you are reading.

1. Click New Workspace and give it a name (e.g., "My Notes")
2. Click the Upload Documents button
3. Drag and drop your Markdown files, PDFs, or text files into the upload area

AnythingLLM will split your notes into chunks (typically 500–1000 tokens each) then generate an embedding vector for each chunk using nomic-embed-text and then store everything in a local vector database (LanceDB, stored in ~/.anythingllm).

This process takes a minute or two, depending on how many notes you have.

Part 4: Querying the notes

Now is the time to make the most of the notes by using AI to question it.

Now the satisfying part. Click on your workspace, type a question in the chat box, and press Enter. To truly see the power of local AI, ask something that ChatGPT could never possibly know. For example, if you uploaded your home server notes:

According to my server migration notes, why did I decide to switch from Nginx Proxy Manager to Traefik, and what IP address is my Pi-hole running on?

Notice that AnythingLLM shows you which notes it used to generate the answer. This is the RAG process in action; ChatGPT can tell you what Traefik is, but only your local AI knows that you switched to it because you were tired of managing SSL certificates manually, and that your Pi-hole is at 192.168.1.100.

Try a few more highly personalized queries:

What is the Wi-Fi password for the guest network at my parents' house, and where is the router hidden?

When are my parents' birthdays this year, and what exactly did I decide to buy for my brother to fix his noisy keyboard?

Each answer is grounded in your notes. The model is not making things up from its training data; it is synthesizing from what you wrote, which means the answers are accurate to your actual knowledge and context.

💡 Keeping things running (optional)

If you want AnythingLLM to start automatically with your system:

docker update --restart unless-stopped anythingllm

And Ollama is already managed as a systemd service, so it will start on boot automatically.
To update the model later if a newer version is released:

ollama pull phi3:mini

Ollama handles versioning for you.

My experience (so far)

I have been using this setup for a few months now. Here is what changed for me:

Before: I would search my notes, find five partial answers in different files, open each one, manually cross-reference them, and then write a synthesis myself.
After: I ask a question. In 5–8 seconds, I get a synthesized answer with the source notes cited. I open the sources to verify. Done.

The model is not perfect - Phi3:mini will occasionally miss nuance or misread a technical term from a note. But for a free, offline, CPU-only setup, it is genuinely impressive.

What it is excellent at:

• Summarizing notes on a topic
• Finding connections between notes you forgot existed
• Drafting a starting point for new writing based on your existing research
• Answering "what did I write about X" questions instantly

What to watch out for:

• Very long PDFs (>50 pages) may need to be split before uploading
• Code blocks in Markdown sometimes confuse the chunking
• Plain prose notes work best
• The model will occasionally "hallucinate" if your notes are thin on a topic; always verify

The entire stack is free, open-source, and runs completely offline. Once set up, it requires zero maintenance and adds nothing to your monthly cloud bill.

Conclusion

The popular mental model of AI is "Cloud service that reads your data". This does not have to be the case and for personal notes, it arguably should not be.

A small, open model running locally on your laptop is good enough for synthesizing your own knowledge base. It will not beat GPT-4 at coding challenges or creative writing. But for the task of "help me navigate and synthesize the notes I already wrote", it does the job well.

Your notes are already doing half the work. A local AI just helps you finish the other half.

Our 20th course is now available 🍾

This one is about log management with ELK stack.

Actually, it's not ELK. Instead of Elastic Search, we used OpenSearch. The course gives you the basics along with sample labs to follow.

This is available for Pro members only. Not a Pro member yet? Upgrade to Pro membership and access all 20 courses, 6 eBooks and every other premium content.

Log Management Course (ELK Stack with OpenSearch)

Stop SSH-ing into servers at 2 AM. Learn to centralize, search, and visualize logs across your entire infrastructure using fully open-source tools.

Linux HandbookYash Kiran Patil

The next course in our pipeline is GitOps video course. After that, we are also thinking of creating a course around using AI assistance in typical DevOps scenarios. I'll keep you posted.

