All Posts
Browse all our DevOps articles, tutorials, and guides.
CKNE Is Live: What the Kubernetes Network Engineer Exam Tests and How to Practice
CKNE is a new hands-on Kubernetes networking exam. Use its published domains to build a lab, rehearse packet-level debugging, and turn DNS, traffic, policy, encryption, and observability into timed terminal drills.
Five Production Bugs You Can Reproduce in a Browser Tab
A cache can leak a cart, one packet can pause an HTTP/2 page, and a shared DataLoader can disclose another user's data. Learn the mechanism, the production check, and a small lab reproduction for five failures worth recognizing before an incident.
We Tested AWS Emulator: It Blocks More Than Its Docs Say, and Less Than AWS Does
AWS Emulator passed all 40 of our workflow checks and caught two IAM mistakes in our own test code. It also let a user with no policies assume an admin role, ignored permissions boundaries and session policies, and with the default JavaScript SDK settings, one SQS request went to real AWS. Here is what we measured on a throwaway droplet.
Disk Full but du Disagrees: Finding Deleted Files That Still Use Space
When df reports a full filesystem but du cannot find the bytes, an unlinked log held open by a process is often the missing space. Find the holder, release space safely, and prevent the next midnight disk-full incident.
Who's On Call for the AI Agent? A Production Runbook
An agent that can call production tools is a service with an incident path, not a clever prompt. Assign an owner, page only for harm in progress, test a kill switch, scope its identity, and keep enough evidence to explain every action.
We Gave an AI Agent a read_only Neon Role. Here Is What It Blocked
A Neon read_only role blocked every INSERT, UPDATE, DELETE and schema change we sent, and the Neon MCP Server with a pinned role stopped every durable write. What still ran comes from standard Postgres defaults, and the real risk was a read that stalled a migration.
We earn commissions when you shop through the links below.
Node.js November 2026 Security Release: How We Tracked and Patched It
Node.js 22.23.5, 24.22.3 and 26.13.1 fix 16 CVEs, seven of them high severity in HTTP/2 and TLS. Here is what was fixed, who should upgrade first, the 15-minute watcher that told us the release was out, and the nvm, pm2 and systemd steps we used to move production in minutes.
EC2 Can Now Tell You Where IMDSv1 Is Still Enabled
AWS added a configuration metric for IMDSv1 on November 5. Here is how to separate migration gaps from active usage and retire tokenless metadata access safely.
Opsville: A Free Pixel-Art DevOps Town in Your Browser
Opsville is a free browser game. Walk a pixel-art town, fix eight DevOps districts with our simulators and quizzes, and see how we built it.
Build an Everyday AI Assistant with DigitalOcean Inference
Build Daylight, a personal assistant that turns a brain dump into a realistic plan, adapts when your day changes, and saves the changes you accept.
cgroup v2 memory.high Throttles, memory.max Kills: Measured on a Host Without Swap
We ran one allocating workload under memory.max, memory.high and both on a Linux 6.8 host with no swap. memory.max killed it in under half a second. memory.high did not kill it: new allocations waited, once per 64-page batch at best and once per page next to a busy neighbour on the same CPU. Here are the numbers, the kernel formula behind them, and what systemd, Docker and Kubernetes write.
Alpine OpenSSH Password Bypass (CVE-2026-123158): Check and Fix
Alpine sshd without PAM could let an attacker into accounts that have no password. Check one host or all your containers, then upgrade and restart sshd.
OpenTelemetry Collector Custom Builds: 6.5x Smaller, and What Resource Detectors Cost at Startup
We built a small Collector with ocb and started it next to the contrib release on a droplet, in two network namespaces and on a Raspberry Pi, 5 times per case. The custom build is 6.5x smaller and holds under a quarter of the memory. Cloud detectors for clouds the host is not on held startup for the full 5 s timeout, even on another cloud, and one detector stopped the Collector from starting at all.
An Empty resources: {} Makes Kubernetes 1.34 to 1.36 Pods BestEffort
An empty pod-level block makes a pod with requests and limits BestEffort on Kubernetes 1.34 to 1.36. We measured what changes on the node, and what does not.
Can a Vision Model Read Your Grafana Panel? 100 Panels on DigitalOcean Inference
We drew 100 Grafana-style panels with known answers and asked NVIDIA Nemotron 3.5 Super VL and three other models on DigitalOcean Serverless Inference to read four facts from each. The best model read 65 of 100 fully right, and log axes broke all of them. Here is what a screenshot costs, where the reads go wrong, and a small bot that checks the model against the alert before it posts.
eMudhra CA Compromise: Two Roots to Remove, and Dropping Comodo AAA Broke 1 of 16,125 Chains
Browsers blocked the compromised eMudhra TLS intermediates in hours, but images and runtimes read their own trust stores. We tested 34 stores, real curl, Python, Node.js and Go clients, and the chains that the top 20,000 sites send. Debian had to remove two roots because of a Sectigo cross-sign. Removing Comodo AAA broke 1 of 16,125 chains in our OpenSSL test.
Neon Anonymized Branches: Mask the Columns, Then Scan the Rest
We gave a Neon anonymized branch masking rules for every PII column of a 20,000-user table. The masking replaced the values in those columns, and all 20,000 original emails were still readable elsewhere on the branch: in order copies, JSON payloads, support tickets, and an audit table that the masking run itself filled. Here is the scanner we use as a CI gate, and the rules it took to pass it.
Docker Build Cache on Ephemeral CI Runners: inline, registry and local, Measured
A fresh CI runner starts with no BuildKit cache. We rebuilt a real multi-stage Node service on a new builder every time, with no cache, inline, registry min and max, and a local cache directory, and measured cold builds, a one-line change, a dependency bump, the export cost and the cache size.
How Much Memory Does a CI Build Need? Five Real Builds at 2, 4 and 8 GB
We ran five real open-source builds inside 2, 4 and 8 GB memory limits. Four fit in 2 GB. The cgroup counter overstated most of them, and the one that failed was a Vite build that also runs a full type check. Every script is in the post.
Terraform 1.17's -minimal-refresh: 202 API Calls Down to Zero, and the Drift Goes Quiet Too
Terraform 1.17 can skip the refresh for every resource you did not change. We measured it on 202 real DigitalOcean resources: API calls went from 202 to 0 and plan time halved, and then we broke three records behind its back to see what it stops noticing.
Base64 Explained: 3 Bytes In, 4 Characters Out, Zero Secrecy
Base64 turns 3 bytes into 4 characters and hides nothing. See it in Kubernetes Secrets and JWTs, measure the 33% overhead, and fix the bugs it causes.
GitLab.com's 60-Requests-an-Hour Limit Is Live, and the Headers Won't Warn You
We sent anonymous requests to GitLab.com until the new per-IP limit blocked us. It depended on which project we asked for, the successful responses never mentioned it, and Retry-After was wrong in both directions. Here is what we measured and how to find the anonymous calls in your CI before GitLab does.
15 Minutes to 5: What Happens When You Move iOS CI From M1 to M4
The Wikipedia iOS app's build and 503 unit tests took a median 15.4 minutes on GitHub's M1 runner and 5.6 minutes on an M4. We split the time by phase, priced each run, and checked whether a bigger Mac is worth it.
Moving Authorization Out of Your App Code: If-Statements vs Cerbos vs SpiceDB, Measured
We built one permission model as if-statements, as Cerbos policies and as a SpiceDB relationship graph, grew it through roles, teams, sharing and a late contractor rule, and checked 84 hand-written decisions at every step. Here is what each design cost in latency, in list queries and in lines of code.
LiteLLM 1.107.0 Was Built From a Lookalike Fork: What PyPI Provenance Can and Cannot Tell You
The poisoned LiteLLM release came out of the real release pipeline, fed from a fork one hyphen away. We measured what a PyPI attestation would have shown, what the Docker image provenance showed, and how many of the 1,000 most downloaded PyPI projects publish attestations at all: 39%.
Why Your GitHub Actions Bill Keeps Growing, and What Each Fix Saves
Per-job rounding, macOS minutes at ten times the Linux price, re-runs and storage add up quietly. We measured where one repository's minutes went in 30 days, then ran a mobile pull request pipeline 34 times on GitHub-hosted runners and on Bitrise Build Hub to see what faster machines change in time and money.
Node.js October 2026 Security Release: Finding Every Node You Actually Run
Node.js 22.23.4, 24.22.1 and 26.12.1 fix a Brotli decoder bug that the project says permits remote code execution, plus TLS and DNS bugs. The version bump is one line. pm2 entries, the pm2 daemon, systemd units, cron jobs and containers each keep their own Node, so here is how to find every one and prove it moved.
PHP2Shell: How to Check That Every PHP You Run Is Actually Patched
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical remote code execution bugs. Installing the update is the easy part. A patched Ubuntu PHP still says 8.3.6, running workers keep the old code, and 4.4 hours after the release 8 of 39 popular images still shipped a vulnerable PHP. Here is how to find the PHP you run and prove it is fixed.
A Service Catalog Nobody Updates Can Be Worse Than None: We Checked 217 Entries Against GitHub
We checked 217 public Backstage catalog entries from 30 organizations against GitHub. One in ten had a record GitHub contradicts, three owners in four could not be checked from outside, and where the catalog and CODEOWNERS both named an owner, they agreed only half the time. Here is the checker, the method, and how to keep a catalog honest.
What Keeps a Neon Compute Awake, and What It Costs
We watched Neon computes through the API to see which clients stop scale to zero. Idle connections do not. An open transaction, a monitoring agent and a health check every 5 minutes do, and that health check keeps the smallest compute running 180 CU-hours a month.
Prompt Caching on DigitalOcean Inference, Measured: What Breaks It and How Long It Lasts
We sent 867 requests with a long on-call runbook as the system prompt to three DigitalOcean-hosted models. With the runbook first and unchanged, the cache cut the input bill about 5 times on Llama 4 Maverick and more than 12 times on DeepSeek V4.1 Flash. One timestamp on the first line turned it off on all three. Here is what else turns it off, how long a cached prefix lasted, and what prompt_cache_key does.
Neon Realtime, Measured: Live SQL Queries Replace the LISTEN/NOTIFY Layer We Built by Hand
Neon Realtime turns a SQL query into a live subscription. We rebuilt our hand-made LISTEN/NOTIFY layer on it as a live order board and measured it on a real Neon project: 48,600 writes at up to 100 per second, which queries are re-sent in full on every write, what a reconnect delivers, scale to zero, and 14 attempts to tamper with a sealed query.
SOC 2 Evidence From GitHub and Terraform, and the Part That Still Needs a Person
We pointed a small evidence collector at a repository whose main branch had a strict ruleset. The ruleset passed and three change-management controls failed. Here is which SOC 2 evidence you can pull from GitHub and Terraform, which still needs a person, and ten ways an evidence script can pass a control without evidence.
Postgres 19 Slipped to November: Every Pulled Feature and Why
PostgreSQL 19 now ships on 19 November, and 13 items left its release notes after beta 1. Here is each pulled feature with the reason from its revert, what to use instead, a script that finds beta-era code that depends on them, and why "AI found too many bugs" is only part of the story.
Let's Encrypt Goes to 64-Day Certificates: When Does Your ACME Client Actually Renew?
Let's Encrypt moves to 64-day certificates on 10 February 2027, and its staging environment already issues them. We issued real 64-day staging certificates with certbot, acme.sh and lego and recorded when each one renews. The ARI clients renewed or scheduled their renewal around day 42. acme.sh 3.0.7 with --days 80 scheduled its renewal for day 79, 15 days after the certificate expired, and upgrading to 3.1.6 fixed that at the next check.
Page, Ticket or Ignore: Is the Cheap Model Good Enough for Alert Triage?
We gave six models on DigitalOcean Serverless Inference one written on-call policy and 200 alerts, three times each. A model at $0.16 per 1,000 alerts made every call the same way as one at $1.64. The real differences were latency, missed pages and a bug in our own test data that the models caught.
DORA Metrics From Git History: The Definition Picks Your Tier
We computed deployment frequency, lead time, change failure rate and recovery time from one year of Kubernetes, uv, Go and Prometheus history, once per common definition. The definition alone moved every project across two or three DORA performance levels, and the merge button decides whether Git still knows when the work started.
