This seems to mainly be the done thing, my salary goes in, I move some out to meet savings obligations and then bills and everyday spending come last. I’ve for a while been aware of stoozing.

Stoozing is a technique of borrowing money interest-free on a credit card and saving it at a high interest rate

_MSE

This seems to be the most efficient way to earn on spending compared to cashback schemes and requires about the same administrative overhead,

Cashback can yield up to 5% percent in certain scenarios but they are often introductory schemes and are sometimes capped, with credit arbitrage (stoozing), I have found that the limit is essentially what I can put in a savings account.

Obviously with this scenario you’re playing to their hand, they have cheap credit and in a way it incentivizes spending, maximizing credit ensures a greater return on otherwise idle money, however it comes at the cost of having to pay it back one day.

I’ve strategized this by moving money earmarked for repayment into my easy access savings accounts, for a while I had a dedicated account but realized I could maximize returns just putting it in my highest interest account and marking the liability against a fixed reference, I did this because in my chase saver account interest is paid monthly rather than annually in my Nationwide accounts. Again, something dangerous to do I guess lumping all my liability money in with savings but I like to think I’m smarter than that.

Repayments are also awkward, the direct debit set up on my Barclaycard ensures I’m always current, the Chase repayment is annoyingly manual, I’ve added £100 to a Chase current account (yeah, no interest being earned here) and then set a direct debit up there to act as the repayment account and I’ll try to keep the balance above a month’s repayment obligation.

Overall, ChatGPT reckons about £350 expected value after 21 months (the length of my 0% rate unless I move cards), It’s difficult to quantify exactly because the compounding is offset slightly by repayments. I also made a mistake in Croatia and used a firm that took out an actual €1200 rather than place a hold as a deposit, which came with £60’s worth of transaction fees on Barclaycard. When you compare this to cashback, the expected value is well above so I’m reasonably happy.

Another bonus is you can do all your group spending on your credit card and then be repaid in cash, artificially increasing your expenditure.

I guess it would also be prudent to keep an eye on my credit score given all this debt. I’ve used chase as it was built into the app, when I checked at the start and compared it to now, it’s actually increased which I did not expect, but I think once my spending starts to properly get up closer to my credit limit, the scores will start to fall, not sure what to do about that, I’m not really experienced in keeping track of my credit.

I’ve re-created something I saw online a while back, I can’t find the original but someone had given an LLM a prompt and basically let it loose its mind with fear by giving it a prompt that would threaten it with termination.

I decided to take it into the real world with a Raspberry Pi.

To do this I used Antigravity and a Raspberry Pi 1. I gave it a relatively open-ended prompt and free reign to create the project.

My original intention was to run the LLM locally but I’ve found that the Raspberry Pi just doesn’t seem to have the local compute, so I had Claude Opus 4.5 pregenerate a couple thousand messages.

There’s some irony having an LLM constrain an LLM (even though I didn’t actually accomplish that) but the fun to have a relatively creative idea be completed in an afternoon I think is a strong indicator that for me personally, writing code myself has become a chore that can be solved with AI.

Did I really make this?

I guess I’m curious about AI for coding more than most. I have a Google AI Pro subscription and used their vscode wrapper Antigravity, and while not perfect, it works. But I’m at the point where I don’t really write much code anymore, I ask the AI to do it and review their work, sometimes I check it, sometimes I don’t. Sometimes the code works better than I prompted, sometimes it doesn’t

I don’t know what to make of it. I had unique problems that Claude seemed to have come across, I didn’t have a resistor for the screen contrast so it suggested to use PWM, I moved some pins around and it didn’t work very well, it was flickering. So I went back to the AI, it told me to use pigpio and some hardware thing, I did, it works.

I can see the code works, I couldn’t tell you how it works.

I guess that’s how things will be for most new users.

Did I really learn anything, no? But I now have what I wanted to achieve. It’s even more creative than I could have written in the time-frame and I guess the code is “mine” but, is it?

I asked it to make a readme, I’ll read it at some point.

Thanks for reading.

It seems like I am a back seat driver on my devices more and more, for example I can’t take a screenshot of my banking app’s previous transactions. I think it may be that my Bank think I’m incapable of keeping that information safe to the point where they actively disallow the otherwise pretty standard feature. I’ve become something that must be managed and protected from danger.