I have been learning DevOps for a while now. The problem is not finding DevOps content on YouTube. There is plenty of it. The problem is knowing which channels are actually worth your time.

Some channels drop theory at you for 45 minutes without touching a terminal. Others teach outdated tooling. A few are genuinely excellent - structured, practical, updated, and respected by the community. I went through dozens of channels, cross-checked with what the DevOps community recommends and narrowed it down to 14 that hold up in real learning situations.

These are not ordered by subscriber count or popularity contests. They are ordered by how naturally they build on each other - from foundational to advanced, from broad to specialized.

Short on time? See the quick overview table below, then jump to the channels that match your current level.

At a Glance: All 14 Channels Compared

TechWorld with Nana - Best for a Complete DevOps Learning Path

TechWorld with Nana is the most recommended DevOps channel on communities and it earns that consistently. Nana covers the full DevOps stack - Docker, Kubernetes, CI/CD, Terraform, Ansible and monitoring - in a structured, course-style format that builds concepts before jumping into commands.

She starts with the basic concepts, builds the fundamentals and then moves towards the advanced concepts and practical approach of the concept. Especially Docker and Kubernetes Tutorial for Beginners is one of the most popular and recommended playlists on YouTube.

Who it's best for: Complete beginners who want a single channel that takes them from zero to job-ready on core DevOps tooling, without having to stitch together random videos.

Verdict: Think of this as your DevOps course library. When you need a full course on a specific tool - Terraform, AWS, Kubernetes, this is where you look first.

freeCodeCamp.org - Best for Full-Length Free Courses on Every DevOps Topic

freeCodeCamp's YouTube channel is not a DevOps-specific channel - it is a massive library of full-length, structured courses across every technical domain, and its DevOps coverage is exceptional. You will find complete, multi-hour courses on Docker, Kubernetes, Terraform, AWS, Linux, and more, all free, no sign-up required.

They usually have one-shot videos of multiple hours, which cover the whole topic in depth, like Docker Tutorial for Beginners, Kubernetes course - Full Beginner Tutorial, etc. They cover a wide range of DevOps topics in full-length videos; you name it, and they have it on their channel.

Who it's best for: Anyone who prefers structured, course-style learning, the kind where you sit down, follow along start to finish, and come out the other end having actually learned a tool completely.

Verdict: Think of this as your DevOps course library. When you need a full course on a specific tool - Terraform, AWS, Kubernetes, this is where you look first.

NetworkChuck - Best Entry Point for Absolute Beginners

NetworkChuck makes networking, Linux, Docker, and cloud concepts feel genuinely approachable. His style is upbeat, fast-paced, and deliberately beginner-friendly - built around the philosophy that the first goal is to make you comfortable enough to not quit.

He mainly makes videos related to cybersecurity, home labs, self-hosted tools and Linux, which is essential for building the prerequisites for DevOps. His storytelling abilities make you stick with the concept and follow all along.

Who it's best for: Complete beginners who feel intimidated by technical content and need a first channel that makes them feel like they can actually do this - before moving to more structured learning.

Verdict: The best channel to remove the intimidation factor before starting a structured DevOps path. Watch a few videos here, then move to a sequenced learning track.

KodeKloud - Best Channel for Learning by Doing and Certification Prep

KodeKloud started as a training platform and its YouTube channel reflects that DNA: every video is designed around hands-on exercises with a clear learning objective. It is the most consistently recommended channel on Reddit when someone asks about CKA, CKAD, or CKS Kubernetes certification prep.

The channel focused on certification prep as well as concept videos on topics like Docker, Kubernetes, Nginx, AWS, etc. Kubernetes Crash Course is one of the most popular video which covers the Kubernetes concepts in the best possible way according to the viewers.

Who it's best for: Learners who retain things by doing, not just watching - and anyone preparing for Kubernetes, Docker, or AWS certifications who wants structured prep content that matches the actual exam format.

Verdict: The best structured practice resource on YouTube for DevOps certifications. Watch KodeKloud when you are preparing for CKA, CKAD, or Docker certification - it was built for exactly that.