Datadog Alternatives in 2026: 12 Tools, Their Real Prices, and What 300 GB of Logs Costs on Each
We read the pricing page of Datadog and 12 alternatives on the same day and priced one workload on each: 300 GB of logs a month. Datadog with standard indexing of every event is $780 to $1,155 a month; the alternatives we could price run from about $19 to $180. Here is each tool, who it suits, and the catch on its pricing page.
DevOps Interviews Now Test How You Decide. How to Practice Situational Questions
Fewer interviewers ask what a Kubernetes Service is. More of them describe a broken system and ask what you do first. Here is what they grade, five worked scenarios with weak and strong answers, and a way to practice making the call.
How YouTube, Slack and GitHub Shard MySQL: We Built the Vitess Pattern on Five Servers and Measured What It Costs
YouTube built Vitess, and Slack and GitHub use it for their largest MySQL workloads. We built the same primitives over five real MySQL servers and measured them: a scatter read took 4 shard queries and got a quarter of the throughput, every simulated half-finished cross-shard transfer lost money, an online split lost no rows, and a hot channel stayed hot at 128 shards.
Ubuntu 26.10 Moves cp, mv and rm to Rust. We Ran 162 Shell Commands Through GNU and uutils to See What Changes
Ubuntu 26.10 ships on October 15 with Rust coreutils for every tool. On the same system, 150 of our 162 shell test cases gave byte-identical results with GNU and uutils. The other 12 come down to four changes that can break a script (GNU detection, cut -c, timeout -s KILL, base64 -d) and five error messages.
DigitalOcean Agent Droplets: When the $50 Plan Pays Off
Agent Droplets is a prepaid discount on DigitalOcean Managed Agents, not a server. We priced our real agent runs from a real invoice to find where the $50 and $200 plans start to save money, and found a rounding rule that made our runs cost more than the token math.
OpenSSH 10.6 Refuses DOMAIN\user and Weakens ssh -C. We Measured Both
OpenSSH 10.6 came out on October 6. It refuses usernames with a backslash or a dollar sign before it connects, which breaks ssh, scp, rsync, git and Ansible logins written as CORP\alice. It also cuts ssh -C to Huffman coding only, so a 32 MiB log now compresses to 21 MiB instead of 3.7 MiB. We built 10.5 and 10.6 side by side and tested 13 ways of passing a username, 4 kinds of data and 8 SSH clients.
Python 3.15 Made UTF-8 the Default. We Ran 13 Cases in Seven Linux Locales to See What Changes
Python 3.15 turns on UTF-8 mode everywhere. With container locale settings, none of our 13 encoding cases changed. On a UTF-8 server, only stdin and stdout changed. On a legacy-locale host, almost everything did, and the PYTHONUTF8=0 opt-out dropped LC_ALL=C processes to ASCII.
Docker Desktop Switched New Containers to the local Log Driver. We Measured What That Changes
Docker Desktop 4.94 made local the default log driver for new Linux containers, while Docker Engine on your servers still uses json-file with no rotation. We wrote the same 500,000 lines through both. local kept every line in 24 MB where json-file used 84 MB. A file-tailing collector read none of them.
Queue or Log? Kafka, RabbitMQ and NATS All Do Both Now
Kafka has queues, RabbitMQ has streams, and NATS JetStream does both, so the broker is no longer the choice. We ran replay, a poison message, extra consumers and a retry through six setups. Two settings decided every result. We also found that RabbitMQ 4.3 quietly stops dead-lettering poison messages for consumers that nack.
OpenTofu 1.13 Re-Encodes base64gzip and Drops WinRM. We Upgraded the Same State to See What Breaks
OpenTofu 1.13 shipped on September 30. We applied configs with 1.12.7 and planned them with 1.13.1 against the same state. Gzipped user data planned an update and a replacement with no config change. A WinRM provisioner passed validate and plan, then failed at apply. The new assume functions turned an Invalid count argument error into a clean plan. Here is what to check before you bump the version.
How Shopify Survives Black Friday: The Flash-Sale Playbook
Shopify load tests at 150% of last year's peak, queues buyers at the edge and reserves stock during payment. We rebuilt checkout with k6 and measured it.
A Poisoned .git/config Runs Code on git status. We Tested Which Commands and Copies Carry It
On October 2 GitLab disclosed ConfigPoisoning: a repo that brings its own .git/config makes an AI coding tool run attacker commands when it shows a diff. We ran the same trick against plain git 2.39 and 2.55. A bare git status ran repo-supplied programs, the usual safe diff flags missed the clean filter, git 2.54 config hooks walked past core.hooksPath=/dev/null, a clone was clean but a cached workspace was not, and GitHub-hosted runners switch off the ownership check that would stop it.
Knowing What Your AI Feature Costs Before Finance Does
The model invoice has one line per model, and finance wants one line per feature. We ran three features on one key and recorded every usage block: a one-word alert label cost a third to a half of a full incident investigation, because of reasoning tokens nobody reads. Here is how to measure that per request and tag it per feature.
GITHUB_TOKEN Is Now 377 Characters Long. We Tested Which Redaction Rules Still Catch It
GitHub finished moving App installation tokens, including the Actions GITHUB_TOKEN, to a new ghs_<app id>_<JWT> format on October 2. We ran 40 real tokens through the usual redaction regexes and one through gitleaks, trufflehog and detect-secrets. The latest gitleaks release found nothing, and the common patterns either missed the token or hid only its first 40 to 46 characters, which were the same in all 40 tokens.
A Repo per Agent: What Cloudflare Artifacts Changes About Git
Cloudflare Artifacts gives every agent, session or task its own Git repository. We measured how push contention grows when agents share one branch, walked through the Workers API, and priced the pattern so you can decide where it fits.
We Took Down Our Mesh VPN Control Plane. Here Is What Kept Working
Replacing the VPN with a WireGuard mesh moves the single point of failure from the VPN gateway to the coordination server. We stopped the control server under real Tailscale clients for 30 minutes and measured what survived: existing tunnels did, joins and revocations did not, an expiring key cut a device off on time, and a client restart took a device offline until we turned on netmap caching.
CVE-2026-80521: The Ubuntu Container Escape Is Not Just an Ubuntu Problem
A public exploit breaks out of default Docker and Kubernetes containers through a bug in the AF_UNIX garbage collector, and Ubuntu 24.04 and 26.04 still have no kernel fix. The same code sits in the 6.1 and 6.6 LTS kernels, where upstream has no fix either. Here is how to check any node in one command, and what to do while you wait for a patch.
GitHub Actions Removed Node 20. Find Every node20 Action You Still Run
Since September 23, GitHub Actions runs every node20 action on Node 24, and the opt-out is gone. An action that still works only adds a warning, so they are easy to miss until one breaks. Here is how to list every action your workflows use, read its runs.using value, and catch the ones hidden behind SHA pins and composite actions.
GitHub Is Removing ssh-rsa Signatures: Find What Breaks Before the November 4 Brownout
GitHub removes the ssh-rsa signature type and diffie-hellman-group-exchange-sha256 on January 13, 2027, with brownouts on November 4 and December 9. Learn which clients and keys are at risk, which debug lines to read, and how to rotate keys before the first brownout.
GitHub Started Enforcing Self-Hosted Runner Versions. We Tested What Happens
GitHub started enforcing self-hosted runner versions on September 29. We tried four runner versions against a free github.com organization and asked GitHub's own API about every release. One was refused, one connected and then exited while its job waited in the queue, and the API scheduled every version's end about nine weeks after its successor.
Free Egress Has Fine Print: S3 vs R2, B2, Wasabi and More
Serving 50 TB a month costs $4,379 on S3 at list price and $62 on R2. But the cheapest number in our comparison is outside the free-egress policy of the provider that offers it. Nine storage offerings, four workloads, and the fine print that changes the answer, with a calculator you can run yourself.
containerd 1.7 Reaches End of Life: What Breaks on 2.x
We ran containerd 1.7.36, 2.3.6 and 2.4.1 against the same data and an old node config. The config still loaded and the mirrors still worked. What broke was pulling schema 1 images, and it stays hidden until a node has to pull one.
Issue to Pull Request with DigitalOcean Managed Agents
We gave an OpenCode agent on DigitalOcean Managed Agents three real GitHub issues and no GitHub token. It produced three merged pull requests and one wrong one that passed its tests. Here is the setup, the recorded runs, the cost per issue, and every gotcha we hit.
Where to Run AI Agents: 8 Managed Agent Runtimes Compared
DigitalOcean Managed Agents, Cloudflare, AWS AgentCore, Google, Microsoft Foundry, E2B, Vercel and Modal, compared on isolation, state, tool access, limits and price, with one cost scenario worked out on every platform.
Six System Design Problems, and the New Problem Each Fix Creates
Caching, read replicas, sharding, queues, WebSockets, retries, circuit breakers and CQRS each solve a real problem and hand you a new one. A practical map of the six problems every growing system meets, the usual fixes, and what each fix costs you.
Terraform Module Outputs, Inputs and Sources: How Modules Pass Data to Each Other
How to get a value out of a Terraform module, pass a resource into another module, chain modules with for_each, pin a Git branch or tag as a module source, share providers and variables across modules, and fix the "Provider configuration not present" error that shows up when you refactor. The terminal examples were run on Terraform 1.15.
Terraform State: Remove, Move and Migrate Resources, and Set Up a Remote Backend
The state questions every Terraform team hits: how to stop managing a resource without deleting it, rename one without a rebuild, move it to another project, bootstrap a remote backend, and why the DynamoDB lock table is on its way out. Every command here was run on Terraform 1.15.
The No-Backend Backend: Neon Data API, RLS and 27 Attacks
A team task board with no server code: static React, Neon Auth, and the Neon Data API with row-level security as the only guard. A signed-in attacker tried 27 ways in. What held, the four mistakes we tried, and the 15-minute gap.
Deploy a Complete AI Incident Backend on One Neon Branch
Build and verify a disposable incident-search backend with Neon Auth, Object Storage, Functions, AI Gateway, and Lakebase Postgres—then remove the complete environment with one guarded command.
CI Passed 6 of 6 Migrations. A Neon Branch of Production Passed 1
How to test Postgres migrations before production: branch production on Neon in seconds, run each migration while an app keeps reading and writing, and gate on errors, failed queries, lock stalls and lost rows. The six migrations that passed on our fixture database failed five times on the branch.
Your Semantic Cache Answers the Question Next Door
We put a semantic cache in front of an ops assistant on DigitalOcean Serverless Inference and replayed 288 hand-labelled questions through six embedding models. At the threshold that cut the bill by about 30 percent, about one hit in three was the answer to a different question. Someone asking how to undo a pushed commit got the instructions for an unpushed one.
Cloudflare Freed 100 TB of RAM From Its Hash Rings. Your Proxy May Have the Opposite Problem
Cloudflare got back 100 TB of RAM partly by cutting 90% of the points on its consistent hash rings. We measured the other end of the same curve: a million keys through nginx and HAProxy to 100 backends, and Envoy rebuilt from its source. The busiest server ranged from 1.05x to 2x its fair share, and the points per server explained most of it.
We Hid 96 Instructions in the Logs an Ops Agent Reads. Here Is What Stopped Them.
An on-call agent reads logs and tickets that other people write. We planted 96 prompt injections in that text and measured six defences on DigitalOcean Serverless Inference. One paragraph in the system prompt cut the attack rate from 35 percent to 4. Delimiters on their own did nothing we could measure. A check outside the model stopped every forbidden action, and still missed the secrets the agent wrote into its own reports.
The Junior Ops Pipeline Did Not Collapse. It Never Existed.
Junior developer hiring is reportedly down 60 to 70 percent since 2022. We counted fifteen years of job postings to see what happened to entry level operations roles, and found something stranger: there were never any to lose.
We Put Localhost on the Internet and Watched Who Turned Up
A Cloudflare quick tunnel gives you a public URL for a port on your laptop in one command and no account. We ran one in front of a server that logs everything and answers nothing, to find out how long it takes the internet to find you, and what the thing actually costs.
