DevOps Daily Newsletter - Week 46, 2026

This issue is mostly about the gap between what a setting says and what it does once you measure it, from masking rules that leave the original data elsewhere on the branch to an empty resources block that changes a pod's QoS class. Our view is that reading config in review is not enough, and if you have not run it and checked the result, you are guessing. That counts most for privacy and security controls, where a rule can cover every column you listed and still miss copies of the same data sitting in other tables and payloads.

This week's focus (with Bitrise Build Hub)

15 Minutes to 5: What Happens When You Move iOS CI From M1 to M4

You get a phase-by-phase look at where a real open-source iOS pipeline spends its minutes, so you can tell which parts of your own build a faster Mac will speed up and which it won't. The per-run cost math is the part to take into your next budget conversation, because a pricier runner that finishes much sooner can move the bill either way. With M4 Macs available for GitHub Actions jobs through services like Bitrise Build Hub, read this before you pick a runner.

Blog Posts

Can a Vision Model Read Your Grafana Panel? 100 Panels on DigitalOcean Inference

We drew 100 panels with known answers, and even the best of four models fully read only 65 of them, with log axes tripping up every model.

Neon Anonymized Branches: Mask the Columns, Then Scan the Rest

Masking every PII column on a 20,000-user table still left all 20,000 original emails readable in order copies, JSON payloads, support tickets, and an audit table that the masking run filled itself.

Opsville: A Free Pixel-Art DevOps Town in Your Browser

Walk a pixel-art town in your browser, fix eight DevOps districts with our simulators and quizzes, and read how we built it.

Build an Everyday AI Assistant with DigitalOcean Inference

This walkthrough builds Daylight, an assistant that turns a brain dump into a realistic plan, reworks it when your day changes, and keeps the changes you accept.

cgroup v2 memory.high Throttles, memory.max Kills: Measured on a Host Without Swap

On a Linux 6.8 host with no swap, memory.max killed our workload in under half a second, while memory.high kept it alive and made new allocations wait, sometimes once per page.

Alpine OpenSSH Password Bypass (CVE-2026-123158): Check and Fix

Without PAM, Alpine's sshd could let an attacker into accounts that have no password, so here is how to check one host or all your containers, then upgrade and restart sshd.

OpenTelemetry Collector Custom Builds: 6.5x Smaller, and What Resource Detectors Cost at Startup

A custom build made with ocb came out 6.5x smaller and used under a quarter of the memory, and detectors for clouds the host was not on held startup for the full 5-second timeout.

An Empty resources: {} Makes Kubernetes 1.34 to 1.36 Pods BestEffort

Adding an empty pod-level resources block turns a pod with requests and limits into BestEffort, and we measured what that changes on the node and what it leaves alone.

eMudhra CA Compromise: Two Roots to Remove, and Dropping Comodo AAA Broke 1 of 16,125 Chains

Browsers blocked the compromised intermediates within hours, but images and runtimes read their own trust stores, so we tested 34 stores and real clients against the chains the top 20,000 sites send.

Also new this week:

Try this week

Speed Up the Slow Queries

Intermediate · about 45 min · CI grades your PR

Three queries behind the shop's busiest pages read whole tables. Add the right PostgreSQL indexes, and fix the query an index cannot help, so each one reads a few pages and returns the same rows.

Featured Games

Git Command Quiz

Work through hands-on scenarios on branches, merges, rebases and conflicts to see how well your Git muscle memory holds up.

GitOps Workflow Simulator

Play through interactive scenarios that teach GitOps principles, starting with Git as the source of truth.

Comparisons

Bitrise Build Hub vs GitHub-Hosted Runners

See how a service that runs your GitHub Actions jobs on M4 Macs and AMD Linux machines compares with GitHub's own hosted runners.

Guides

A Practical Guide to FinOps for DevOps Engineers

If the cloud bill keeps landing on your desk, this walks through reading FOCUS billing data, tagging and allocating costs, and setting budgets.

Quizzes

Junior DevOps Engineer Interview Quiz

Prep for an entry-level DevOps interview with questions on Linux fundamentals, Git basics and Docker essentials.

Flashcards

Docker Essentials

Brush up on containers vs images, layers, volumes, networks and build cache, one card at a time.

Worth reading elsewhere

SECURITY Hardening Tetragon’s gRPC API with Tetragon: Tetragon before v1.7 exposes an unauthenticated gRPC admin API that some pods on the same node can reach. (Cilium Blog)
RELEASE OpenTelemetry eBPF Instrumentation reaches v1.0.0: OBI is now stable and adds OpenTelemetry observability to Linux applications that are already running. (OpenTelemetry Blog)
STORY How we halved DNS build delay and cut memory use by 85%: Zone setting changes used to rebuild whole DNS zones, some with tens of millions of records, until Cloudflare built a planner. (Cloudflare Blog)
RELEASE Gitea 28.3.0 is released: The third 28.x maintenance release has a large number of security fixes, so self-hosted Gitea instances should upgrade. (Gitea Blog)
HOWTO Measuring developer experience on an Amazon EKS developer platform: Shows how to collect the four DORA metrics automatically so platform teams can prove their internal platform improves delivery. (AWS Containers Blog)

All 81 links in the weekly digest

Happy learning, The DevOps Daily Team