Fireship - Best for Fast, Accurate Concept Explainers

Fireship is not a DevOps channel - it is a technology explainer channel with a cult following, and its DevOps coverage is some of the best bite-sized technical content on the internet. The famous "X in 100 seconds" format delivers accurate, dense explanations of Docker, Kubernetes, CI/CD pipelines, Git, and cloud concepts faster than any other format.

Who it's best for: Learners at any level who want a fast, accurate reference for a concept they have heard of but do not fully understand - before going deeper elsewhere. Also excellent for keeping up with new DevOps tooling without spending hours on each one.

Verdict: The fastest way to understand what something does before committing to learning it. Use Fireship to decide what to learn next, then use a hands-on channel to actually learn it.

DevOps Directive - Best for Deep, Technically Accurate Tutorials

DevOps Directive is the channel community recommends when someone says, "I want to actually understand Docker and Kubernetes, not just copy commands." Every tutorial is longer than average, technically precise, and built around real use cases rather than simplified toy examples.

He covers the history, installation, demo, practical, deployment, clustering and CI/CD in a complete depth. His Best of DevOps Directive YouTube Videos is popular for in depth knowledge of DevOps.

Who it's best for: Intermediate learners who already have the basics and want to go deep, understanding not just how to use Docker or Terraform, but why the design decisions exist and how things work under the hood.

Verdict: When you are past the basics and want tutorials that respect your technical intelligence, DevOps Directive is where you go. Fewer videos, higher quality per video.

Kunal Kushwaha - Best Free DevOps Bootcamp on YouTube

Kunal Kushwaha's DevOps bootcamp is one of the rare examples of a complete, free, structured DevOps curriculum published entirely on YouTube. The bootcamp covers Linux, Docker, Kubernetes, networking, Git, CI/CD, and cloud from scratch, in a sequence that actually makes sense as a learning path.

DevOps Bootcamp is a popular series in which he has covered the DevOps topics in depth; the teaching style is more of a conversation where you don't feel it as a scripted story.

Who it's best for: Beginners and intermediate learners who want a free, structured bootcamp they can follow from start to finish - without paying for a course platform or stitching together random videos.

Verdict: If you want a free, complete, structured bootcamp that you can follow without paying anyone, Kunal Kushwaha's bootcamp series is the honest answer.

TrainWithShubham - Best for Project-Based Learning and Roadmap Clarity

TrainWithShubham is built around one idea: learning DevOps by building and deploying real projects. Shubham Londhe focuses on projects that you can put on a resume, CI/CD pipelines, containerized deployments and infrastructure automation and explains the roadmap clearly for learners unsure what to learn next.

The creator teaches in the native language Hindi, so it might be a con for other language users, but for users whose native language is Hindi it provides a clear understanding of the topic that he covers fully. Has one of the best one-shot videos, like Linux One Shot, Kubernetes One Shot and many more.

Who it's best for: Beginners and intermediate learners who are actively job-hunting or building a portfolio, and want project-based tutorials that produce something real, not another to-do app deployed locally.

Verdict: If building an actual DevOps portfolio is your goal, TrainWithShubham's project-based approach gives you real output for every hour you invest, especially if you are a Hindi audience.

That DevOps Guy - Best for Honest, Real-World Kubernetes Content

Marcel Dempers does not make content for clout. That DevOps Guy is built around real Kubernetes setups, actual production decisions, and content that tells you what actually happens when things go wrong, not just the happy path. The channel covers Kubernetes, Helm, GitOps, ArgoCD, and service mesh with a refreshing absence of marketing language.

What makes him truly unique is his distinctive teaching style combined with those nostalgic, retro-style animations that make even the most complex concepts feel simple and fun. His real, no-fluff talk in every video delivers deep, practical knowledge that actually sticks - turning technical topics into something you genuinely enjoy learning.

Who it's best for: Intermediate to advanced learners who want Kubernetes content that reflects what real deployments actually look like - including the failure modes, tradeoffs, and operational realities that most tutorials skip.