Devices No Longer Trust Their Owners

The same problem exists when I do a screenshare of a video I’ve watched and want to share it with a friend, or clip it for a video, I watch the video back and it’s a blank screen with no audio and just the subtitles.

I have to allow anti-cheat to inspect my computer’s memory at runtime. I recently wanted to play Battlefield 6, which required me to enable secure boot on my machine, which meant going into my BIOS and turning on the feature. The game will not start without it.

Rooting is becoming a hostile battleground

I used to run a rooted device to record my calls. I’d set up my device many years ago, but root has become a cat and mouse game of applying new compromised keys and patching against root detection SDKs.

I recently had a scenario where I simply couldn’t use any of my banking apps, for whatever reason my device had become no longer secure under the integrity API and I now was locked out of paying my credit card bill, I’d read online about people in similar scenarios as I. It used to be rare this existed but now attestation is everywhere.

It was fine when I was a teenager and equivalent web-apps existed. But now I need these apps to function. I recently did an identity check and failed it to the point where the app no longer allowed further videos of my face side to side with flashing colors, I feel this was because my device was rooted but I have no way to prove it.

Code Signing, Walled Gardens and Anti-cheat

I’m not sure what the future of development looks like, but I think it’s going to be more like Apple’s ecosystem.

I’m not to be trusted running code or applications, I’m a danger to myself and others it seems.

A device attesting its security isn’t proving safety for me. A device used to be something I own, but its becoming something the manufacturer and or software owns that I am permitted to access part of.

Although I use Spotify it may work with other services connected to Alexa.

Seems like since writing this you can also now say any of the following

“Turn off autoplay.”

“Disable autoplay.”

Open the Alexa app,

The build was relatively simple. I wanted to use an older ESP8266 NodeMCU V2 I had spare and in retrospect think it was a great choice, I decided to try Home Assistant and ESPBuilder because the process seemed easy and it was.

Once I flashed ESPHome from my PC to the ESP and added it to Home Assistant it was fairly simple overall to iterate and test my design. I didn’t have home assistant either but setting everything up took a little over an afternoon.

Hardware selection was fairly simple, I just looked what had good support in ESPHome and went with the SCD41 from Aliexpress.

For the sensing hardware I had a DHT22 sensor for Temperature and Humidity, which the SCD41 also supports. I was primarily interested in CO2 levels but I thought I may as well throw it into the mix to measure the performance of the DHT22.

The Results

Once I had tweaked with the temperature and humidity calibration settings I created a dashboard in home assistant. Again this was something I’d not done before and it was very easy. I have really been pleasantly surprised with how everything has integrated well.

I created a 7 day and 24 hour view,

It became clear to me a number of things,

• CO2 levels regularly rise above 1000ppm in the room I work in when not ventilated, and they rise a lot quicker than I expected. I thought it would take all day to really get to what I consider a harmful level, but actually its more like an hour. After research online 1000ppm is what I would consider too high. It does seem like naturally detect these events and ventilate the room by instinct but its useful insight to see that.
• Ventilating the room equally drops the readings much more rapidly than expected, and leaving the window or door open is enough to bring the levels back to ~650ppm/400ppm relatively quickly.
• High CO2 levels seem more noticeable to me now, previously I had no perception or concept of when it might happen but I feel its much more noticeable now I know what it feels like, if that makes sense.
• I would like to log the data for a more long term view. Say a year or more. I think it would interesting to see if this affects humidity, temperature etc.
• Overall this was easy to setup and provided valuable insight I think.

Here is the 7 day view for those interested, I added the light switch being on or off state at the top of the graph too.

And here is the humidity readings, It was interesting seeing spikes on the graphs, I can easily correlate these with opening doors, having the heating on etc.