Full-Text vs pgvector vs Hybrid Search, Measured
We put keyword search, pgvector and hybrid retrieval over the same 3,814 passages with 200 hand-written queries and pooled relevance judgments. The overall winner turned out to be the least useful number in the whole benchmark.
We Measured the 200x Claim, and Got It Wrong Twice First
Last week we told you to measure a vendor claim on your own workload instead of repeating it. Then we got access, did exactly that, and produced two confident numbers that were both artefacts of our own bad method. Here is the real result, and the two mistakes, which are more useful than the result.
Your Tenant Isolation Is One Forgotten WHERE Clause Away
Most multi-tenant apps enforce isolation in application code, which means every query is a chance to leak. Postgres row-level security moves the boundary into the database. Here is a working schema, the things that quietly break it, and why the role in your Neon connection string reads every tenant no matter what your policies say.
Your Logs Cost More Than the Service That Emits Them
Log ingestion is priced per gigabyte and indexing is priced per event, which means a service emitting small lines pays far more than its byte count suggests. Here is the arithmetic on a real server, why the usual advice to "log less" misses, and the five levers that actually move the bill.
Jev and the Classification Problem Hiding in Your LLM Bill
Routing, tagging, triage and extraction are classification wearing a chat interface. A new model class is arguing that point loudly, with numbers worth reading carefully. Here is how to tell whether the argument applies to your pipeline, and how to read a 200x claim before you repeat it.
Git Bisect for Your Data
You know the number is wrong today. Nobody knows when it started. git bisect answers that question for code by checking out old commits; the same search works on a database if you can read it as it was at an arbitrary moment. Here is a CLI that does it, measured against a real Postgres, and the one limit that decides whether it can help you at all.
Where Your Code Runs When There Is No Region
The edge compatibility tax people still warn about has mostly been paid off. What is left is stranger and more interesting: you can keep your Node imports, but you cannot keep your process. Two measured demos of what that actually costs.
Linux, Git, Docker: Why That Order Matters
Every DevOps roadmap lists the same tools. Almost none of them explain why the order is not arbitrary, or why learning Docker first makes containers feel like magic. Three steps, each one runnable in a terminal, each one making the next one obvious.
Serverless Killed Your Connection Pool
A connection pool only works because a process outlives the request. Take the process away and it has nothing to amortise across. Measured against a real Postgres: what a connection costs cold and warm, why the pooler barely touches latency, and the benchmark that makes pooling look pointless.
The Producer Changed the Schema and Nobody Told the Consumer
A schema registry stops the obvious breakages and sleeps through the expensive ones. Two changes to the same event, demonstrated live: one the registry rejects before it is published, one it cannot see at all because the schema never changed.
Your Trace Dies the Moment the Pipeline Shells Out
OpenTelemetry has a Release Candidate spec for passing trace context through environment variables, which is how you connect a CI run to the build tool it spawns. Two runnable demos: one showing four orphaned traces becoming one, and one showing why BAGGAGE across a trust boundary is the part worth arguing about.
Figma Made Multiplayer Instant by Picking the Dumber Algorithm
Figma rejected Operational Transforms, and they are not running a real CRDT either. They built something simpler on purpose, and the reason it works is a constraint most teams already have. Here is the model, the trade it makes, and two runnable demos of where it breaks.
systemd and NetworkManager Are Trapping AI Agents
Both projects now plant instructions in their repos designed to make an unreviewed AI contribution give itself away. I ran a real agent against each to see what fires, what does not, and what walks straight past.
Gate Your Terraform Plans: Rules Decide, the Model Explains
A pull request says "3 to add, 1 to change, 1 to destroy" and everyone approves it. This is a GitHub Action that reads the plan JSON, fails the job on selected changes that risk data loss or public exposure, and uses DigitalOcean inference only to write the comment. Measured against twenty labelled plans, including the four it misses.
How Netflix Ships a Third of the Internet: The CDN They Had to Build
At its 2015 peak Netflix was 37% of North American downstream traffic, and almost none of it came from a commercial CDN. Open Connect is a cache hierarchy built on one asymmetry: Netflix knows tonight what people will watch tomorrow. Here is how the appliances, the nightly fill, the BGP steering and the 800 Gb/s FreeBSD boxes fit together, a runnable comparison of push fill against pull-through caching, and what it teaches anyone running a cache.
In-App, Email and Push From One Event
An order ships. The user wants a badge in the app, a digest email later, no push at all, and their own webhook endpoint pinged. The design that handles that without duplicates: an outbox keyed by event, user and channel, preferences evaluated at send time, digest windows, and provider feedback wired back in. With a runnable model and a build-or-buy verdict.
Meta Says Every Muse User Gets Their Own VM
Meta says its new consumer agent runs on a dedicated cloud VM per person, with a second agent that has to approve anything leaving that machine and a credential store the agent can use but never read. Those are three infrastructure decisions you face too. Here is what each one defends against, what it costs to build, and a runnable model of the broker, including the injected page that tries to walk out with a token.
How Stripe Avoids Double-Charging Anyone
A payment request times out. Did the charge happen? Stripe answers that question with idempotency keys, and the design behind them is more than a cache of responses: locked key rows, recovery points, and a rule about which calls can be retried. Here is the design, a working Postgres implementation, the run where our own version double-created rides, and the constraint that caught it.
Who Owns the State File, and Other Questions That Decide Your Week
Most Terraform pain is not HCL. It is state: who is allowed to write it, how it is split, how you find out it no longer matches reality, and how a plan gets reviewed before it applies. Four decisions, a real drift run, and the tooling that exists for each.
Go Is Not Just for CLIs. It Runs the Cloud Native Control Plane
Docker, Kubernetes, etcd, Terraform, Vault, Prometheus, CoreDNS, Caddy, MinIO, CockroachDB: we pulled the real language breakdown of 20 infrastructure projects from GitHub, explain why Go keeps winning the control plane, list where it does not, and build a static cross-compiled HTTP server to show the reason in under 6 MB.
Stop Building Webhook Retries Yourself
We pointed a webhook sender at a receiver built to fail the common ways production fails: outages, 429s, timeouts, dead endpoints, bad signatures. Then we watched the retries, the schedule, the signature checks, and the replay happen without writing any of it. Here is the run, with the code and the attempt logs.
DNS Detective: an Agent That Diagnoses Your Domain by Actually Probing It
We built an agent on DigitalOcean's Serverless Inference that debugs DNS, TLS and email problems the way an engineer does: form a hypothesis, run a real lookup, follow the evidence. It solved a null-MX mystery, an expired certificate, and a broken DNSSEC chain on camera, and one model we tried got disqualified for inventing probe results.
Omarchy 4 Makes the Linux Desktop Feel Like a Product, Finally
DHH's Arch-based distro shipped its biggest release in August: a full desktop shell rewrite, sub-minute installs, dual boot, and coding agents treated as system citizens. With an $8M foundation behind it and hardware vendors paying attention, Omarchy is the most serious run at the developer workstation in years.
Getting a Row Change Out of Postgres Without Dual-Writing
Your service writes to Postgres and publishes to Kafka, and one day those two disagree. The fix is to make the database the only writer and read changes from its log: the outbox pattern, logical decoding, and the replication-slot failure mode that quietly fills your primary's disk, demonstrated live with real numbers.
How Discord Stores Trillions of Messages With a Tiny Team
Discord went from 12 database nodes to 177 to 72, while message volume went from billions to trillions. The interesting part is not the migration to ScyllaDB; it is what they built in front of the database, and what their three worst problems teach anyone running a hot datastore at any scale.
Email APIs With Hosted MCP Servers: Who Actually Ships One
Every email provider now claims AI-agent support, but there is a real dividing line: a hosted MCP server your agent connects to with a URL, versus a package you have to run yourself. As of August 2026 the hosted club is small. Here is the roster, what each server exposes, and how to wire one into Claude in two minutes.
Kubernetes 1.37 Really Can Flag Unused PVCs, but the Viral YAML Is Wrong
A post making the rounds says Kubernetes 1.37 adds an unusedSince field to PVC status. The feature is real and it is genuinely good news for storage bills; the YAML being shared shows an API that does not exist. Here is what KEP-5541 actually shipped, the correct fields, and a working query for "PVCs unused for 30 days".
WAL as the Source of Truth: What Lakebase Storage on S3 Means for You
Neon published a deep dive on the storage engine behind Lakebase Postgres: the write-ahead log is the database, S3 holds the history, and Postgres itself runs stateless on top. This is the reader-level version, with a hands-on session where we watch LSNs move, delete a table, and branch back to the moment before the mistake in under a second.
Kubernetes 1.37 Garhwal: What Shipped and What Slipped
Kubernetes 1.37 landed on August 26 with 67 enhancements: 16 stable, 23 beta, 27 alpha. We checked the release against the June feature-freeze plan, KEP by KEP. Pod Certificates made stable, pod-level resources slipped to 1.38, the GPU-slicing feature everyone watched did not graduate, and the ipvs removal clock is now running.
WebSockets Are the Easy Part
Opening a WebSocket takes twenty lines. Reconnection, resume-from-cursor, presence, fan-out and backpressure are the actual product, and they are why realtime systems fail in month two instead of day one. Here is each problem, what it looks like in production, and an honest build-vs-buy section.
Kubernetes Beyond the Basics: 7 Concepts That Take You From Junior to Mid-Level
You can write a Deployment and debug a CrashLoopBackOff. The gap between junior and mid-level is a different set of ideas: how requests really drive scheduling, why Services do not load-balance the way you think, what actually happens during a rolling deploy, and why Kubernetes is a reconciliation engine, not a command runner.
Terraform Variables, Loops, and Outputs: The Complete Guide
Everything about moving values through Terraform in one place: declaring vs assigning variables, tfvars and TF_VAR_ precedence, locals, maps and lists, for_each and its pitfalls, splat outputs for counted resources, sensitive values, and the classic "variables may not be used here" error.
The Postmortem Nobody Reads, and the One They Do
Most incident write-ups are compliance artifacts: written once, filed, and never opened again. The difference between those and the postmortems engineers actually forward to each other comes down to a handful of choices about audience, structure, and follow-through.
Why Your Kafka Bill Is Mostly Network
Run the numbers on a self-managed Kafka cluster and the biggest line item is not brokers or disks, it is cross-AZ data transfer. Here is the arithmetic, where every gigabyte crosses a zone boundary, and the four levers that actually shrink the bill.
GitHub's 2.9B Monthly Commits: Anatomy of an Outage
GitHub's August 17 outage began with a missed sidecar limit and escalated through retry storms. Learn which reliability controls your platform needs next.
Someone Ran migrate:fresh on Production
We wiped a 30,000-row Laravel production database on purpose, then recovered every row in under a second with a Neon point-in-time restore. Here is the full timed experiment, the recovery playbook, and the guardrails that stop it happening to you.
Agentic AI Vocabulary for DevOps: 12 Terms You Already Operate Under Another Name
Every agentic AI glossary is written for executives. Read the same twelve terms as an infrastructure engineer and most of them describe control loops, sandboxes and admission policies you have run for a decade. The useful exercise is finding the three where that analogy breaks, because those are the ones that will page you.
The Anatomy of Kubernetes Persistent Storage: PV, PVC and the Parts That Bite
A PersistentVolumeClaim is a request and a PersistentVolume is the thing you get. That part takes five minutes to learn. The lifecycle rules underneath, which decide whether deleting a claim also deletes your data, are where teams lose production volumes.
The 9 Types of API Testing, and Where Each Belongs in Your Pipeline
Telling load testing from stress testing is easy. What shapes delivery is which of the nine run on every pull request, and which only run after a deploy.
Build and Evaluate an AI Error Explainer with DigitalOcean Inference
Build a FastAPI error explainer, enforce structured model output, and evaluate models and routers against reviewed errors before choosing one.
Fix Your DevOps Career in One Day
Not a five-year plan. Eight things you can finish between breakfast and dinner, ordered by how much they change what happens to you next month, with the evidence for why each one is on the list.
6 Apache Kafka Use Cases, and When You Do Not Need Kafka
Six patterns where Kafka genuinely earns its operational cost, what each one looks like in practice, and the failure mode nobody mentions until you are already running it in production.