Verdict: One of the most trusted voices in the Kubernetes space, precisely because Marcel does not oversimplify. When you are ready for production-level content, this channel is a regular stop.

KubeSimplify - Best Channel Focused Entirely on Kubernetes

KubeSimplify does one thing: Kubernetes. Not Docker fundamentals, not cloud basics, Kubernetes concepts, tools, and ecosystem in depth. The channel covers Helm, Kustomize, GitOps, cluster management, networking, and Kubernetes tooling with a focus on making concepts clear through practical demos.

The Kubernetes Course by him is one of the suggested courses for gaining complete knowledge of Kubernetes.

Who it's best for: Learners who have Docker and basic Kubernetes knowledge and want to go deep specifically into the Kubernetes ecosystem - Helm, GitOps, cluster operations, RBAC, networking policies, and more.

Verdict: The go-to channel when you are ready to move beyond kubectl apply and actually understand how Kubernetes production setups are built.

Bret Fisher - Best for Docker and Kubernetes Live Q&A

Bret Fisher has been teaching Docker since before it was cool. His live sessions are a masterclass format that few channels match: real questions from real engineers, answered in real time with actual Docker and Kubernetes context - not scripted scenarios.

Cloud Native DevOps and Docker Talk is a series popular for live shows with Q&A and guests from the cloud native ecosystem.

Who it's best for: Intermediate learners who have hit real-world problems they cannot find answers to in tutorials - Bret's live Q&A sessions are specifically good for the gap between "tutorial worked" and "production is broken."

Verdict: Once you have real Docker and Kubernetes problems, not just tutorial exercises - Bret Fisher's Q&A sessions are one of the most valuable resources available for free.

Anton Putra - Best for Production-Grade AWS, Terraform, and Kubernetes Content

Anton Putra is the channel community calls "underrated gem" on a regular basis, and the description is accurate. The content is production-grade: real AWS architectures, Terraform modules that reflect actual engineering decisions, Kubernetes setups built the way teams actually build them, not simplified for beginners.

AWS EKS Kubernetes Tutorial is one of the recommended playlists for learning production-grade kubernetes learning.

Who it's best for: Advanced learners and working engineers who want content that reflects production reality - AWS infrastructure, Terraform state management, Kubernetes cluster operations, observability, and CI/CD at scale.

Verdict: If there is one underrated channel on this entire list, it is Anton Putra. The quality-to-subscriber-count ratio is remarkable. Subscribe before the rest of the internet catches up.

Abhishek.Veeramalla - Best for DevOps Roadmap, Real Projects, and Interview Preparation

Abhishek Veeramalla has built one of the fastest-growing DevOps channels by doing something most channels avoid: being explicit about what you need to learn, in what order, and why - from the perspective of someone actively placing engineers into DevOps roles. The channel covers projects, roadmaps, and interview preparation with rare practical clarity.

DevOps Engineer in 3 months is the playlist many people follow to learn DevOps. He is also covering topics like AI assisted DevOps, Learning, DevSecOps and many more.

Who it's best for: Beginners and intermediate learners who want a clear learning roadmap, hands-on project walkthroughs, and honest interview preparation content - especially those targeting their first or second DevOps role.

Verdict: If you are building toward a DevOps role and want a channel that connects learning to employment outcomes, Abhishek Veeramalla is one of the most practically useful channels on this list.

Jeff Geerling - Best for Ansible, Homelab Infrastructure and Automation

Special mention for Jeff Geerling, the internet's go-to resource for Ansible, not as a passing topic, but as a deep, ongoing practice. Beyond Ansible, his channel covers Raspberry Pi infrastructure, homelab automation, and systems topics that most DevOps channels do not touch, all with a level of technical depth that reflects decades of hands-on systems work.

Homelab playlist is one of the most popular ones viewers recommend for actual technical depth. Ansible playlist contains all the content about Ansible, your one-stop solution for Ansible concepts.

Who it's best for: Engineers who want to master Ansible for real infrastructure automation, homelab enthusiasts who want to take their setup to a professional engineering level, and anyone who wants content that goes deep on systems topics.