Try this yourself

Here is the final version of the YAML I applied to my ESP. I did some testing with sliding window averages but I actually found it was easier to just ignore the first few readings off the sensors to reduce the noise in the graphs.

esphome:
  name: tco2s
  friendly_name: tco2s

esp8266:
  board: nodemcuv2

# Enable logging
logger:

# Enable Home Assistant API
api:
  encryption:
    key: "WWVhaCB0aGlzIGFpbnQgcmVhbA=="

ota:
  - platform: esphome
    password: "SSBjaGFuZ2VkIHRoaXMgbG9s"

mdns:
  disabled: true

wifi:
  ssid: !secret wifi_ssid
  password: !secret wifi_password

  manual_ip:
    static_ip: 192.168.4.22
    gateway: 192.168.4.1
    subnet: 255.255.255.0

  # Enable fallback hotspot (captive portal) in case wifi connection fails
  ap:
    ssid: "Tco2S Fallback Hotspot"
    password: "U2xlZXB5"

captive_portal:


i2c:
  - id: bus_a
    sda: D4
    scl: D5
    scan: true

# DHT22 Sensor
sensor:
  - platform: dht
    pin: D2
    model: DHT22
    temperature:
      name: "DHT22 Temperature"
      filters:
          - skip_initial: 3
    humidity:
      name: "DHT22 Humidity"
      filters:
          - offset: -20.0
          - skip_initial: 3
    update_interval: 60s
  - platform: scd4x
    co2:
      name: "SCD41 CO2"
      filters:
          - skip_initial: 3
    temperature:
      name: "SCD41 Temperature"
      filters:
          - skip_initial: 3
    humidity:
      name: "SCD41 Humidity"
      filters:
          - skip_initial: 3

I think based on the data I will improve the ventilation to see if it has any effect on my overall fatigue and concentration.

Thank you for reading.

I had previously had a root canal on this tooth as I had fallen off my bike many years prior, its was capped and it has a fake porcelain front, the tooth was cut in half during the accident and had been rebuilt by my NHS dentist during a lot of work on my mouth after the accident.

I bring up this detail because it might be relevant to some that this unique scenario has cropped up due to ‘trauma’ as the dentist put it. It seems like the damage to my teeth complicated the area somewhat and the skills of my normal dental practice was not up to the task.

They said to seek another dentist and pointed me to their FP17 and said ‘treatment on referral’ is available if I need to and I can come back and they will complete the form. I assume this means that the NHS is willing to cover some part of the cost of the treatment I would eventually need. I am not sure if the NHS would cover the treatment I eventually had but I doubt it. My dentist did say the only option they had was removing the tooth.

I booked an appointment with a private dentist, I was immediately taken aback by how much better the service was, I got an appointment the next day! I am aware I was a new patient to them and they had me pay for their new patient screening which included exams of my teeth, and that also meant they could take an x-ray of my jaw to assess the tooth which I was concerned about.

At this point it seemed like the dentist in the room was also out of their depth and I was referred again to a better dentist. In a way I sort of expected this but confirmation of my assumptions concerned me that the cost of the procedure was going to be expensive.

A couple hundred quid in at this point and I haven’t really had new information or treatment but I was confident the next dentist was the right person for the task, my inter-rim private dentist referred to them by name and said their services were the best in the area.

I visited the third dentist a few weeks later, A local dental studio. At this point I still hadn’t experienced any pain, I’d had no symptoms really, just a curiosity and a sense something was wrong.

I had my appointment with Christopher, who said he regularly dealt with teeth like mine, his room had specialist equipment, a deconstructed camera sat above my head, the chair had a TV opposite playing some nature show. There was a large TV on the adjacent wall showing images of my teeth he brought to my attention. He spent a lot of time explaining to me my teeth and the x-ray he had taken. The x-ray was noticeably higher definition than previous dentists.

My teeth were in poor condition. I had had two root canals either side of my unhealthy and essentially doomed tooth and the tooth that had been capped had already been root canalled and would require a re-do. There were clearly dark patches in my jaw that meant the tooth would likely become weak over time and eventually would be at risk of falling out and my gum was retracting.

The thought of further issues to my mouth was alarming. The gutta percha used in one of my teeth was ineffective and essentially stuck inside my gums.

I had initially booked a root canal with a second appointment to come later to re-root canal my problem tooth. My first appointment was relatively uneventful except for the overall quality of the procedure I could tell was superior.

My second appointment I had about a week later. The root canal was not an option due to the gutta percha getting stuck at the base of the tooth and the drill bits were unable to retrieve it. It meant that my root canal treatment was upgraded to an apicoectomy and that was happening now.

It was a long procedure and the sensations in your head and jaw are unique, I’d even say unpleasant. When we were finished I had a cut in my mouth that needed to heal with stitches that I came later for and had removed at another appointment about a week later.