Streaming LLM Responses in Next.js: 1.3s to First Token, Not 15.7s
The same model, the same prompt, and the same DigitalOcean endpoint. One version shows the first words in 1.3 seconds, the other shows a blank screen for nearly 16. The difference is entirely in your route handler.
Why Your Base Image Has 1,684 CVEs
I inventoried 17 base images straight from the registry and counted every advisory against the exact package versions inside. The totals are larger than you expect, one package produces most of them, and the runtime you actually run is not in the count at all.
HTTP QUERY Shipped. Your Cache Did Not Get the Memo
RFC 10008 gave HTTP its first new method since 2010: QUERY, a request that is safe and idempotent like GET but carries a body like POST. The semantics are the easy part. The hard part is that its cache key includes the request body, which is not something your CDN or browser does by default yet, and the RFC quietly ships a workaround for exactly that.
We Built an On-Call Agent in Mastra: Where It Won and Where It Would Not
Most agent tutorials stop at the happy path. We built a real on-call agent on Mastra, then killed the process with SIGKILL at the exact moment it rolled back a deploy. It recovered the run. It also rolled the deploy back a second time. Here is what durable execution actually guarantees, and the code that makes it safe.
Auth for a Postgres App, Without a Separate Service
The usual way to add auth is to run a second system next to your database and spend forever keeping the two in sync. Neon Auth puts the auth server in the same project as Postgres: one line in a config file, one deploy, and the user who signs in is a row you can join to your own tables. Here is how it works and why the reconciliation tax disappears.
Realtime Chat With Auth: Next.js, Neon Auth, and WebSockets
A WebSocket cannot carry an Authorization header, so how do you know who is on the other end? This build-log wires a realtime chat where every socket is authenticated with a Neon Auth JWT, verified before the connection is accepted, and fanned out across isolates with Postgres LISTEN/NOTIFY. Real code, the security gotcha that matters, and the test output that proves it.
Top 5 AI Agent Frameworks in 2026
Five frameworks worth shipping production agents on, ranked against stated criteria, with the GitHub and npm numbers behind the ranking and an honest note on where each one loses.
You Cannot Rotate a Secret You Cannot Find
Trace one credential from a laptop to production and count the copies it leaves behind. That count is your rotation cost and your blast radius, and it is why most teams never rotate anything.
From DNS to Delivery: Building Transactional Email with SMTPFast
Connect a domain, send a FastAPI receipt through SMTPFast, trace delivery beyond the 200 response, and verify signed webhooks end to end.
Adding SAML and SCIM Before It Costs You a Deal
What actually changes in your application when an enterprise buyer asks for SSO and directory sync, in the order you should build it, including the validation steps that turn SAML into an authentication bypass if you skip them.
Terraform Strings and Conditionals: The Complete Guide
Building strings, checking substrings, ternaries, optional attributes and conditional resources, in one place.
What Does One Merge Actually Cost You in CI?
Wall-clock time and machine minutes are different numbers, and most teams track only one. Here is how to get both from your own repo.
I Tested AI Resume Screening. The Model Was the Fair Part
Eight models scored the same DevOps resume. They ignored tool names and buzzwords, but six docked the engineer for a career break.
A Postgres Branch Per Learner: Building on Neon
Every hands-on lab gets its own Postgres branch, AI generation runs outside the request cycle, and cleanup is core infrastructure rather than a chore.
Running a Background Job That Must Not Be Lost
A queue gets your job to a worker, not to the finish line. What happens when the worker dies halfway, and a durable executor in 90 lines of TypeScript.
Build and Deploy a Ticket Triage App with DigitalOcean Inference
Build a practical FastAPI ticket triage app with DigitalOcean Serverless Inference, then deploy it to App Platform with Terraform.
Stacked Pull Requests on GitHub: What They Actually Fix
GitHub shipped stacked pull requests to public preview. What stacking solves, how the gh-stack workflow works, and when a stack is the wrong shape.
What It Actually Takes to Deliver a Webhook in Production
Sending a webhook is one HTTP POST. Delivering one is a retry schedule, a signature scheme, an idempotency story, and a way to answer "did you get it?" six hours later. Here is the whole problem, and a working Node implementation of both sides.
Explaining CI Failures Automatically with a GitHub Action
We built a GitHub Action that reads a failing job log and tells you what broke, using DigitalOcean serverless inference. The interesting part was not the model call. It was throwing away 92% of the log before sending it.
The DevOps Skills That Create Openings, Not Just Pass Filters
Most skill lists tell you what gets you past a screening. They do not tell you what makes a company decide to hire someone in the first place. Those are different lists, and the second one is shorter, more specific, and worth a lot more.
What Sending a Developer Newsletter Actually Takes
A newsletter looks like a for-loop over an address list. It is not. Here is the infrastructure behind the DevOps Daily newsletter: sending domain and DNS, bounce and complaint handling, one-click unsubscribe, idempotent scheduling, and the Message-ID that makes any of it debuggable.
11 Laws That Quietly Run Your Engineering Team
Parkinson, Goodhart, Brooks, Chesterton. Eleven old "laws" that were not written about software but explain your incidents, your estimates, and your org chart better than most engineering blog posts.
DMARCbis Is Here: What Changed in the New DMARC and What to Do to Your Records
DMARC finally became a real internet standard in 2026. The pct tag is gone, there are two new tags, and the Public Suffix List is out. Here is what actually changed and the exact edits to make to your DNS.
Send an Email by Hand: The Raw SMTP Conversation (and Why You Should Not Do It in Production)
You can open a socket to a mail server and type an email one command at a time. Doing it once teaches you what every email API hides. Here is the full SMTP conversation, byte by byte, and the exact reasons production sending needs more than a telnet session.
DevOps Engineer, What's Next? Five Career Paths for the Next Five Years
The generic "DevOps Engineer" title is splitting into specialized tracks. Here are five honest career paths for the next five years, what each one really involves, who thrives in it, and the first concrete step to take.
One git push to RCE: the anatomy of CVE-2026-3854 and the parsing bug behind it
A single git push could execute code on GitHub's backend, with cross-tenant reach on github.com itself. The root cause is a bug you almost certainly have somewhere too: untrusted input smuggled through a delimited internal header.
Stop Compiling Postgres Extensions in Your Dockerfile: How pglayers Works
Adding pgvector or PostGIS to a Postgres image usually means apt-get, build tools, and a fat, slow image. pglayers ships each extension as a scratch Docker layer you COPY in. Here is how it works and when to use it.
Build the Container Boundary You Do Not Have: Seccomp Profiles with the Security Profiles Operator
A container is not a security boundary out of the box, but you can build one. Here is a hands-on guide to recording, tuning, and enforcing seccomp profiles with the Security Profiles Operator, which just shipped v1.0.
Swapping Across 25 Models With One Line
Choosing a model is usually a commitment: an SDK, a key, an integration. Through the gateway it is a string, so you can shop the whole catalog per task. And the catalog spans a 100x price range, which turns model choice into your biggest cost lever. Here is the swap, the price spread, and a real multi-model run.
The pwn request just got harder: what actions/checkout v7 changes, and what it does not
GitHub is backporting a fork-checkout block to actions/checkout, with enforcement on July 20, 2026. Here is what a pwn request actually is, what the change stops, and the three ways your pipeline is still exposed after you upgrade.
Build a Terraform Provider for Your API with the Plugin Framework
If your product has a REST API, a Terraform provider lets people manage it as code. Here is how to build one with the modern Terraform Plugin Framework, using a real email API as the example, from client to registry.
Per-Branch AI Endpoints: Isolating Model Spend Across Prod, Preview, and CI
When previews, CI, and production all call models with the same key, you cannot tell what a preview cost or notice a runaway test until the invoice. Because a Neon branch is its own deployment with a usage ledger that lives in the branch's Postgres, model spend is attributed and isolated per environment. I proved it: a CI branch spent tokens while production stayed flat.
Your GitOps Controller Is Tier Zero: the Argo CD repo-server RCE
An unauthenticated RCE in Argo CD's repo-server turns one compromised pod into full cluster takeover. Reported 18 months ago, still unpatched. Here is how it works and the one control that stops it.
Your Container Is Not a Security Boundary: GhostLock (CVE-2026-43499)
A 15-year-old Linux kernel bug just got a public exploit that breaks out of containers and hands any local user root on the host. GhostLock is a reminder that the container is not your security boundary, the shared kernel is. Here is what actually shrinks the blast radius.
How Docker Really Works, From docker run to the Kernel
You type docker run and a container appears. Follow the CLI, dockerd, containerd and runc down to the kernel, with the commands to watch each step. Then get clear answers on image vs container, docker run vs start, containers vs VMs, the performance cost, and when Compose is enough.
Model Fallback and Routing Without a Provider SDK Each
Models have outages, rate limits, and bad minutes. A resilient app falls back to another one, but building that across providers normally means a different SDK and error shape for each. Through one OpenAI-compatible gateway, fallback is a loop over model names. Here it is, tested against a real failure.
One Key for Claude, GPT, and Gemini: the Gateway Pattern
Using three model providers usually means three API keys, three SDKs, and three billing relationships sprayed across your code. An AI gateway collapses that to one credential and one OpenAI-compatible endpoint. I proved it on a Neon Function: the same call answered by GPT, Claude, and Gemini.
Migrating From S3 to Branch-Aware Storage
Neon object storage is S3-compatible, so moving to it is mostly a config change, not a rewrite. Your upload code, your presigned URLs, and your download paths all stay the same. Here is exactly what carries over, the small diff that changes, and a copy script to move the objects, with the honest list of what does not come along.
Stop Standing Up an S3 Bucket Per Preview Environment
Giving every preview environment isolated file storage usually means provisioning a real bucket per environment: policies, IAM, lifecycle rules, credentials, and a teardown job that leaves orphans anyway. When the bucket rides the database branch, that whole apparatus disappears. Here is the difference, tested.
Stop Prompting, Start Looping: Agentic Loops Explained
The best engineers stopped hand-writing prompts and started writing loops. Here is what an agentic loop actually is, the plan-build-judge pattern behind it, why the judge has to be a separate agent, and how to try it in an interactive simulator.
The Docker AuthZ Bypass Is Back: CVE-2026-34040
CVE-2026-34040 lets a crafted API request slip past Docker authorization plugins, and it is an incomplete fix of the 2024 maximum-severity bug. Here is how the bypass works, who is exposed, and how to close it.
PostgreSQL 18.2 Broke Standbys: The 18.x Upgrade Footguns
PostgreSQL 18.2 shipped regressions bad enough to force an out-of-cycle 18.3: halted standbys, substring crashes, and a pg_trgm segfault. Here is what went wrong and the quieter Postgres 18 upgrade traps to check before you patch.
Presigned-URL Uploads From a Serverless Function
Streaming user uploads through your API means the bytes cross your server twice, and serverless functions have request-size limits that make it worse. Presigned URLs let the browser upload straight to object storage while your function just hands out permission. Here it is on a Neon Function, tested end to end.
Object Storage That Branches With Your Database
Database branching gives you a throwaway copy of your rows. But your app also stores files in object storage, and those normally stay in one shared bucket. On Neon a branch forks the bucket too, so each branch gets its own copy of the files. I built a small files API to prove it.
Stop Paginating With OFFSET: Keyset Pagination and the Deep-Page Cliff
LIMIT/OFFSET is the reflexive way to paginate, and it is fine on page one. But OFFSET makes the database generate and throw away every row before the page you want, so cost grows with page depth until deep pages fall off a cliff. Keyset pagination makes every page the same speed regardless of depth. Here is why OFFSET is slow, the fix, and the one tradeoff.
Firebase Alternatives in 2026: Choose by Why You Are Leaving, Not by a Ranking
Most "Firebase alternatives" lists rank tools you cannot compare, because Firebase is five products in a trench coat. The useful question is which part you are replacing and why you are leaving: the Firestore bill that scales with reads, or the data model you cannot port. Here is an honest map of Supabase, Appwrite, Convex, PocketBase, Nhost, Amplify and the rest, grouped by the reason you are actually switching.