Verdict: For Ansible specifically - Jeff Geerling is the answer, full stop. The channel is what trustworthy, technically serious free content looks like.

FAQ

You will have some questions in mind, so let me answer some of those.
Do I need to watch all these channels?
No. Most people get structured value from 2-3 channels at a time. Start with one beginner-friendly channel (TechWorld with Nana, Kunal Kushwaha, or NetworkChuck), add a hands-on or cert-focused channel (KodeKloud), and a specialized one based on your current tool focus. Add the rest as your skill level grows.

What is the recommended order for a complete beginner?
A practical sequence: NetworkChuck (comfort with Linux and Docker basics) → TechWorld with Nana (structured DevOps roadmap) → KodeKloud (hands-on labs and cert prep) → DevOps Directive or That DevOps Guy (production depth). Use Fireship throughout as a quick reference when you encounter new concepts.

Are these channels still actively updated in 2026?
All channels on this list are actively publishing as of April 2026. Anton Putra and DevOps Directive publish less frequently but maintain consistent quality.

Which channels are best specifically for Kubernetes?
In rough order of depth: KubeSimplify (K8s-focused, breadth of ecosystem), That DevOps Guy (production realism), KodeKloud (cert prep), Anton Putra (cluster operations, Terraform + K8s integration). TechWorld with Nana has solid K8s fundamentals for beginners.

Are these channels useful for someone already working as a DevOps engineer?
Yes - specifically That DevOps Guy, Anton Putra, Jeff Geerling, KubeSimplify, and Bret Fisher. These four channels produce content that reflects real production decisions rather than learner-facing introductions. The others are better suited to foundational or intermediate learning.

Which channels cover cloud platforms (AWS, Azure, GCP) beyond just containers?
Anton Putra (AWS + Terraform depth), TrainWithShubham and Abhishek.Veeramalla (AWS projects), freeCodeCamp (platform-agnostic full courses), TechWorld with Nana (all three major cloud providers covered). KodeKloud has certification prep for AWS, Azure, and GCP certifications.

Final recommendation

If you are just starting out: TechWorld with Nana, trainwithshubham gives you the roadmap, KodeKloud gives you the practice. Those two together cover what most DevOps learners need through the intermediate stage.

If you are preparing for certifications: KodeKloud is the standard recommendation for a reason. The CKA and CKAD prep content is the best free version available.

If you want production-level depth: Anton Putra for infrastructure, That DevOps Guy for Kubernetes operations, Jeff Geerling for Ansible. These three channels give you what textbooks and tutorials usually skip.

If you know of a channel that deserves to be on this list, don't wait and drop it in the comments below!

You're debugging logs the hard way.

A single app on a single server is manageable. Ten servers? Fifty containers? Log files become a nightmare you can't grep your way out of.

Your current workflow at 2 AM:

$ ssh prod-server-01
$ tail -f /var/log/app.log # nothing obvious
$ ssh prod-server-02
$ grep -r "error" /var/log/ | awk '{print $5}'
# 20 minutes later... still piecing it together

The ELK Stack centralizes every log from every service into one searchable, visualizeable system. You go from reacting to incidents to proactively catching them before they happen.

What you'll learn

🏗️ ELK Architecture: How logs flow from your app through Logstash into OpenSearch and out to dashboards.

⚙️ Logstash Pipelines: Parse, filter, and enrich raw logs before they hit your index.

🔍 Query DSL & Indexing:Search across millions of log events in milliseconds.

📊 Kibana Dashboards: Build visualisations that surface patterns raw log files never could.

🔒 Security & Access Control: TLS, users, roles — features Elasticsearch charges for, free on OpenSearch.

🤖 ML-Powered Anomaly Detection: Let OpenSearch flag unusual patterns before your users notice them.

📈 Scaling OpenSearch: From a single node to a cluster that handles production traffic.

Who this course is for?

✅ Linux / DevOps Engineers: You manage servers and containers and want a proper observability stack without Elastic's licensing fees.

✅ Backend Developers: You deploy apps and want to understand what's actually happening in production when things break.

