This week, I had to do some work with Linux, so I found myself working with Alpine Linux again. And, of course, one of the worst and most absurd security vulnerabilities in recent times popped up. 😆
Fortunately, none of my setups met the conditions required for exploitation.

That said, I've been running some interesting experiments on a Raspberry Pi 4, the same one that has been running FreeBSD for quite some years, hosting a Time Machine service in a jail and handling backups from other servers.

Long story short, I installed Alpine Linux on the Raspberry Pi and moved FreeBSD into a KVM virtual machine, with the disks passed through directly to it.

The result? The VM runs beautifully with 3 GB of RAM (possibly even 2 GB), and I still have the rest of the Raspberry Pi available to run OpenBSD, NetBSD, and other systems I need for different setups.

It's a sad that bhyve doesn't (yet) support virtualization on that device. Or at least, that was still the case the last time I checked.

#Linux #AlpineLinux #FreeBSD

There's a vulnerability on musl based linuxes for SSH where the password can be easily bypassed by including a long enough password and meeting some other requirements.

If I had my Alpine computer working at the moment, it wouldn't affect me because I don't have SSH turned on.

If you're not able to update yet, be sure to turn off password authentication.

Source: https://www.alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

#musl #linux #alpinelinux #JBTechPost

New patch releases for Alpine Linux:

3.21.10
3.22.8
3.23.8
3.24.4

- A security fix in apk-tools 3.0.9 and 2.14.13 to prevent crashing on certain malformed data.

https://alpinelinux.org/posts/alpine-3.21.10-3.22.8-3.23.8-3.24.4-released/

#AlpineLinux #security

My passord is a single * and i run #AlpineLinux. Am I vulnerable?

Security advisory regarding openssh-server on Alpine Linux:

https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

#AlpineLinux #security

Urgent: Immediately set 'PasswordAuthentication no' in /etc/ssh/sshd_config and restart the sshd service. Make sure you have ssh key authentication or other ways to access your machines.

Also make sure to update openssh to the latest version.

The openssh fix will be backported all the way back to Alpine 3.16

https://openssh.org/releasenotes.html#10.6p2

#security #AlpineLinux

Although I'm the Barista at BSD Cafe and illumos Cafe, I've always enjoyed using some Linux distributions as well.

Just as I did with my article and installation script for Void Linux on ZFS (which I've since updated to use a TUI, although it still needs some polishing before I publish it), I'll be sharing articles and other material about Alpine Linux over the coming weeks.

And something I've been using for quite a long time already will, I believe, be particularly interesting to many of you.

Stay tuned!

#AlpineLinux #ITNotes #Linux

We'd like to let you know that gitlab.alpinelinux.org is back. All passwords, 2FA and tokens were reset, and the SSH host keys have changed. See what you need to do:

https://alpinelinux.org/posts/GitLab-reopened-after-security-incident.html

#AlpineLinux

RE: https://fosstodon.org/@alpinelinux/117520651908520232

The new GitLab instance should be on-line now.

#AlpineLinux

Peter Sanchez boosted

Alpine Linux » 🌐 2026-10-28
@alpinelinux@fosstodon.org

We have published a report on a security incident on gitlab.alpinelinux.org. An attacker tried to exploit CVE-2026-97229. We found no evidence it succeeded but can't rule it out, so we rebuilt
GitLab from scratch.

Alpine packages and releases were not affected, and no signing keys were exposed.

All GitLab passwords have been reset. If you reused yours elsewhere, change it there.

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

#AlpineLinux #security

We have published a report on a security incident on gitlab.alpinelinux.org. An attacker tried to exploit CVE-2026-97229. We found no evidence it succeeded but can't rule it out, so we rebuilt
GitLab from scratch.

Alpine packages and releases were not affected, and no signing keys were exposed.

All GitLab passwords have been reset. If you reused yours elsewhere, change it there.

https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

#AlpineLinux #security

is there a huge back up of pkgs needed to be built in #alpinelinux ?

eg. usb-signaller is 0.4.2 still, but should be 0.4.3. its been 2 days 🫪

https://pkgs.alpinelinux.org/package/edge/community/armv7/usb-signaller

huh 0.4.3 built a little over 24 hours ago and still not published. whats going on?

#alpinelinux

https://build.alpinelinux.org/buildlogs/build-edge-armv7/community/usb-signaller/

oh wow, seems like the builders are stuck for almost every single arch?

https://build.alpinelinux.org

built pkgs arent published and havent been updated since Oct 23

https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/

#alpinelinux

In order to deal with all the increased traffic our gitlab instance has received, we're going to increase resources.

This means gitlab.alpinelinux.org will be unavailable for a bit while the instance is being upgraded.

