Skip to main content
NeweMudhra CA Compromise: Two Roots to Remove, and Dropping Comodo AAA Broke 1 of 16,125 Chains

Learn DevOps by doing,
not just reading.

771+ articles, guides, and hands-on learning tools for engineers who prefer a terminal over a slide deck.

Join 1,500+ DevOps engineers learning every week

kubectl --watch
$
devops-daily --stats

// featured

Interactive Simulators

Browse all simulators

// categories

Popular Categories

Explore our content by topic

// exercises

Hands-On Exercises

Practice real-world DevOps scenarios with step-by-step guidance

View all exercises

// quizzes

Test Your Knowledge

Short interactive quizzes across Docker, Kubernetes, Terraform, networking, and more

// posts

Latest Posts

Stay up to date with the latest DevOps content

Security

Neon Anonymized Branches: Mask the Columns, Then Scan the Rest

We gave a Neon anonymized branch masking rules for every PII column of a 20,000-user table. The masking replaced the values in those columns, and all 20,000 original emails were still readable elsewhere on the branch: in order copies, JSON payloads, support tickets, and an audit table that the masking run itself filled. Here is the scanner we use as a CI gate, and the rules it took to pass it.

|13 min read
Security

eMudhra CA Compromise: Two Roots to Remove, and Dropping Comodo AAA Broke 1 of 16,125 Chains

Browsers blocked the compromised eMudhra TLS intermediates in hours, but images and runtimes read their own trust stores. We tested 34 stores, real curl, Python, Node.js and Go clients, and the chains that the top 20,000 sites send. Debian had to remove two roots because of a Sectigo cross-sign. Removing Comodo AAA broke 1 of 16,125 chains in our OpenSSL test.

|13 min read
Docker

Docker Build Cache on Ephemeral CI Runners: inline, registry and local, Measured

A fresh CI runner starts with no BuildKit cache. We rebuilt a real multi-stage Node service on a new builder every time, with no cache, inline, registry min and max, and a local cache directory, and measured cold builds, a one-line change, a dependency bump, the export cost and the cache size.

|16 min read
CI/CD

How Much Memory Does a CI Build Need? Five Real Builds at 2, 4 and 8 GB

We ran five real open-source builds inside 2, 4 and 8 GB memory limits. Four fit in 2 GB. The cgroup counter overstated most of them, and the one that failed was a Vite build that also runs a full type check. Every script is in the post.

|17 min read
Terraform

Terraform 1.17's -minimal-refresh: 202 API Calls Down to Zero, and the Drift Goes Quiet Too

Terraform 1.17 can skip the refresh for every resource you did not change. We measured it on 202 real DigitalOcean resources: API calls went from 202 to 0 and plan time halved, and then we broke three records behind its back to see what it stops noticing.

|11 min read
DevOps

Base64 Explained: 3 Bytes In, 4 Characters Out, Zero Secrecy

Base64 turns 3 bytes into 4 characters and hides nothing. See it in Kubernetes Secrets and JWTs, measure the 33% overhead, and fix the bugs it causes.

|12 min read

// guides

Latest Guides

Step-by-step tutorials to boost your DevOps skills

// tools

DevOps Tools and Calculators

Free, browser-only utilities. CIDR, JWT, base64, UUID, cron, K8s sizing, YAML. No sign-up, no server.

// about

DevOps Daily is a free, independent education platform for engineers who want to learn by running things, not by reading pitch decks. Kubernetes, Docker, Terraform, CI/CD, observability, and security, through hands-on simulators, quizzes, exercises, and a weekly newsletter.

Free
$0
forever
Tools
62
interactive
Subscribers
1,500+
engineers
Cadence
Weekly
no spam

// sponsors

Supported by

DevOps Daily stays free because these companies sponsor it.

  • Bitrise
  • Atomsized
  • DigitalOcean
  • DevDojo
  • SMTPfast
  • QuizAPI
Become a sponsor
devops-daily --subscribe
$ echo "Weekly DevOps digest. No spam. Unsubscribe anytime."
Weekly DevOps digest. No spam. Unsubscribe anytime.
$ subscribe --email
$

1,500+ engineers subscribed