Skip to main content
NewOpenTofu 1.13 Re-Encodes base64gzip and Drops WinRM. We Upgraded the Same State to See What Breaks

Learn DevOps by doing,
not just reading.

742+ articles, guides, and hands-on learning tools for engineers who prefer a terminal over a slide deck.

Join 5,000+ DevOps engineers learning every week

kubectl --watch
$
devops-daily --stats

// featured

Interactive Simulators

Browse all simulators

// categories

Popular Categories

Explore our content by topic

// exercises

Hands-On Exercises

Practice real-world DevOps scenarios with step-by-step guidance

View all exercises

// quizzes

Test Your Knowledge

Short interactive quizzes across Docker, Kubernetes, Terraform, networking, and more

// posts

Latest Posts

Stay up to date with the latest DevOps content

Terraform

OpenTofu 1.13 Re-Encodes base64gzip and Drops WinRM. We Upgraded the Same State to See What Breaks

OpenTofu 1.13 shipped on September 30. We applied configs with 1.12.7 and planned them with 1.13.1 against the same state. Gzipped user data planned an update and a replacement with no config change. A WinRM provisioner passed validate and plan, then failed at apply. The new assume functions turned an Invalid count argument error into a clean plan. Here is what to check before you bump the version.

|14 min read
DevOps

How Shopify Survives Black Friday: The Flash-Sale Playbook

Shopify load tests at 150% of last year's peak, queues buyers at the edge and reserves stock during payment. We rebuilt checkout with k6 and measured it.

|16 min read
Git

A Poisoned .git/config Runs Code on git status. We Tested Which Commands and Copies Carry It

On October 2 GitLab disclosed ConfigPoisoning: a repo that brings its own .git/config makes an AI coding tool run attacker commands when it shows a diff. We ran the same trick against plain git 2.39 and 2.55. A bare git status ran repo-supplied programs, the usual safe diff flags missed the clean filter, git 2.54 config hooks walked past core.hooksPath=/dev/null, a clone was clean but a cached workspace was not, and GitHub-hosted runners switch off the ownership check that would stop it.

|14 min read
FinOps

Knowing What Your AI Feature Costs Before Finance Does

The model invoice has one line per model, and finance wants one line per feature. We ran three features on one key and recorded every usage block: a one-word alert label cost a third to a half of a full incident investigation, because of reasoning tokens nobody reads. Here is how to measure that per request and tag it per feature.

|14 min read
Security

GITHUB_TOKEN Is Now 377 Characters Long. We Tested Which Redaction Rules Still Catch It

GitHub finished moving App installation tokens, including the Actions GITHUB_TOKEN, to a new ghs_<app id>_<JWT> format on October 2. We ran 40 real tokens through the usual redaction regexes and one through gitleaks, trufflehog and detect-secrets. The latest gitleaks release found nothing, and the common patterns either missed the token or hid only its first 40 to 46 characters, which were the same in all 40 tokens.

|12 min read
Git

A Repo per Agent: What Cloudflare Artifacts Changes About Git

Cloudflare Artifacts gives every agent, session or task its own Git repository. We measured how push contention grows when agents share one branch, walked through the Workers API, and priced the pattern so you can decide where it fits.

|11 min read

// guides

Latest Guides

Step-by-step tutorials to boost your DevOps skills

// tools

DevOps Tools and Calculators

Free, browser-only utilities. CIDR, JWT, base64, UUID, cron, K8s sizing, YAML. No sign-up, no server.

// about

DevOps Daily is a free, independent education platform for engineers who want to learn by running things, not by reading pitch decks. Kubernetes, Docker, Terraform, CI/CD, observability, and security, through hands-on simulators, quizzes, exercises, and a weekly newsletter.

Free
$0
forever
Tools
61
interactive
Subscribers
5,000+
engineers
Cadence
Weekly
no spam
devops-daily --subscribe
$ echo "Weekly DevOps digest. No spam. Unsubscribe anytime."
Weekly DevOps digest. No spam. Unsubscribe anytime.
$ subscribe --email
$

5,000+ engineers subscribed