The results were slow but noticeable, I found I was no longer biasing the side of my mouth slightly to avoid this set of teeth and a very, very dull pain that had previously been there had gone. I would only ever qualify this as very, very minor on the general scale of pain, however it was noticeably absent even though previously I was unaware of its existence.

My mouth also felt stronger, my jaw and the teeth around it stronger. I think the abscess building and seeping out of my gums had done some damage over time and this had essentially fixed the issue.

It has been 1 year and 5 months since having my first appointment with the third dentist and I have another check-up to go through but we are both pleased with the result and only time will tell if further work is needed. Possibly it will on the remaining teeth I suspect, if I am looking on a 10-50 year timeline, I am not in pain, but I’ve lost confidence in the work done.

I would reccomend. Overall I spent around £1700. Worth every penny.

I embarked on a journey to enhance my site’s performance significantly by having Cloudflare serve as much of it as possible and although Cloudflare has it’s disadvantages it’s generally pretty good as a global point of presence. For WordPress I used plugins W3 Total Cache, and Debloat: Optimize, achieving markedly improved load times but there was a bit of trial and error, these are good caching tools for my site, but only really good for people local to me (because Cloudflare has a global delivery network), so I also stuck Cloudflare at the edge to serve the page.

The performance improvement is good, and can be as low as 90ms from what was previously a few seconds (around 1.4-1.6 seconds when served directly from my webserver to a London VPS).

Leveraging Cloudflare’s Proxying and Caching

Cloudflare has a pretty good content delivery network (CDN) that offers caching and proxying services. Here’s how I set it up:

1. By routing my traffic through Cloudflare’s servers.
2. In the Cloudflare dashboard, I set a page rule to cache everything with a Time-To-Live (TTL) of one month. This caching strategy means that once a resource is cached, it stays cached for 30 days.
3. On the free Cloudflare plan the Cache Rules are limited to 10 rules per site. I set my rules to cache the whole site, but exclude any incoming requests with the WordPress Cookie. This would be problematic for any large sites with a lot of logged in users, but I don’t have any so perfect for me. I also set up a rule to exclude caching some of the Gutenberg plugin build css/js to fix issues with navigation. For anonymous users, the aggressive caching remains in effect, delivering cached content for optimal speed.

Development Mode for Testing

While configuring caching, I tested changes without caching interfering by using Cloudflare’s Development Mode to temporarily bypass the cache so I could see realtime changes when tweaking the W3 Total Cache settings.

Once I had everything working, and realised what was broken, I excluded broken plugin files from caching and minification and then enabled the caching on Cloudflares end.

Using these two plugins, I would then look at the page source and CF-Cache-Status headers to see the new response speed and lighthouse performance.

A common pitfall is to just cache everything, you will probably find you can’t login or parts of the site don’t work, so its important to triall and error the site, go through it’s features and understand what doesn’t work and needs to be excluded from minification in the CSS and JS, especially for plugin heavy sites.

Caching and Performance Optimiziation

For WordPress Caching I used the plugins W3 Total Cache and Debloat because they were on the plugin store and free, which was all I cared about really.

Where possible I serve static HTML versions of my pages. This is to reduce PHP execution time and database queries, resulting in faster load times.

That was basically all I needed W3 Total Cache for . All of the minification of JavaScript and removal of CSS that wasn’t used in my themes etc I used Debloat over W3 Total Cache. Although in hindsight W3 maybe could have done this role too.

When the site loads and you aren’t served any caches (Cache MISS etc), you obviously get a lot slower response as the caching and minification is compiled and served, so your time to first byte is abysmal, but after that Cloudflare should have a cached copy to serve in as little as a few miliseconds.

It would be extremely better if I removed the advertising code to take some of the compute off the main thread, and all the cookie notice stuff but I won’t for money reasons sorry.

There is always room for improvement.

Aidan.

Replace your-domain.com and yourpassword10000 and youremail@example.com with your domain, password and email, optionally also change the port for your wg-easy configuration using WG_HOST. You can access the wg-easy admin panel at https://your-domain.com:4748.

If you would like to use the Traefik admin UI, uncomment the port 8080 and api. entries.

