Keep raw PostgreSQL table files out of selective recovery plans
Use a database recovery path instead of replacing raw relation files to recover one PostgreSQL table.
Read the guideDSE security knowledge hubIT
IT
Knowledge
Page 8 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide IT knowledge center
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
DSE post stream
1,297 articlesIT
Preserve PostgreSQL global objects beside database dumps
Give shared roles and tablespaces an explicit recovery step beside per-database archives.
Read the guide
Budget connections before parallel PostgreSQL dumps
Set a connection budget and lock-aware maintenance window before enabling parallel PostgreSQL dumps.
Read the guide
Check capture offloading before diagnosing checksum corruption
Determine where packets were captured before treating invalid outbound checksums as a network fault.
Read the guide
Know which Syncthing changes create file versions
Check where a change originated before expecting Syncthing to retain the file’s previous contents.
Read the guide
Limit GitLab deployment credentials to registry pulls
Use the registry-read scope when a deployment system only needs to download container images.
Read the guide
Distribute Caddy local CA trust to the clients that need it
Treat Caddy’s certificate issuance and client trust distribution as separate parts of an internal HTTPS deployment.
Read the guide
Grant Docker Compose secrets only to services that need them
Review both the secret definition and each consuming service when replacing environment-based credentials in Linux containers.
Read the guide
Separate an OpenSSH SFTP jail root from its upload directory
Check ownership of the whole chroot path before changing upload permissions for an SFTP account.
Read the guide
Keep declared service state writable under ProtectSystem=strict
Identify the service’s real write locations before weakening a systemd filesystem restriction.
Read the guide