✅ SRE / Platform Engineers: You need centralised logging across microservices and want a self-hosted solution you fully control.

✅ Teams Migrating Off Elastic: You're moving away from paid tiers and want to get up to speed on OpenSearch fast.

Start learning today

Stop reacting. Start observing.

Everything you need to build a production-grade observability stack. Free, open source, and ready to deploy.

Included with Linux Handbook Pro.

For years, my default setup for Linux demos was simple. Spin up a virtual machine, configure the environment, take a snapshot, and hope nothing breaks during the presentation.

In fact, my old demo setup was a collection of virtual machines I'd accumulated over the years. One for Docker demos, another for Kubernetes workshops, and a third one, a Debian box for shell scripting sessions. Each one sat on my SSD, consuming gigabytes of space and demanding occasional updates just to stay usable.

The breaking point came during a Kubernetes workshop I was running remotely. Screen sharing was already choppy because OBS, Chrome, and the VM were all fighting over the same CPU. Then the VM froze mid-demo during a kubectl walkthrough. The audience waited in silence. I got it working again, but the rhythm of the session never recovered.

That evening, I started looking for something better. I found Webtop, and it quietly replaced most of that VM setup.

What Webtop Actually Is

Webtop is a Linux desktop environment packaged inside a Docker container and accessible entirely through a browser. You start the container, open a browser tab pointing to port 3000, and a full Linux desktop appears.

LinuxServer.io maintains this project. The same group provides container images for Jellyfin, Nextcloud, and dozens of other self-hosted tools.

What surprised me when I first launched it was how complete the experience felt. You get a real desktop environment, with the option to choose from XFCE, KDE, MATE, or others, depending on the image, with a terminal, file manager, and the ability to install packages normally through apt, dnf, or whatever the base distro uses. It behaves like a lightweight remote workstation that happens to live in your browser.

Getting It Running

The quickest path is Docker Compose or Podman Compose. Here's the configuration I started with:

services:
  webtop:
    image: lscr.io/linuxserver/webtop:ubuntu-xfce
    container_name: webtop
    security_opt:
      - seccomp:unconfined
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Asia/Kolkata
    volumes:
      - ./config:/config
    ports:
      - 3000:3000
    shm_size: "1gb"
    restart: unless-stopped

Running docker compose up -d and then navigating to http://[SERVER-IP]:3000, or http://localhost:3000 genuinely all it takes. The first boot took maybe 10 seconds before the desktop was usable.

Choosing the Right Image

Webtop supports multiple distributions and desktop environments. The available combinations include Ubuntu, Debian, Fedora, Alpine, and Arch, each paired with desktop options like XFCE, KDE, and MATE. You can find all related tags on the project's GitHub page.

From my practical experience, XFCE consistently performs best for demos and workshops. It's lighter on resources, and the responsiveness during screen sharing is noticeably better than KDE. KDE is visually polished and worth running if you have headroom, but when your machine is also running OBS, a browser, and a video call simultaneously, the extra weight shows.

Alpine is worth knowing about if you need something extremely minimal. Its image is tiny and starts almost instantly, but package availability is limited compared to Ubuntu or Debian. For most demo scenarios, ubuntu-xfce hits the right balance of familiarity, package ecosystem, and performance.

Why This Works Better for Demos Than VMs

Recovery feels dramatically simpler. If I break something during a session, and with live demos, this happens. Restoring a VM means hunting for the right snapshot, waiting for it to load, and hoping the snapshot captured the right state. With Webtop, recovery looks like this:

docker rm -f webtop
docker compose up -d

That's it. A fresh environment in seconds.

Resource usage is another area where the difference is noticeable. A traditional Ubuntu VM with 8 GB allocated holds that memory whether it's being used or not. Containers are far more cooperative with the host system. After moving most of my demo environments to Webtop, I noticed the laptop fan spinning less during presentations and screen sharing becoming smoother.

Building Reproducible Demo Environments

One thing I missed initially about VMs was the snapshot workflow. It's the ability to freeze a perfectly configured state and return to it. Webtop doesn't work that way, but the Docker approach is actually cleaner once you adjust your thinking.