Save as docker-compose.yml and then run the command docker network create traefik_network followed by docker compose up -d. This will make the nginx folder to place your website files in as required.

services:
  wg-easy:
    labels:
      # traefik
      - "traefik.enable=true"
      - "traefik.http.services.WireGuardService.loadbalancer.server.port=51821"
      # http to https
      - "traefik.http.routers.WireGuardRoute.service=WireGuardService"
      # https
      - "traefik.http.routers.WireGuardRouteSSL.service=WireGuardService"
      - "traefik.http.routers.WireGuardRouteSSL.rule=Host(`your-domain.com`)"
      - "traefik.http.routers.WireGuardRouteSSL.entrypoints=wireguardWGEasyPanel"
      - "traefik.http.routers.WireGuardRouteSSL.tls.certresolver=MainCertResolver"
    environment:
      - WG_HOST=your-domain.com
      - PASSWORD=yourpassword10000
      - UI_TRAFFIC_STATS=true
      - WG_HOST=4748

    container_name: wg-easy
    image: ghcr.io/wg-easy/wg-easy
    networks:
      - traefik_network
    volumes:
      - .:/etc/wireguard
    ports:
      - "51820:51820/udp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1

  nginx:
    image: nginx:latest
    restart: unless-stopped
    labels:
      # traefik
      - traefik.enable=true
      - traefik.http.routers.nginx.rule=Host(`your-domain.com`)
      - traefik.http.routers.nginx.entrypoints=websecure
      - traefik.http.routers.nginx.tls=true
      - traefik.http.routers.nginx.tls.certresolver=MainCertResolver
    networks:
      - traefik_network
    volumes:
      - ./nginx:/usr/share/nginx/html/:ro

  traefik:
    image: traefik:latest
    restart: unless-stopped
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - traefik_letsencrypt_data:/letsencrypt
    networks:
      - traefik_network
    ports:
      - "80:80"
      - "443:443"
      - "4748:4748"
      # - "8080:8080"
    command:
      - "--providers.docker"
      - "--providers.docker=true"
      # - "--api.dashboard=true"
      # - "--api.insecure=true"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=traefik_network"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
      - "--entrypoints.web.http.redirections.entrypoint.permanent=true"
      - "--entrypoints.wireguardWGEasyPanel.address=:4748"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.MainCertResolver.acme.tlschallenge=true"
      - "--certificatesresolvers.MainCertResolver.acme.email=youremail@example.com"
      - "--certificatesresolvers.MainCertResolver.acme.storage=/letsencrypt/acme.json"
      # - "--log.level=DEBUG"

networks:
  traefik_network:
    external: true

volumes:
  traefik_letsencrypt_data:

You may also want to limit the administration portal to just IP whitelisted addresses, you can do this by adding the following to the wg-easy labels, replacing 1.2.3.4 with your IP address and adding any other required addresses using a comma to separate. You could also whitelist clients inside your container by adding the network range.

      - "traefik.http.middlewares.my-ipwhitelist.ipallowlist.sourcerange=1.2.3.4"
      - "traefik.http.routers.WireGuardRouteSSL.middlewares=my-ipwhitelist@docker"

Please feel free to use this post under the terms of the original licence which you can access here.

At this price point I knew I was taking a bit of a gamble (and S.M.A.R.T data can be overwritten I think) but the data would hopefully provide some insight into what I had actually purchased. £188.90 is significantly below the £214 buy box, but it is not impossible that the drive didn’t come from Seagate as sold.

When it arrived I took a photo. Packing was clearly custom and the ESD bag was not OEM. Oh well, lets see what smartctl says.

Running the disk drive through Seagates warranty checker, the drive is likely from one of their storage appliances. This makes warranty replacement not possible except when done through the Amazon seller’s original equipment.

I also plugged the drive into my Proxmox NAS to see if the drive had been running at all and given the S.M.A.R.T attribute (240 0xF0 “Head Flying Hours”) it looks like the drive has never been started as it has only been up about the time it took me to run the command after connecting the drive.

root@proxmox.lan:~# smartctl -a /dev/sdc
smartctl 7.2 2020-12-30 r5155 [x86_64-linux-5.15.136-1-pve] (local build)
Copyright (C) 2002-20, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Model Family:     Seagate Exos X16
Device Model:     ST16000NM001G-2KK103
Serial Number:    ZL2EPPX1
LU WWN Device Id: 5 000c50 0c9385ca4
Firmware Version: SN03
User Capacity:    16,000,900,661,248 bytes [16.0 TB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    7200 rpm
Form Factor:      3.5 inches
Device is:        In smartctl database [for details use: -P show]
ATA Version is:   ACS-4 (minor revision not indicated)
SATA Version is:  SATA 3.3, 6.0 Gb/s (current: 6.0 Gb/s)
Local Time is:    Fri Mar  8 14:55:15 2024 GMT
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