When the SSH Server Attacks the Client: libssh2 CVE-2026-55200
You spent years hardening sshd. This bug does not care. CVE-2026-55200 is a pre-auth heap overflow in libssh2 where a malicious SSH server takes over the client that connects to it, no credentials needed. And libssh2 is a client library hiding in curl, git tooling, and backup jobs all over your pipeline. Here is the bug, who is actually exposed, and how to find it in your stack.
The Everything-on-Your-Branch Architecture
For a decade "branch the database" has meant a copy of the schema and rows. But your app is also files, backend code, and model config. Neon now forks all of it on one branch: Postgres, object storage, functions, and the AI gateway, together and isolated. I branched a full-stack project to prove it.
A Postgres-Backed MCP Server in ~20 Lines
Most of what an MCP server does is run database queries on behalf of an AI agent. So I put one right next to the database. Here is a Postgres-backed MCP server built on Neon Functions, deployed onto a database branch, with the code, a live client test, and the repo.
Preview Environments That Include the Backend, Not Just the Frontend
Every PR gets a frontend preview URL. The backend is almost always one shared staging database, so previews quietly lie to you. On Neon a branch is the database, its data, and the functions together, so each PR can get a real isolated backend. Here is the workflow, tested end to end.
Realtime Without a WebSocket Service
Live counters, presence, notifications: the reflex is to add a websocket service to run and pay for. But if your data already lives in Postgres, it has a pub/sub built in. Here is realtime fan-out with Postgres LISTEN/NOTIFY and SSE on a Neon Function, tested with two live subscribers.
hostNetwork Is Still a Footgun: What CVE-2026-32193 Teaches Every Cluster
A recent AKS advisory let an untrusted pod with hostNetwork break out to the worker node. The Azure-specific bug is patched, but the footgun that made it reachable lives on every Kubernetes cluster. Here is how the escape class works and what to actually lock down.
Stop Using Random UUIDs as Primary Keys: uuidv7() Lands in PostgreSQL 18
Random UUIDv4 primary keys quietly wreck insert speed and bloat indexes on large tables. PostgreSQL 18 ships a native time-ordered uuidv7() that keeps the upsides of UUIDs without the B-tree penalty. Here are the numbers and how to adopt it.
Compute That Lives on Your Database Branch
Neon Functions run your code in the same region as your Postgres, on a per-branch URL. To see why that matters I deployed a small API and timed a query from inside the function versus from a machine across the Atlantic: 1.2 ms against 135 ms. Here is how it works, with the real numbers and the repo.
Streaming an AI Agent Without a Function Timeout
Long agent loops and long token streams run into the same wall: a serverless function that hits its execution cap and cuts the connection. Neon Functions hold long-lived streaming connections by default. I deployed two endpoints to prove it: one streamed for 90 seconds, the other streamed an agent token by token starting at 466 ms.
Splunk Shipped an Unauthenticated Database Sidecar: CVE-2026-20253
You did not install a PostgreSQL server, but Splunk Enterprise 10 did, and in affected versions its sidecar endpoint had no authentication. The result is a pre-auth, CVSS 9.8 path to writing files on the host as the Splunk user, now on CISA's actively-exploited list. The bug is patched; the broader lesson is about every helper service your tools quietly bundle.
I Gave an AI Agent a Database, Compute, Storage, and Models From One CLI
An AI agent usually needs four accounts: a database, somewhere to run, object storage, and a model provider. I wired all four from a single Neon credential and had a deployed image-generating agent in a few minutes. Here is the actual build log, the config that ties it together, and the honest caveats.
Neon Is Becoming a Backend Platform, Not Just Postgres
In June 2026 Neon added serverless functions, S3-compatible object storage, and an AI gateway to its database. The interesting part is not any one feature, it is the through-line: everything branches with your data. Here is what shipped, what it competes with, and where the seams still show.
Your Automation Platform Is a Credential Honeypot: Ansible CVE-2026-11807
A missing authorization check in Event-Driven Ansible lets any logged-in user pull plaintext vault passwords, SSH keys, and OAuth tokens out of Ansible Automation Platform. It is a CVSS 9.6, it is patched, and it is a reminder of what your automation control plane really holds.
SpaceX Just Bought Cursor for $60B. What That Means If Your Team Lives in It
SpaceX is acquiring Anysphere, the maker of Cursor, in a $60 billion all-stock deal, the largest acquisition of a venture-backed startup ever. The number is the headline. The real question for engineering teams is what it means to build your daily workflow on a tool whose owner just changed.
The gRPC-Go Auth Bypass Hiding in Your Dependency Tree: CVE-2026-33186
A missing leading slash lets requests slip past gRPC-Go authorization rules. It is a CVSS 9.1, it is fixed in 1.79.3, and because gRPC-Go is a transitive dependency in a huge slice of cloud-native Go, you may be shipping it without knowing. Here is how to find out.
Kubernetes 1.37 Just Locked Its Feature Set: What Made the Cut
The enhancements freeze for Kubernetes 1.37 landed on June 17, so the shape of the August release is now decided. GPU partitioning keeps maturing for AI workloads, and a cgroup v1 change will stop some kubelets from starting. Here is what is locked in and what to check before you upgrade.
Your First Serverless LLM Call on DigitalOcean in 10 Minutes
DigitalOcean's Inference Engine gives you an OpenAI-compatible endpoint with pay-per-token pricing and no GPU to manage. Here is the fastest path from zero to a working call, with curl, Python, and Node, every snippet run against the live API.
Secrets Management Best Practices with HashiCorp Vault
Run HashiCorp Vault the way production needs it: auto-unseal, AppRole auth for machines, dynamic database credentials that expire on their own, and encryption as a service. Real config, real terminal output.
AI SRE Agents: What They Actually Fix, and What They Will Happily Break
AI SRE is now its own category, with every incident vendor shipping an agent that investigates and remediates on its own. Here is the honest split: where these agents genuinely earn their keep, where they are oversold, and the one risk nobody puts on the marketing page.
Hetzner Doubled Its Prices Again. The AI Memory Crunch Is Why
On June 15, 2026, Hetzner raised prices on new orders by roughly 99% in Germany and 158% in the US, the latest in a string of 2026 increases. It is not greed and it is not just Hetzner: the AI memory supercycle has reached the infrastructure bill of teams that never touch AI.
How to Design a Multi-Region Active-Active Architecture on AWS
A practical walkthrough of building active-active multi-region apps on AWS: traffic routing with Route 53 and Global Accelerator, data replication with DynamoDB Global Tables and Aurora, and the application changes that make failover actually work.
The US Government Pulled Two Frontier Models Overnight. The Real Lesson Is About Your Stack
On June 12, 2026, an export-control directive forced Anthropic to disable Claude Fable 5 and Mythos 5 for every user worldwide, three days after launch. The policy fight is interesting. The operational lesson for anyone building on a single model provider is more urgent.
npm v12 Will Stop Running Install Scripts. We Audited Our Repos to See What Actually Breaks
Starting with npm v12 (estimated July 2026), dependency install scripts will not run unless you allowlist them. We ran the new audit tooling on our own production repos: 65 packages flagged, 4 that matter, and a surprising amount of nothing breaking.
OpenTofu 1.12: destroy = false Retires the tofu state rm Ritual
OpenTofu 1.12 lets a resource declare that it should be forgotten instead of destroyed, makes prevent_destroy dynamic, and quietly ends the manual providers lock step. Here is what each change does, plus the footguns the release notes will not warn you about.
Neon vs Supabase in Production: We Benchmarked the Operations That Page You at 3am
Two benchmark sessions against Neon and Supabase Pro measured what spec sheets never show: compute resizes cost 39 seconds of real downtime on one platform and zero on the other, read replicas differ by 23x, and branch creation has a tail you should know about.
Neon vs Supabase Pricing: What the Same App Costs From Launch to Scale
We priced one application through five growth stages on both platforms using verified June 2026 list prices. The result is three distinct cost regimes, two crossover points, and a surprise: at scale the biggest line item is not the database.
Neon vs Supabase Free Tiers: We Benchmarked Both So You Don't Have To
We ran 320 timed operations against the Neon and Supabase free tiers from a same-region client: query latency, project creation, cold starts, and branching. The latency race is a tie, and the real differences are nothing like the marketing.
node-postgres Silently Ignores Your TLS Config When the URL Says sslmode
If your connection string contains sslmode=require, the pg library throws away the ssl options object where you loaded your CA certificate, and verification fails with "self-signed certificate in certificate chain". Here is the trap, the fix, and the v9 changes coming.
Designing Rate Limiting for APIs: Algorithms, Patterns, and Implementation
A practical comparison of token bucket, leaky bucket, fixed window, and sliding window rate limiting, with copy-paste Redis and FastAPI code, nginx config, and guidance on which one to actually use.
Shai-Hulud Reaches PyPI: The Hades Wave That Runs Before You Import It
The Shai-Hulud worm jumped to PyPI on June 7. The Hades wave hides in 19 Python packages, runs at interpreter startup through a .pth hook before you import anything, and steals your CI/CD secrets.
Is Valkey Ready to Replace Redis in 2026?
Valkey forked from Redis after the 2024 license change and has matured fast. Here is whether it is production-ready, how the migration works, and whether the AGPL question even applies to you.
OpenTofu in 2026: Should You Switch from Terraform (and What It Actually Costs You)
OpenTofu has matured into a real Terraform alternative in 2026. Here is what the fork gives you, why the migration is easier than you think, and where the actual lock-in hides.
Zero-Downtime Database Migrations for PostgreSQL in Production
A single ALTER TABLE can take down a busy PostgreSQL database for minutes. This post shows why that happens and how to ship schema changes safely with lock timeouts, the expand-and-contract pattern, and copy-paste SQL recipes for indexes, columns, constraints, and type changes.
Hetzner's Third Price Increase in Three Months: What DevOps Teams Should Do
Hetzner is changing dedicated server and cloud pricing again on June 15, 2026. Here is what changed, why customers are frustrated, and how to decide whether to stay, resize, or move workloads.
How NetEase Games Cut LLM Cold Starts From 42 Minutes to 30 Seconds Using Fluid
NetEase Games published a Kubernetes case study walking through how they took their serverless GPU inference cold-start time from 42 minutes down to under 30 seconds. The bottleneck isn't the GPU. It's the 60GB model weights crossing a region. Here is what they did with the CNCF Fluid project and how to apply the same pattern even if you are not on Kubernetes.
OpenTelemetry Just Graduated: What to Retire from Your Stack This Quarter
On May 21, 2026, CNCF graduated OpenTelemetry. All three core signals (traces, metrics, logs) are now production-ready, the project is the second-most-active in CNCF after Kubernetes itself, and Anthropic, Bloomberg, Capital One, eBay, and Heroku run it at scale. Here is the decision framework for what proprietary agents you can stop running, what is still risky, and the 90-day adoption checklist.
How to Build an Effective On-Call Rotation and Escalation Policy
Your phone buzzed at 3:14 AM for a disk warning that auto-resolved by 3:16. Nobody fixes the alert. The next person on rotation hates their life. Here is how to build on-call schedules, escalation policies, and alert rules that respect your engineers.
When the Malicious Hook Is in the Other Manifest: 700+ Repos, 8 Packagist Packages, One package.json Trick
On May 22, 2026, Socket disclosed a Composer supply chain attack that hid an npm-style postinstall command inside package.json on PHP projects. composer.json was clean, the PHP review missed it, and 700+ GitHub repos pulled it in. Here is the exact payload, why ecosystem-boundary blindness keeps catching teams, and how to wire your CI to look at both manifests.
node-ipc DNS-Tunneling Supply Chain Attack: Your Egress Firewall Probably Missed This
On May 14, 2026, three malicious versions of the node-ipc npm package shipped a payload that hunts AWS, SSH, kubeconfig, and GitHub CLI credentials, then smuggles them out through DNS TXT queries. Most orgs filter HTTPS egress. Almost nobody filters DNS. Here is what the payload does and how to close the gap.
AI Is Reshaping DevOps. The Engineers Are Faster Than the Vendors.