#AlpineLinux

People are asking when fixes for php are landing in alpine <old>. we have php85, php84 and php83. five maintained branches (edge, v3.24, v3.23, v3.22, v3.21). This is 15 packages that needs to be fixed. test suite regressions needs to be handled. It is not realistic to expect all that work be done for every php security fix for two years for free.

If you care about one branch, help us fix it. We may accept merge requests if CI is green, but don't *expect* anything

#AlpineLinux

not that many cares much at this point, but at least we have a security fix for musl and new releases are on their way...

#AlpineLinux

There is a lot work going on to get the fixes out for https://emudhra.we-have-a-problem.com/ updated packages for ca-certifcates were bumped within a couple of hours and are out.

I am a bit worried for the extra load on our gitlab instance. If you want read git history etc, please use the mirror https://git.alpinelinux.org/aports

If you are not actively working on getting security fixes and stable releases out, please wait a bit if you can.

Thanks!

#AlpineLinux

I know it's still very much a WIP, but I'm excited to eventually try out AlpineBSD

https://sr.ht/~sircmpwn/alpinebsd/

(NetBSD base + Alpine pkgs)

#netBSD #alpinelinux

alpinelinux.org is currently unavailable due to emergency patching of the host (CVE-2026-99999).

It should be back soon.

#AlpineLinux #AlpineOps

The #AlpineLinux 3.25 builders are online

@alpinelinux now has a new "Documentation Team" lead: @whynothugo

https://gitlab.alpinelinux.org/alpine/council/-/work_items/710

#AlpineLinux #FOSS

Were any of the talks from the postmarketOS and Alpine Linux conference 2026 posted anywhere?

#nura #nuraeco #postmarketOS #AlpineLinux

Finally turned attention to getting Immich up and running tonight. I like it, seems snappy enough with tens of thousands of photos imported.

The Immich website has a handy form driven page for generating a docker compose file so it took like 30 seconds to get it running once mutated to follow my way of doing things on my server (persistent storage, naming, cert proxy, etc).

I struggled a bit with using the Immich command line tool to import my photo collection and in the process of trying to figure out why --recursive didn't work, stumbled upon the immich-go project on github. It's also a command line tool and works very well; immediately was able to recursively import photos, etc. Compiles cleanly on Alpine Linux (ofc, it's just golang).

Immich-go has a migrate function that allows you to connect to one Immich server and copy the files to another Immich server (but no 'delete source' as far as I could tell).

I set up a second Immich instance on a different port and started to use the migrate function to finally start moving all the photos of my computer electronics and vehicle technical projects out of the whole household's photo collection. My wife will appreciate that. Ha. Managed to split out 2026-2025, only ~25 more years to go. Ugh.

Anyway, Immich (the server) and Immich-go (the CLI tool) are cool. Recommended.

Fun!

#immich #immichgo #AlpineLinux #cli #photography #photos #HomeLab #SelfHosting #SelfHosted

I guess I hadn't looked at photos since migrating to Alpine Linux lately.

Does anyone have HEIC (i.e. Apple) formatted images working correctly under Alpine?

I've installed libheif, kimageformats and anything remotely libheif related in the repo but Gwenview still doesn't display HEIC images. Neither does Shotwell.

I installed Ristretto to compare and it also doesn't display HEIC images.

GIMP works as does Darktable.

Dolphin displays the thumbnails properly but the preview pane doesn't work.

Ideas? Kinda pulling my hair out and out of options.

#Linux #AlpineLinux #AlpineLinuxEdge #KDE #Plasma #Gwenview #libheif #HEIC #Apple #Ristretto #GIMP

Alpine Linux stable releases are out:

- 3.21.8
- 3.22.6
- 3.23.6
- 3.24.2

https://alpinelinux.org/posts/Alpine-3.21.8-3.22.6-3.23.6-3.24.2-released.html

#AlpineLinux

One slightly weird thing I had is that inbound #ipv6 traffic on both SSH and HTTPS was returning a "connection reset by peer" for a while. It seems to be working now, but if some IPv6 folks can check https://cablespaghetti.dev loads properly over v6 for them now, it would put my mind at rest.

https://cablespaghetti.dev/hosting-a-fediverse-instance-on-an-original-raspberry-pi.html

#snac #snac2 #alpinelinux #linux #raspberrypi

https://cablespaghetti.dev/hosting-a-static-site-on-an-original-raspberry-pi.html

#raspberrypi #alpinelinux #linux

Here's a script to backup to Backblaze B2 with just Jq as an additional dependency (and the included curl, tar, openssl etc.). It works so far...

https://gist.github.com/cablespaghetti/01862b9d8252223719cbe2586145f686