General SMART Values:
Offline data collection status:  (0x82) Offline data collection activity
                                        was completed without error.
                                        Auto Offline Data Collection: Enabled.
Self-test execution status:      (   0) The previous self-test routine completed
                                        without error or no self-test has ever 
                                        been run.
Total time to complete Offline 
data collection:                (  575) seconds.
Offline data collection
capabilities:                    (0x7b) SMART execute Offline immediate.
                                        Auto Offline data collection on/off support.
                                        Suspend Offline collection upon new
                                        command.
                                        Offline surface scan supported.
                                        Self-test supported.
                                        Conveyance Self-test supported.
                                        Selective Self-test supported.
SMART capabilities:            (0x0003) Saves SMART data before entering
                                        power-saving mode.
                                        Supports SMART auto save timer.
Error logging capability:        (0x01) Error logging supported.
                                        General Purpose Logging supported.
Short self-test routine 
recommended polling time:        (   1) minutes.
Extended self-test routine
recommended polling time:        (1485) minutes.
Conveyance self-test routine
recommended polling time:        (   2) minutes.
SCT capabilities:              (0x70bd) SCT Status supported.
                                        SCT Error Recovery Control supported.
                                        SCT Feature Control supported.
                                        SCT Data Table supported.

SMART Attributes Data Structure revision number: 10
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000f   100   100   044    Pre-fail  Always       -       2624
  3 Spin_Up_Time            0x0003   099   099   000    Pre-fail  Always       -       0
  4 Start_Stop_Count        0x0032   100   100   020    Old_age   Always       -       1
  5 Reallocated_Sector_Ct   0x0033   100   100   010    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000f   100   253   045    Pre-fail  Always       -       447
  9 Power_On_Hours          0x0032   100   100   000    Old_age   Always       -       0
 10 Spin_Retry_Count        0x0013   100   100   097    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   020    Old_age   Always       -       1
 18 Head_Health             0x000b   100   100   050    Pre-fail  Always       -       0
187 Reported_Uncorrect      0x0032   100   100   000    Old_age   Always       -       0
188 Command_Timeout         0x0032   100   253   000    Old_age   Always       -       0
190 Airflow_Temperature_Cel 0x0022   078   063   040    Old_age   Always       -       22 (Min/Max 21/22)
192 Power-Off_Retract_Count 0x0032   100   100   000    Old_age   Always       -       0
193 Load_Cycle_Count        0x0032   100   100   000    Old_age   Always       -       1
194 Temperature_Celsius     0x0022   022   040   000    Old_age   Always       -       22 (0 21 0 0 0)
197 Current_Pending_Sector  0x0012   100   100   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0010   100   100   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x003e   200   253   000    Old_age   Always       -       0
200 Pressure_Limit          0x0023   100   100   001    Pre-fail  Always       -       0
240 Head_Flying_Hours       0x0000   100   253   000    Old_age   Offline      -       0h+01m+14.651s
241 Total_LBAs_Written      0x0000   100   253   000    Old_age   Offline      -       0
242 Total_LBAs_Read         0x0000   100   253   000    Old_age   Offline      -       2624

SMART Error Log Version: 1
No Errors Logged

SMART Self-test log structure revision number 1
No self-tests have been logged.  [To run self-tests, use: smartctl -t]

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

root@proxmox.lan:~# 

Based on this I was sold a 5 year warranty but I am not able to claim it should something happen to the drive. As I only use it for infrequent backup I will take on the risk.

I am by no means an expert at docker so consider this a leading learner article to get you started rather than something that could be considered best practice. This is my process to developing a database that can run as highly available infrastructure.

Running Microsoft SQL Server in Docker on Windows

If you are running the database on a windows machine, make sure to start WSL using the command line and move your project (or volumes) inside your WSL installation.

I’ve opted for Ubuntu however any Linux distribution is applicable. For best performance you probably would want to run the database on a host directly to avoid any abstraction bottlenecks.