Instead of snapshots, I build custom images. Here's an example Dockerfile for a Kubernetes demo environment:

FROM lscr.io/linuxserver/webtop:ubuntu-xfce

RUN apt-get update && apt-get install -y \
    docker.io \
    kubectl \
    helm \
    neovim \
    tmux \
    htop \
    git

Building that with docker build -t demo-webtop . produces an image I can launch anywhere, including on my homelab server, a VPS, a colleague's machine, and get an identical environment every time.

There are no multi-gigabyte VM disk files to transfer. The image is versioned, shareable, and rebuildable from scratch if needed. For a Kubernetes workshop I ran recently, I published the image so participants could run their own copy locally, which would have been considerably more complicated to coordinate with traditional VM images.

Accessing It Remotely

Browser-based access turned out to be more valuable than I expected. I can reach my Webtop environments from any device with a browser. That portability genuinely changed how I work while traveling.

For remote access, I put Webtop behind a reverse proxy with HTTPS and authentication. Running it directly to the internet without any protection is a bad idea. You'd be serving an unauthenticated Linux desktop to the world. Here is an example configuration for Caddy:

webtop.lhb-tut.com {
    basicauth {
        bndev $2a$14$ebc7C6dlwFafmtZmfQ4vKe2ToQsTe6nWbV3k3ky6HAwLQr76u1l8m
    }

    reverse_proxy webtop:3000
}

My current setup uses Tailscale for network-level access control and Caddy for HTTPS termination.

Traefik and Cloudflare Tunnels are both solid alternatives, depending on your existing infrastructure. The key principle is the same regardless of tooling: don't expose port 3000 publicly without something in front of it.

What It Doesn't Handle Well

Webtop isn't a universal replacement for VMs, and overselling it would be dishonest. There are categories of work where I still reach for a traditional hypervisor without hesitation.

Kernel development and anything requiring full systemd Support needs a real VM. Container isolation isn't equivalent to hardware virtualization, and some low-level work simply requires full-stack virtualization and nested virtualization.

Low-level networking labs where you need to demonstrate VLAN behavior, DHCP servers, or raw packet analysis at the hardware interface level are also better suited to VMs, because container networking abstracts away exactly the things you're trying to show. Similarly, malware analysis and security sandboxing, where strong isolation is the whole point, shouldn't be done in a container environment.

GPU-accelerated workloads, video editing, and anything that genuinely needs graphics hardware won't be served well by Webtop. The rendering pipeline is inherently software-based, and the limitations are obvious in GPU-heavy applications. For terminal work, admin demos, and development environments, this is rarely relevant, but it's worth knowing upfront.

Practical Situations Where It Shines

Training sessions where participants need identical environments are where Webtop provides the most obvious value. Instead of distributing VM images and debugging hypervisor incompatibilities across fifteen different laptop configurations, participants open a browser tab. That's a meaningful reduction in setup overhead and the inevitable "it doesn't work on my machine" troubleshooting.

The disposable workstation use case is one I didn't anticipate valuing, but I use it regularly. Sometimes I need a clean Linux environment to test a script, verify a package installation, or try something I don't want running on my main machine. Spinning up a Webtop container, doing the work, and removing it takes a minute. The equivalent with VMs took considerably longer and left behind disk state to clean up.

Final Thoughts

I went into Webtop expecting curiosity. What I found was something that genuinely improved a recurring frustration in my workflow. The demo environment problem, maintaining multiple VMs, managing snapshots, and dealing with hypervisor overhead, completely went away.

The tradeoff with VMs isn't that containers are strictly superior. The point is that for the specific problem of running Linux environments for demos, workshops, and quick testing, the browser-based container approach solves the actual pain points without introducing new ones.

If you're maintaining a collection of demo VMs and spending time managing snapshots and debugging hypervisor issues, it's worth an hour to spin up Webtop and see how it feels. The barrier to trying it is low enough that the experiment costs almost nothing.