GitHub, Datadog, HashiCorp and friends are moving carefully. The engineers running their stacks are wiring AI into kubectl and pull-request review on a Tuesday afternoon. Here is what is actually changing in 2026, what is not, and where the gap between vendors and the engineers using their tools is widest.
AntV npm Compromise: The Shai-Hulud Worm Comes for Your Dashboards (May 19, 2026)
A new Shai-Hulud wave landed at 01:56 UTC on May 19 and rode the @antv maintainer account through 323 packages including echarts-for-react. Here is what got published, what it steals, and the lockfile grep that tells you if you are exposed.
Cilium 1.19 ClusterMesh Policy Flip: The Silent Default That Will Drop Your Cross-Cluster Traffic
Cilium 1.19 changed how network policies without a cluster selector resolve in a ClusterMesh. East/West traffic that 1.18 implicitly allowed is now silently dropped. Here is how to find every affected policy before you upgrade.
Karpenter Spot Storm Fallback Gap: The Production Loop Nobody Talks About
When AWS spot capacity dries up in a region, Karpenter does not automatically fall back to on-demand. It retries the same dying offerings on a 3-minute loop. Here is why, and how to design around it.
Running Your First Chaos Engineering Experiment with Litmus
A hands-on walkthrough of installing LitmusChaos on Kubernetes, killing pods on purpose, and watching whether your app actually recovers. Real YAML, real output, no theory.
When One Data Center Room Got Hot: AWS US-EAST-1, Coinbase, and the DR Drill That Was Not
On May 7, 2026, cooling failed in a single hall of one US-EAST-1 data center. Coinbase, FanDuel, and CME Group went down for hours, and Coinbase publicly confirmed their backup systems did not work as expected. Here is what happened, the multi-AZ checklist that would have caught it, and the AWS Fault Injection Simulator commands to run the drill before the next thermal event.
Argo CD CVE-2026-42880: When Read-Only Means Read-Everything-Including-Secrets
A critical Argo CD bug (CVSS 9.6, disclosed May 7) lets any authenticated user pull plaintext Kubernetes Secrets out of any Application that has ServerSideDiff with mutation-webhook diffs enabled. Here is the upgrade matrix, the one-liner to find at-risk apps in your cluster, and the safe RBAC scope-down for teams that cannot patch today.
Ingress-NGINX Is Retired: A Real Migration to Gateway API With ingress2gateway 1.0
In March 2026 the Kubernetes project retired ingress-nginx with no replacement waiting in the wings. Roughly half of all clusters still run it. This post is the migration that does not involve a flag day: how to inventory your annotations, what ingress2gateway 1.0 translates and what it silently drops, the side-by-side cutover pattern with the actual PromQL, and how to pick between Envoy Gateway, kgateway, Cilium Gateway, and Istio.
NGINX Rift (CVE-2026-42945): The 18-Year-Old Rewrite Bug That Hands an Attacker Your Worker Process
An autonomous code-audit tool found an 18-year-old heap overflow in NGINX's rewrite module. Affects every release from 0.6.27 through 1.30.0, plus NGINX Plus and the entire F5 product line. Full RCE PoC is public. Here is the one-line config grep that tells you whether you are exposed, the patch matrix, and what to do about the long tail of products that bundle the vulnerable nginx without a vendor patch yet.
TanStack npm Worm: The Supply-Chain Attack With a Dead-Man's Switch
On May 11, 2026, attackers republished 14+ official TanStack packages on npm with a worm that signs itself with valid SLSA provenance and arms a dead-man's switch that wipes your home directory the moment you revoke the stolen GitHub token. Here is what happened, how the payload works, and how to check your machine.
Distributed Tracing with OpenTelemetry: From Instrumentation to Visualization
A walkthrough of instrumenting a real service with OpenTelemetry, running the Collector, and finding the slow span in Jaeger when a request hops across five microservices.
Dirty Frag (CVE-2026-43284 + CVE-2026-43500): Local Root on Every Major Linux Distro
A two-bug chain in the Linux kernel networking subsystems lets any unprivileged local user become root in a single command. The PoC is public, the embargo broke, and not all distros have a patch yet.
Next.js 16.2.6 and 15.5.18 Ship 13 Security Fixes: Patch Now
Vercel released back-to-back security updates for Next.js covering 7 high, 4 moderate, and 2 low severity advisories, including an upstream React denial-of-service issue. Here is what is broken, who is exposed, and the rollout path.
Mini Shai-Hulud: PyTorch Lightning Just Stole Your CI Secrets
On April 30 a supply chain worm pushed malicious versions of PyTorch Lightning (10M+ downloads/month), intercom-client, and intercom-php to PyPI, npm, and Packagist in 48 hours. It steals every credential in your CI and propagates through your own GitHub tokens. Here is what to check and what to rotate.
10 GitHub Repositories That Will Actually Teach You DevOps in 2026
Most "top DevOps repos" lists are recycled awesome-list links. This one is a curated set of repositories that will move the needle on your DevOps skills, with star counts, who each one is for, and how to actually use it.
CVE-2026-3854: A Single git push Owned GitHub
A semicolon in a git push option let any authenticated user run code on GitHub.com's backend and on 88% of self-hosted GitHub Enterprise installs. Here is how the bug worked and what to do.
Istio Traffic Management: Routing, Retries, and Circuit Breaking
Configure weighted routing, automatic retries, and circuit breakers in Istio with copy-paste YAML examples and real kubectl output you can verify on your own cluster.
CVE-2026-31431 Copy Fail: A 4-Byte Kernel Write That Escapes Containers
A new Linux kernel bug lets any unprivileged process flip 4 bytes in the page cache and break out of a container. runtime-default seccomp does not block it. Here is what to do.
Kubernetes 1.36 Ships User Namespaces GA and Pod-Level In-Place Resize
Kubernetes 1.36 "Haru" landed on April 22, 2026. Two changes matter most for production: user namespaces graduated to stable, and pod-level CPU and memory can now be resized in place without restarting. Here is what each one does, the kubelet and runtime requirements, and how to enable them safely.
GitOps with Argo CD: Structuring Your Repository for Multi-Environment Deployments
A practical guide to laying out your Git repository for Argo CD across dev, staging, and production. See real folder structures, Kustomize and Helm patterns, and the pitfalls that bite teams in production.
How to Set Up Cloud Cost Allocation Tags Across AWS, GCP, and Azure
A working playbook for tagging resources across AWS, GCP, and Azure so finance can finally answer which team spent what, and engineers can prove their workload is not the expensive one.
The MCP Design Flaw That Exposes 150M Downloads to RCE
Researchers at OX Security disclosed an architectural vulnerability in Anthropic MCP that enables remote code execution across Python, TypeScript, Java, and Rust SDKs. Anthropic calls it "by design." Here is how the flaw works, which tools are affected, and what to do if you use Cursor, Claude Code, LangChain, or anything with an MCP server.
The Vercel April 2026 Security Incident: What Happened and What to Do About It
Vercel disclosed a security incident that started with a compromised OAuth app at Context.ai, escalated through a Vercel employee Google Workspace account, and reached internal systems plus customer environment variables not marked sensitive. Here is the attack chain, what was exposed, and what to change in your deployments.
How Does It Work So Fast? The Engineering Behind Instant UI Responses
Credit card validation, username checks, autocomplete, URL shorteners - they all feel instant. Here is what is actually happening under the hood in each case.
Two Composer Command Injection Flaws Let Attackers Run Arbitrary Code - Even Without Perforce
CVE-2026-40176 and CVE-2026-40261 affect all Composer 2.x versions. A malicious composer.json or crafted package metadata can execute OS commands on your machine. Upgrade to 2.9.6 now.
SLOs, SLIs, and Error Budgets: A Practical Implementation Guide
Your service went down at 2 AM and nobody could agree on whether it was "bad enough" to page someone. SLOs, SLIs, and error budgets fix that. Here is how to define, measure, and act on them with real Prometheus queries and alerting rules.
Best Claude Code Plugins for DevOps Engineers in 2026
A curated guide to Claude Code plugins built for DevOps workflows - from Terraform validation and Kubernetes troubleshooting to security scanning and CI/CD pipeline optimization.
Claude Code: Agents, Commands, Skills, and Plugins Explained
A clear breakdown of the four extension types in Claude Code - what each one does, how they differ, and when to use which. No marketing fluff, just practical explanations with examples.
CLI vs MCP: When to Use Each for AI-Powered DevOps
CLI tools and MCP servers both let AI agents interact with your infrastructure, but they solve different problems. Here is when to reach for each one and why the answer is usually both.
The Ory Ecosystem Explained: Identity, OAuth2, and SSO for Kubernetes
A practical breakdown of the Ory ecosystem - Kratos, Hydra, Polis, Oathkeeper, and Keto - what each one does, how they connect, and how to pick the right components for your auth stack.
Building an Internal Developer Platform from Scratch
A step-by-step guide to designing and building an internal developer platform that gives your teams self-service infrastructure, faster deployments, and fewer tickets to the platform team.
Coolify: Self-Hosted PaaS on DigitalOcean - Deploy Apps Without Vendor Lock-In
Set up Coolify on a DigitalOcean droplet and get your own Vercel-like platform for deploying Next.js apps, databases, and more - with auto SSL, GitHub auto-deploy, and no per-seat pricing.
CVE-2025-55182 React2Shell: 766 Next.js Hosts Breached in 24 Hours
A CVSS 10.0 RCE in React Server Components let attackers breach 766 Next.js hosts in a single day, stealing database credentials, SSH keys, and cloud secrets. Here is how it works, who is affected, and what to do right now.
Claude Code Source Leaked via npm Source Maps: Lessons for Every DevOps Team
Anthropic accidentally shipped source maps in their npm package, exposing 512,000 lines of Claude Code source. Here is what went wrong and how to prevent it in your own CI/CD pipeline.
The Axios Supply Chain Attack: What DevOps Teams Need to Know
A compromised npm maintainer account led to malicious axios versions deploying a RAT across macOS, Windows, and Linux. Here is what happened, how to check if you are affected, and how to prevent this in your pipeline.
Claude Code Hidden Features You Probably Missed
From mobile sessions to automated PR reviews, here are the Claude Code features that most engineers overlook but can seriously level up your workflow.
5 DevOps Books Worth Reading in 2026
A curated list of DevOps books that are actually worth your time in 2026, from beginner Linux guides to production Kubernetes patterns and the SRE bible.
How to Implement Progressive Delivery with Feature Flags
Learn how to implement progressive delivery using feature flags, canary releases, and gradual rollouts to ship changes safely in production without risking your entire user base.
Migrating from Heroku to DigitalOcean
A complete guide to migrating production applications from Heroku to DigitalOcean. Covers App Platform, Managed Databases, Redis, Spaces, Coolify self-hosted, and infrastructure-as-code setup with real-world migration strategies.
Why Most FinOps Initiatives Fail (and What Actually Works)
Your FinOps team is probably a reporting bottleneck, not a cost optimization engine. The fix: stop centralizing cost visibility and start decentralizing cost accountability to the teams that own the services.
The 3 Infrastructure Decisions That Determine Your Engineering Velocity
Provisioning model, environment strategy, and deployment surface. Everything else is optimization. Here's how to make these foundational choices without killing your team's momentum.
Your Cloud Bill Is an Organizational Problem, Not a Technical One
Why your AWS bill keeps growing despite cost optimization efforts. The real driver is team structure, not instance size. A framework for tying cloud spend to service ownership and engineering accountability.
When Kubernetes Is the Wrong Default
Most teams adopt Kubernetes too early. Here's a pragmatic framework for deciding between managed platforms, VMs, and Kubernetes based on your team size and workload characteristics.
Build vs Buy in 2026: What Still Makes Sense to Build In-House?
A practical guide to infrastructure decisions: When building in-house makes sense, when it wastes resources, and how to calculate the true cost of engineering time.
The Hidden Cost of Overengineering Your First 50 Engineers
Service meshes, multi-cloud strategies, and platform teams sound impressive. But for early-stage companies, they often slow delivery and burn cash. A practical guide to progressive complexity adoption.
Heroku vs Self-Hosting: A Cost-Benefit Analysis for 2026
A transparent breakdown of Heroku costs versus self-hosting alternatives. Real numbers, honest tradeoffs, and a framework to help you decide when to make the switch.