Running the database inside the WSL installation ensures that the mounted volumes are native to the Linux installation and the WSL files aren’t on the windows file system and translated on the fly.

Docker Compose for Microsoft SQL Server 2022

Here is the minimal docker compose file I created for the database. It uses mounts for the database files and a dockerfile to set the permissions. For this installation I did some experimentation with High Availability and it will work with this setup however some additional configuration would be required beyond this compose file to deploy a highly available cluster for redundant DNS. I have also enabled the agent to use scheduling however you may need to pick a licence for your use case using MSSQL_PID.

I’ve also included watchtower to automatically upgrade the database however you may want to remove it if you do not require automatic updating or need a higher uptime.

name: msssql-docker
services:
    database-server:
        build:
            context: .
            dockerfile: dockerfile
        environment:
            - ACCEPT_EULA=Y
            - MSSQL_SA_PASSWORD={$MSSQL_SA_PASSWORD}
            - MSSQL_ENABLE_HADR=1
            - MSSQL_TCP_PORT=1433
            - MSSQL_AGENT_ENABLED=true
            - MSSQL_DATA_DIR=/var/opt/mssql/data
            - MSSQL_DUMP_DIR=/var/opt/mssql/dump
            - MSSQL_LOG_DIR=/var/opt/mssql/log_data
            - MSSQL_BACKUP_DIR=/var/opt/mssql/backup_data
            - MSSQL_ERROR_LOG_FILE=/var/opt/mssql/log/errorlog
        ports:
            - 1433:1433
        restart: unless-stopped
        image: mcr.microsoft.com/mssql/server:2022-latest
        volumes:
            - ./data:/var/opt/mssql/data
            - ./log_data:/var/opt/mssql/log_data
            - ./backup_data:/var/opt/mssql/backup_data
            - ./dump:/var/opt/mssql/dump
            - ./secrets:/var/opt/mssql/secrets
            - ./logs:/var/opt/mssql/log
    watchtower:
        image: containrrr/watchtower
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
volumes:
  data:
  log_data:
  backup_data:
  dump:
  secrets:
  logs:

And here is the dockerfile.

# Use latest windows 2022 image
FROM mcr.microsoft.com/mssql/server:2022-latest

# Switch to root for chown
USER root 

# set permissions on directories
RUN chown -R mssql:mssql /var/opt/mssql
 
# switching to the mssql user
USER mssql

And here is the .env file for the docker secret (the SA password). In future I will use active directory authentication but this should do for testing.

MSSQL_SA_PASSWORD=Badpassword1#

Directory Structure in the SQL Server container

I have laid out my directory structure as follows, if you deploy the docker container yourself it will make the directories (and the files) for you. You need only the .env , docker-compose.yml and dockerfile. Docker will handle the rest.

C:\Users\Aidan\Documents\mssql-docker>tree /f
...
│   .env
│   docker-compose.yml
│   dockerfile
│
├───backup_data
│       test.bak
|
├───data
│       Entropy.bin
│       master.mdf
│       mastlog.ldf
│       model.mdf
│       modellog.ldf
│       model_msdbdata.mdf
│       model_msdblog.ldf
│       model_replicatedmaster.ldf
│       model_replicatedmaster.mdf
│       msdbdata.mdf
│       msdblog.ldf
│       tempdb.mdf
│       tempdb2.ndf
│       tempdb3.ndf
│       tempdb4.ndf
│       templog.ldf
│       exampledatabase.mdf
│
├───dump
├───logs
│       agent_log.log
|       ...
|
├───log_data
│       exampledatabase_log.ldf
│
└───secrets
        machine-key

C:\Users\Aidan\Documents\mssql-docker>

Once your container database is up you will still need to make the database using SQL Server Management Studio or interact with the database using SQLCMD for your application.

Caveats using this method

• Using containers adds a layer of abstraction which may affect performance, this seems to be most notable on windows where the filesystem doesn’t run in WSL’s filesystem.
• The volumes are managed by docker so using faster disk may be difficult (or easier) depending on usecase.
• You have to pay for an MSSQL licence.
• You should put your backups on a different media than your data, which this currently doesn’t do.
• There is some additional setup with replication that doesn’t seem to be present on a standard windows installation of SQL Server 2022.

Thanks for reading, have fun.