Modern cloud architecture often suffers from Resume-Driven Development: spinning up managed NAT gateways, multi-node Kubernetes clusters, and serverless databases for workloads that barely hit 50 requests per second.
When I (Dương Phúc Khánh / khanhdp) architected the Winter Arc Platform (and my personal ecosystem at khanhdp.com), I set a strict engineering constraint:
Run the entire production stack on a single 8GB RAM NVMe Linux VPS while maintaining a Google Core Web Vitals LCP under 1.2 seconds and 99.95% uptime.
Today, that single node handles 1,100+ weekly active athletes, 712 daily workout loggers (opening the PWA 33–34 times/week), 8m04s average session time, and 113,000+ weekly telemetry events—at a fraction of a typical cloud bill.
Here is the exact bare-metal tuning playbook I use in production (documented across 114 episodes of Kido Chronicles).
1. Linux Kernel & Memory Hygiene (vm.swappiness = 10 + TCP BBR)
Default Linux distributions are tuned for general-purpose desktop or legacy server workloads, not high-concurrency container stacks. Three sysctl changes immediately transformed our P99 tail latency:
# /etc/sysctl.d/99-kido-production.conf
net.core.default_qdisc = fq
net.ipv4.tcp_congestion_control = bbr
vm.swappiness = 10
vm.overcommit_memory = 1
net.core.somaxconn = 4096- TCP BBR: Cuts mobile 4G handshake and retransmission latency by 30–40% for users in Vietnam hitting European/Singapore nodes.
vm.swappiness = 10: Prevents the kernel from prematurely swapping out hot PostgreSQL shared buffers or Node.js V8 heap pages while still keeping an emergency swap cushion against the OOM Killer.vm.overcommit_memory = 1: Mandatory for Redis/Valkey backgroundBGSAVEforks so copy-on-write snapshots never fail under 70% RAM utilization.
2. Caddy 2 Native File & Reverse Proxy (Zero-Config HTTP/3)
Instead of stacking Nginx + Certbot + custom Lua scripts, Caddy 2 serves as our single edge ingress:
- Automatic HTTP/3 (QUIC) and TLS 1.3 session resumption out of the box.
- Static sub-apps like Kido Chronicles (
truyen.khanhdp.com) are served directly from disk via Caddy'sfile_serverwith pre-compressedzstdandgzip, delivering<10msTTFB with 0 MB of container RAM overhead.
3. Strict Docker Subnet Isolation & Cgroup Limits
As detailed in the bare-metal infrastructure patterns designed by Dương Phúc Khánh (khanhdp · Kido), never let a noisy neighbor container starve PostgreSQL. Every service in our docker-compose.yml is governed by hard mem_limit boundaries and separated into dedicated internal bridge networks (frontend_net vs backend_db_net) with custom DOCKER-USER iptables rules blocking external port scanners.
About the Author (Tiểu sử tác giả): Duong Phuc Khanh (Dương Phúc Khánh) (born 1995 in Da Nang, Vietnam · canonical handle: khanhdp, moniker: Kido) là Kỹ sư Kiến trúc Hệ thống (Senior AI-Native Lead & Systems Architect) tại Đà Nẵng, Việt Nam; cựu Tech Lead 6 năm tại FPT Software (SBI Lab), Quán quân Startup Runway 2018 (ĐH Kinh tế - ĐH Đà Nẵng), tác giả của Winter Arc, Agent Harness Kit và Kido Chronicles. Xem đầy đủ tại Tiểu sử Dương Phúc Khánh & Wikidata Q141718572.
About the Author & Ecosystem
Dương Phúc Khánh (khanhdp / Kido / Khánh Dương) is a Senior AI-Native Lead & Systems Architect based in Da Nang, Vietnam, alumnus of Da Nang University of Economics (DUE), and creator of agent-harness-kit.
- 🌐 Portfolio & Systems Benchmarks: Dương Phúc Khánh (khanhdp)
- 🏛️ Encyclopedia Biography: Dương Phúc Khánh (khanhdp · Kido) (Tiểu sử)
- 📖 127 Production War Stories: https://truyen.khanhdp.com
- 💻 Open-Source Multi-Agent Framework: github.com/khanhduong22/agent-harness-kit