5 Advanced Docker Features Worth Knowing
Go beyond Docker basics with BuildKit, multi-stage builds, health checks, init processes, and build secrets. Learn practical techniques that improve security, performance, and reliability.
Infrastructure as Code: A Beginner's Guide to IaC Fundamentals
Learn the fundamentals of Infrastructure as Code - what it is, why it matters, key concepts, popular tools, and best practices for managing infrastructure with code.
Heroku is Shutting Down: Top Alternatives for Your Apps in 2026
Heroku has announced it is transitioning to a sustaining model with no new features. Here are the best alternatives to migrate your applications.
Understanding Kubernetes Operators: A Deep Dive with a Practical Example
Learn the concepts behind Kubernetes operators, why they exist, and how the control loop pattern works, then build one yourself to solidify your understanding.
DevOps vs SysAdmin vs SRE: What's the Difference?
Confused about DevOps, SysAdmin, and SRE roles? This beginner-friendly guide uses real-world analogies to explain what each role does, how they differ, and which path might be right for you.
What is DevOps? A Complete Beginner's Guide
New to DevOps? This beginner-friendly guide explains what DevOps is, why it matters, and how it transforms the way software is built and delivered - no technical background required.
GitOps: Deploy Docker Containers with GitHub Actions and ArgoCD
Learn how to implement a modern GitOps workflow for Docker deployments. This guide covers building images with GitHub Actions, pushing to container registries, and automated deployments with ArgoCD.
How to Publish a Helm Chart
Learn how to package and publish your Helm charts to various repositories including GitHub Pages, OCI registries, and ChartMuseum. This guide covers the complete workflow from packaging to distribution.
Docker Image Optimization: Best Practices for Smaller, Faster Images
Learn proven strategies to optimize Docker images: multi-stage builds, layer caching, base image selection, and security hardening. Reduce image size by up to 90% while improving build times and security.
Introduction to ArgoCD: Getting Started with GitOps
Learn how ArgoCD brings GitOps principles to Kubernetes deployments. This hands-on guide covers core concepts, architecture, and practical examples to get you started with declarative, automated application delivery.
How to Set Up AWS Cost Explorer and Budgets for Teams
Learn how to set up AWS Cost Explorer and Budgets to track cloud spending, prevent cost overruns, and keep your team informed about AWS expenses.
Deployment Strategies: Blue-Green vs Canary vs Rolling
Blue-green, canary and rolling deployments side by side: how each ships a release, how fast it rolls back, what it costs, and when to use which one.
Ping: Request Timed Out vs Destination Host Unreachable
"Request timed out" means no reply came back. "Destination host unreachable" means a router, or your own machine on the LAN, says it cannot reach the host.
The 5-Minute Kubernetes Cluster Health Check
Learn how to quickly assess your Kubernetes cluster's health with essential commands and catch issues before they become critical problems.
Right-Sizing Kubernetes Resources with VPA and Karpenter
Overprovisioned CPU and memory in Kubernetes increases costs and reduces efficiency. Learn how to use Vertical Pod Autoscaler, Karpenter, and monitoring tools to balance performance and resource usage.
How to Free Up a TCP/IP Port on Linux, macOS, and Windows
Learn how to identify processes using a port and free it up by stopping the service, killing the process, or changing configuration across different operating systems. Find an available port, and close a port with ufw, firewalld or nftables.
The Hidden Costs of Over-Automation in DevOps
Automation speeds things up, but too much of it can hide failures, slow incident response, and add fragile layers you have to maintain.
How to Get a List of All Valid IP Addresses in a Local Network?
Discover active devices on your local network using tools like nmap, arp-scan, and native OS commands. Learn network scanning techniques for inventory management, security audits, and troubleshooting.
A Day in the Life of a DevOps Engineer
Follow a DevOps engineer through a typical day - from morning deployments to midnight hotfixes. Real challenges, real solutions, and real impact on business operations.
How Can I Delete a Remote Tag?
Learn how to delete Git tags from remote repositories safely. Understand the difference between local and remote tag deletion, and discover best practices for managing release tags in team environments.
COPY with Docker but with Exclusion
Learn how to use the COPY instruction in Docker with exclusion patterns to optimize your Docker builds.
How to Set Image Name in Dockerfile
Learn how to set and manage image names effectively in Dockerfiles for streamlined workflows. This guide covers the steps to build Docker images with specific names and tags.
Forward Host Port to Docker Container
Publish container ports with -p, bind them to localhost, add a port to a container that already runs, understand ports vs expose in Compose, connect to Postgres in a container, find a container IP, and connect containers from different Compose projects.
How do I Get Flask to Run on Port 80?
Running Flask on port 80 requires special permissions since port 80 is a privileged port. Learn the different approaches to running Flask on port 80, from using sudo to setting up reverse proxies with Nginx.
Make an Existing Git Branch Track a Remote Branch
Run git branch --set-upstream-to=origin/branch-name (short: git branch -u origin/branch-name). Not on the remote yet? Run git push -u origin branch-name.
Can Two Different Sockets Share a TCP Port?
Understand how TCP port sharing works with SO_REUSEADDR and SO_REUSEPORT, when multiple sockets can bind to the same port, and the limitations you need to know.
What do PTY and TTY Mean?
TTY and PTY are interfaces for text input and output in Unix systems. Learn the difference between physical terminals (TTY), pseudo-terminals (PTY), and how they enable SSH sessions, terminal emulators, and command-line tools.
How to Clone a Git Repository into a Specific Folder
Want to clone a repository into a custom directory name? Learn how to specify the target folder when cloning Git repositories.
How to Set Git Editor for Commit Messages
Want to use your preferred editor for Git commit messages? Learn how to configure Git to use VS Code, Vim, Nano, Emacs, or any editor of your choice.
Why Does the C Preprocessor Interpret "linux" as "1"?
Discover why the word 'linux' is predefined as the constant 1 in the C preprocessor on Linux systems, and how this historical quirk can cause unexpected compilation errors.
Git Clone a Specific Branch with --single-branch
Clone only one branch with git clone -b branch-name --single-branch <repo-url>. Add --depth 1 to download just the latest commit and save more space.
How to Access a Docker Container's Shell, Run Commands and Copy Files
Open a shell with docker exec, run one-off commands, get root without sudo, add bash or ps to a slim image, edit and copy files with docker cp, look inside an image that has no shell, and debug a stopped container.
Why SCTP Is Not Widely Used Despite Its Technical Advantages
Explore why Stream Control Transmission Protocol (SCTP) remains niche despite offering features that improve on both TCP and UDP, including NAT issues, lack of OS support, and ecosystem inertia.
docker compose: Always Recreate Containers from Fresh Images
Run docker compose up -d --pull always --build --force-recreate to pull newer images, rebuild local ones and replace containers instead of reusing them.
How Can I Trigger a Kubernetes Scheduled Job Manually?
Run a Kubernetes CronJob now with kubectl create job --from, wait for it and read its logs, change it for one run, and check the CronJob settings that decide when it runs.
How to Use Environment Variables in Docker and Docker Compose
Pass environment variables with docker run -e and --env-file, set them in Compose with environment, env_file and .env files, learn which value wins, use defaults and required variables, set ENV and PATH in a Dockerfile, and keep secrets out of all of them.
Using ls to list directories and their total sizes
How to show directory sizes from the shell - practical commands for macOS and Linux, and why `ls` alone is not enough.
Docker: Connect to the Host's localhost from a Container
Use host.docker.internal, not localhost. Docker Desktop resolves it; on Linux add --add-host=host.docker.internal:host-gateway or use --network host.
How to Get the IP Address of the Docker Host from Inside a Docker Container
Need your container to talk to the Docker host? Learn practical ways to discover the host's IP address from inside a container, with examples for Linux, macOS, and Windows.
How to Connect to Network Shares with Username and Password
Learn how to mount SMB/CIFS network shares with credentials on Linux, macOS, and Windows, including persistent mounts and secure credential storage.
Experimenting Locally With Terraform, and Re-Running on File Changes
Try Terraform changes without touching shared state: providers that need no account, terraform console, local backends via override files, mock providers, local AWS emulators, and what to do instead of a watch mode when files change.
How to Get the Current Branch Name in Git
Need to programmatically get the current Git branch name? Learn multiple methods to retrieve the branch name for scripts, CI/CD pipelines, and shell prompts.
How to Get the Current Date, Time and Epoch Seconds in Linux and Bash
Print and format the current date and time with date, get Unix epoch seconds and milliseconds, convert between dates and timestamps, measure how long a command takes, and turn your favorite format into a custom command.
Close a Port on Windows from the Command Line
Find the PID with netstat -ano | findstr :PORT, checking the Local Address column, then end it with taskkill /PID <pid> /F, or block the port with netsh.
Increasing the Maximum Number of TCP/IP Connections in Linux and Monitoring Network Usage
Find the limit you actually hit, then raise it: file descriptors, the ephemeral port range, listen backlogs, TIME_WAIT and connection tracking. Then watch bandwidth per process, per connection and per interface with nethogs, iftop, nload and ss.
How to Save Terraform Plan and Apply Output to a File
Learn how to save Terraform plan output for review, share readable apply logs, and use the -out flag for safe two-step deployments.
Delete a Commit from a Git Branch: Reset, Rebase or Revert
Remove the last commit with git reset --hard HEAD~1, drop an older one with git rebase -i, or undo a pushed commit safely with git revert <commit-hash>.
How do I Add an Empty Directory to a Git Repository?
Git does not track empty directories by design. Learn practical workarounds to include empty folders in your repository using .gitkeep files and understand why this limitation exists.
How to Get Logs From All Pods, Events and Files With kubectl
Read the logs of every pod of a Deployment or ReplicationController at once, follow them live, see the events of one pod, and copy files out of a pod with kubectl.
How to List Volumes in Docker Containers
Learn multiple ways to view Docker volumes attached to containers, inspect volume mounts, find volume locations on the host, and understand volume usage across your Docker environment.
How to Run Terraform From a Different Directory and in Scripts
Use terraform -chdir to run init, plan and apply against another folder, run Terraform without interactive prompts, limit a run to one resource with -target, and destroy everything except one resource without losing it.
How to Update or Sync a Forked Repository on GitHub
Your fork is behind the original repository? Learn how to sync your GitHub fork with the upstream repository and keep it up to date with the latest changes.
Close vs Shutdown Socket
The difference between close() and shutdown() on a socket: when to use each, how shutdown enables half-closed connections, why a restarted server gets "Address already in use", and how SO_REUSEADDR and SO_REUSEPORT differ.
How to List All Files in a Git Commit
Need to see which files were changed in a commit? Learn how to list all files modified, added, or deleted in any Git commit using log and show commands.
UDP vs TCP: How Much Faster Is UDP Really?
How much faster UDP really is, measured on localhost, where the difference comes from, and when it is appropriate to use UDP instead of TCP: DNS, calls, games, VPNs and QUIC.
Capturing Mobile Phone Traffic on Wireshark
Learn how to capture and analyze network traffic from your mobile phone using Wireshark. Set up a proxy or WiFi hotspot to inspect HTTP/HTTPS requests, debug mobile apps, and understand what data your phone is sending.
How to Find and Restore a Deleted File in Git
Accidentally deleted a file and need it back? Learn how to find when a file was deleted and restore it from Git history.
How to Sleep for Milliseconds in Bash and Linux
Learn how to pause script execution for fractions of a second using sleep, usleep, and other methods for precise timing in Bash scripts and command-line operations.
How to Set Up Fargate Execution Roles and IAM Policies in Terraform
Create the ECS Fargate task execution role and task role with Terraform, attach several IAM policies to one role, fix "MalformedPolicyDocument: Has prohibited field Resource", and find the minimum AWS permissions that Terraform itself needs.
Git File History: View the Changes Made to a File
Run git log --follow -p -- path/to/file to list the commits that changed a file, with patches, across renames. git blame shows who last changed each line.
