Debian

systemd in one container failed with "Too many open files", and Docker in another with "unable to create session key: disk quota exceeded". Neither was about files or disks: all the containers were spending the same per-user kernel quotas on the host.

A systemd-run rollback brought a remote Debian host back, and systemd killed the dhclient it had started. The DHCP lease ran out exactly a day later.

fail2ban listed the address as banned, and the address still got in. On a Debian host with firewalld, the nft binary was missing, so every ban had failed.

The iptables ACCEPT rule for udp/67 on lxcbr0 kept counting, and dnsmasq never saw a DHCPDISCOVER. With nftables, an accept is not final: firewalld's table hooks in after it and rejected everything from the bridge.

A Debian 13 server had unattended-upgrades enabled, its timers ran every day, and 61 security updates sat uninstalled. The config used Ubuntu's Allowed-Origins lines, which match the suite, and Debian's security suite is stable-security, not trixie-security.