Pouya Ghourchiani — full-stack & infrastructure engineer. Next.js, NestJS, TypeScript, and Rust. BidiMD & NebulaGrid.https://ghourchiani.ir/blogMon, 02 Nov 2026 00:00:00 GMThttps://ghourchiani.ir/blog/cve-2026-98432-docker-container-namespaceshttps://ghourchiani.ir/blog/cve-2026-98432-docker-container-namespacesI hardened a production Docker host against the Linux TCP flaw CVE-2026-98432. The host was fine. 19 of 20 containers were not — and Docker's own DNS was listening with MPTCP inside every one of them.Mon, 02 Nov 2026 00:00:00 GMThttps://ghourchiani.ir/blog/ai-writes-code-who-owns-the-systemhttps://ghourchiani.ir/blog/ai-writes-code-who-owns-the-systemAI made generating code cheap. Deciding whether it belongs, drawing real boundaries and proving it works is still an engineering job — and someone owns it.Sat, 31 Oct 2026 00:00:00 GMThttps://ghourchiani.ir/blog/hellohttps://ghourchiani.ir/blog/helloWhy this site exists — engineering notes on platforms, Rust tooling, and shipping under constrained networks.Sun, 20 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/why-restricted-network-toolinghttps://ghourchiani.ir/blog/why-restricted-network-toolingWhy Pouya Ghourchiani builds mirrors, installers, and gateways for places where crates.io, npm, and CDN defaults flake.Fri, 18 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/upstream-contribution-diaryhttps://ghourchiani.ir/blog/upstream-contribution-diaryLessons from merged upstream PRs (Biome, Nitro, Watchexec, ripgrep) and from keeping independent projects discoverable — small, evidence-backed changes.Thu, 17 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/mirror-first-dxhttps://ghourchiani.ir/blog/mirror-first-dxDesign CLIs and installers as if registries will flake.Wed, 16 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/axum-gateway-auth-boundarieshttps://ghourchiani.ir/blog/axum-gateway-auth-boundariesWhere identity stops and routing begins in a Rust control-plane edge.Tue, 15 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/openvsx-marketplace-checklisthttps://ghourchiani.ir/blog/openvsx-marketplace-checklistParity checklist from shipping BidiMD to both registries.Mon, 14 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/atomic-static-releaseshttps://ghourchiani.ir/blog/atomic-static-releasesGates, atomic deploy, and rollback for a personal SSG site.Sat, 12 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/indexnow-bilingual-ssghttps://ghourchiani.ir/blog/indexnow-bilingual-ssgKeep EN/FA URLs discoverable without lying to crawlers.Sat, 12 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/nebulagrid-control-planehttps://ghourchiani.ir/blog/nebulagrid-control-planeDesign notes from Pouya Ghourchiani on NebulaGrid — Rust/Axum gateway plus React control UI for constrained ops networks.Sat, 12 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/workers-atomic-static-swaphttps://ghourchiani.ir/blog/workers-atomic-static-swapHow this site ships HTML without a half-deployed middle state.Fri, 11 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/bidimd-rtl-previewhttps://ghourchiani.ir/blog/bidimd-rtl-previewWhy Mohammad Pouya Ghourchiani built BidiMD — bilingual Markdown preview that does not fight Persian/Arabic direction.Thu, 10 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/nda-safe-shipping-noteshttps://ghourchiani.ir/blog/nda-safe-shipping-notesHow to write about production delivery without leaking private systems.Thu, 10 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/publish-vscode-openvsxhttps://ghourchiani.ir/blog/publish-vscode-openvsxChecklist from BidiMD dual publishing. Hands-on notes from shipping softwareThu, 10 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/dnstt-slipnet-noteshttps://ghourchiani.ir/blog/dnstt-slipnet-notesGenerating and decoding configs for constrained connectivity experiments.Wed, 09 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/apt-mirror-clihttps://ghourchiani.ir/blog/apt-mirror-cliCLI workflow for faster mirrors on constrained links.Tue, 08 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/person-jsonld-without-fake-awardshttps://ghourchiani.ir/blog/person-jsonld-without-fake-awardsHow Pouya Ghourchiani models Person schema honestly — alternateName spellings, sameAs, no invented prizes.Tue, 08 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/nestjs-iot-ingestionhttps://ghourchiani.ir/blog/nestjs-iot-ingestionPatterns for queues and time-series ingestion without leaking private systems. Short engineering note from production work — practical, NDA-safe, no flufMon, 07 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/aurum-three-interfaceshttps://ghourchiani.ir/blog/aurum-three-interfacesSharing core logic across CLI, REST, and TUI.Sat, 05 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/cargo-dist-installershttps://ghourchiani.ir/blog/cargo-dist-installersCross-platform installers for CLI tools without a custom packaging maze.Fri, 04 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/biome-forwardref-false-positivehttps://ghourchiani.ir/blog/biome-forwardref-false-positiveWhat broke, what the PR fixed, and how to test lint edge cases.Thu, 03 Sep 2026 00:00:00 GMThttps://ghourchiani.ir/blog/restricted-network-cargohttps://ghourchiani.ir/blog/restricted-network-cargoHow Mohammad Pouya Ghourchiani keeps Rust builds moving when crates.io is unreliable — mirrors, vendor discipline, and installers.Tue, 01 Sep 2026 00:00:00 GMT