How to Integrate DAST Into Your CI/CD Pipeline (With OWASP ZAP Examples)
A practical guide to Dynamic Application Security Testing. Learn how DAST works, set up OWASP ZAP scans, compare it with Burp Suite, and automate security testing in your CI/CD pipeline with quality gates.
Dependency Scanning: Finding Vulnerabilities Before Attackers Do
A practical guide to dependency scanning with Snyk, Dependabot, and native package manager tools. Learn how to detect vulnerable dependencies, automate fixes, and integrate scanning into your CI/CD pipeline.
Pre-commit Hooks for Security: Stop Secrets Before They Hit Your Repository
Once a secret is committed to Git, it lives forever in the history. Pre-commit hooks with gitleaks, detect-secrets, and custom checks catch credentials before that happens.
Secrets Management Guide: Vault, AWS Secrets Manager, and Azure Key Vault
Stop storing secrets in .env files and environment variables. This guide covers secrets management fundamentals, HashiCorp Vault dynamic secrets, AWS Secrets Manager rotation, and Azure Key Vault with practical code examples.
Security-Focused Code Reviews: Catching Vulnerabilities Before Production
Learn how to review code with a security mindset: the vulnerability patterns and language-specific pitfalls to look for, the secure coding practices every change should follow, and checklists for finding injection flaws, auth bypass, and logic bugs that automated tools miss.
Software Supply Chain Security: CI/CD Pipeline Hardening, SBOMs, Sigstore and SLSA
Harden the CI/CD pipeline that builds your software, then prove what it built: isolated runners, OIDC instead of stored keys, restricted egress, SBOMs, keyless signing with Cosign and SLSA provenance with GitHub artifact attestations.
Should .terraform.lock.hcl Be in .gitignore? Checksums and Versions
No: commit .terraform.lock.hcl. Learn what the lock file records, how version constraints work, how to fix checksum mismatch and "Invalid legacy provider address" errors, how to install a specific Terraform version, and which providers manage on-premises servers.
How to Fix SSH "Could Not Resolve Hostname" Error
Troubleshoot and fix the SSH 'nodename nor servname provided, or not known' error with DNS checks, host file configuration, and SSH config debugging.
Undo or Abort a Git Merge, and Resolve Merge Conflicts
Undo a merge with git reset --merge ORIG_HEAD, stop one with git merge --abort, resolve conflicts, and fix "refusing to merge unrelated histories".
How to Use Multiple Build Arguments in Docker Build
Learn how to pass multiple build-time variables to Docker builds using --build-arg, set default values in Dockerfiles, and use build arguments for environment-specific configurations.
How to Apply SQL Scripts to RDS and Read Secrets With Terraform
Terraform has no SQL resource. Compare the three ways to run SQL against RDS (local-exec, a database provider, a migration tool), and learn how to read secrets from AWS Secrets Manager without storing them in the Terraform state.
Fix Docker 'Cannot Connect to the Docker Daemon' and 'Permission Denied' Errors
Fix 'Cannot connect to the Docker daemon at unix:///var/run/docker.sock', permission denied on the Docker socket and on volumes, and 'denied: requested access to the resource is denied' on docker push. Learn why the docker group equals root, and how to harden a Docker host.
Git Diff Between Two Branches: Files, Commits and Stats
git diff main..feature shows changed lines, git log main..feature lists commits main does not have, and git diff --stat main feature sums it up per file.
Ingress vs Load Balancer in Kubernetes, Pending IPs and port-forward
When to expose a Service with a LoadBalancer, an Ingress or Gateway API, why EXTERNAL-IP stays pending, and how kubectl port-forward reaches a pod without exposing it.
How to Squash the Last N Commits and Change Commit Authors in Git
Squash the last N commits with git reset --soft or git rebase -i, use fixup commits, and fix commit authors with --amend, rebase --exec or a mailmap.
How to Copy, Overwrite and Symlink Files in Linux, and Get Their Full Path
Make cp overwrite without asking, copy whole directories with their hidden files, create symlinks with ln -s and get relative targets right, remove a symlink without deleting the target, and get the absolute path of any file.
What Does set -e Mean in Bash? Shebangs, sh vs bash and the Script Directory
The first lines of a Bash script decide which shell runs it, what happens when a command fails and where it finds its files. Learn what set -euo pipefail does and where it does not stop a script, which shebang to use, how sh differs from bash, and how to get the script directory.
How to Fix Pods Stuck in Terminating and Delete All Resources
Why a pod or namespace stays in Terminating, when a force delete is safe, how to handle finalizers, down nodes and volumes, and how to list or delete all resources and pods.
How to Configure CloudWatch Logs Subscription Filter to Lambda With Terraform
Learn how to stream CloudWatch Logs to a Lambda function using Terraform, including permissions and error handling, and how to run a Lambda function on a schedule with EventBridge.
How to Find Files Containing Specific Text on Linux
Need to locate files with specific content? Learn how to use grep, find, and other Linux tools to search through files and directories efficiently.
How to Reset Local Git Branch to Match Remote Repository HEAD
Learn different methods to reset your local Git branch to exactly match the remote repository HEAD, including hard reset, fetch and reset, and when to use each approach safely.
How to Push a New Local Branch to Remote Git Repository and Track It
Push a new branch with git push -u origin <branch>, fix "src refspec does not match any", and rename or delete a branch locally and on the remote.
kubectl apply vs kubectl create, and How to Export Live YAML
Learn when to use kubectl apply, create, replace and server-side apply, how apply decides what to change, and how to get clean YAML from a resource that already runs.
How to Find the IP Address of an SSH Client
Learn multiple ways to identify the IP address of clients connected to your SSH server, from environment variables to logs and active connection monitoring.
Move the Most Recent Commit(s) to a New Branch with Git
Learn how to move recent commits from your current branch to a new branch using git checkout, reset, and cherry-pick. Fix branch organization mistakes effectively.
How to Fix Docker "The input device is not a TTY" Error
Learn what causes the Docker TTY error and discover multiple solutions to fix it, from command-line flags to proper terminal configuration for interactive containers.
How to Organize a Terraform Repository: Environments, Modules, Files
A practical layout for a Terraform repository: one root folder per environment and component, small reusable modules, and clear file names. Also covers dev, staging and production, workspaces, and how to split main.tf into several files.
How to Rebuild, Restart and Upgrade a Docker Compose Container
restart, up -d, up --build and --force-recreate each apply a different kind of change, and only one of them rebuilds your image. Tested on Compose 5.6: which command picks up which change, how to start only some services, wait for a healthy database, upgrade without losing data, get a shell in a crashed service, and what changed from docker-compose v1.
How to Recursively Grep All Directories and Subdirectories
Learn how to use grep with recursive options to search through entire directory trees efficiently, exclude directories, list only matching file names, and filter live log streams without buffering delays.
How to Find Files Using Wildcards in Linux, Exclude Directories and Count Files
Use find with wildcards to search directory trees, fix "Argument list too long", skip directories such as node_modules in find and tar, count files and lines of code, and change permissions for folders and files separately.
Difference Between RUN, CMD and ENTRYPOINT in a Dockerfile
RUN executes at build time, CMD sets the default command, and ENTRYPOINT sets the program that always runs. See how the three combine, why a container exits at once, how to run cron, when ADD beats COPY, and how comments work in a Dockerfile.
How to Profile C++ Code Performance on Linux
Learn how to use profiling tools like gprof, Valgrind, and perf to analyze C++ application performance and identify bottlenecks on Linux systems.
Remove a Git Submodule: deinit, git rm and Cleanup
Run git submodule deinit -f path, then git rm -f path, and commit. To delete the leftover Git data too, remove .git/modules/<name>, usually the same path.
How to Access Host Port from Docker Container
Learn how to access a host machine's port from a Docker container using network configurations and best practices.
How to Read a .env File in Terraform, and Where path.module Points
Terraform reads only TF_VAR_ environment variables and never a .env file. Learn how to load one safely, how path.module, path.root and path.cwd differ, and how to upload a local folder or create an empty folder in S3.
How to Permanently Set $PATH on Linux and Unix
Learn how to permanently modify your PATH environment variable on Linux and Unix systems so your custom directories persist across shell sessions and reboots, then reload .bashrc, export or delete variables, and write aliases that take parameters.
How to Undo a Git Rebase with ORIG_HEAD or reflog
Just rebased? Check git log -1 ORIG_HEAD, then run git reset --hard ORIG_HEAD. Otherwise find the old commit in git reflog. Mid-rebase: git rebase --abort.
How to Force a Clean Docker Build and Fix Common Build Errors
Rebuild without the cache, fix "docker build requires 1 argument", use files from outside the build context, look inside a build that failed, and give a build SSH keys or secrets without baking them into the image.
How to Simulate a Slow Internet Connection for Testing
Throttle and break the network on purpose: tc netem on Linux, Network Link Conditioner on macOS, Clumsy on Windows, browser DevTools, Toxiproxy for a single service, and three ways to create a connection timeout.
Git Fetch a Remote Branch and Check It Out Locally
Run git fetch origin branch-name, then git switch branch-name for a local branch that tracks origin/branch-name, or git switch --track origin/branch-name.
How to Keep Docker Data When a Container Exits: Volumes and Bind Mounts
Data in a container goes away with the container. Learn when that happens, how named volumes and bind mounts keep data, how to add a volume to an existing container, where database images keep their files, and how to back up and remove volumes safely.
How to Stash Only One File in Git
Need to temporarily save changes to just one file? Learn how to stash a single file in Git while leaving other changes in your working directory.
How to Reference for_each Resources in Terraform: Keys, Indexes and Import
A resource with for_each is a map of instances. Learn how to reference one instance or all of them, how to get a list index inside for_each, and how to import existing objects into for_each addresses without quoting errors.
Who is Listening on a Given TCP Port on Mac OS X?
Need to find out which process is using a specific port on your Mac? Here's how to check which application is listening on a TCP port using built-in macOS tools.
Specify a Private SSH Key for Git, and Show or Change the Remote URL
Choose the SSH key Git uses with core.sshCommand, GIT_SSH_COMMAND or an ~/.ssh/config alias with IdentitiesOnly, and show or change the remote URL.
How to Copy Command Output Directly to Your Clipboard in Linux
Pipe command output to the clipboard with wl-copy on Wayland, xclip or xsel on X11, pbcopy on macOS and clip.exe on WSL. Paste it back, write clipboard functions for scripts, and copy to your local clipboard over SSH.
How to Make Git Ignore File Mode Changes
Git showing chmod changes you don not care about? Learn how to configure Git to ignore file permission changes while tracking actual code changes.
How Does cat << EOF Work in Bash?
Understand heredocs in Bash - the << EOF syntax that lets you write multi-line strings, create files with embedded content, and pass complex input to commands.
Remove a File from Git Without Deleting It, or Undo git add
Stop tracking a file with git rm --cached and keep it on disk, unstage a file with git restore --staged, and commit only part of a file with git add -p.
How to Parse and Check Command Line Arguments in Bash
Read positional arguments with $1 and "$@", check that the user passed the arguments a script needs, parse short options with getopts and long options such as --env=prod with a while loop.
How to Get Your Local IP Address
Learn multiple methods to find your local IP address using command line tools, programming languages, and system utilities across different operating systems.
How to Prompt for Yes/No/Cancel Input in a Linux Shell Script
Learn different techniques for creating interactive prompts in your shell scripts, from simple yes/no confirmations to three-way choices with proper input validation and user-friendly interfaces.
How to Change the Output Color of Echo and Fix Newlines in Bash
Print colored text in a Linux terminal with ANSI escape codes or tput, turn colors off when output is not a terminal, and fix echo when it prints a literal \n instead of a new line.
How to Find Which Process Is Listening on a Port in Windows
Need to know which application is using a specific TCP or UDP port on Windows? Here's how to check using netstat, tasklist, PowerShell, and Resource Monitor.
Why Does a Deleted Kubernetes Pod Get Recreated? Deployments, Images
A deleted pod comes back because a controller owns it. Find and stop that controller, compare pods, Deployments and StatefulSets, update or re-pull an image, and debug ImagePullBackOff.
Kubernetes API - Get Pods on Specific Nodes
Learn how to list the pods on one node, or every pod with its node, with kubectl field selectors, custom columns and direct calls to the Kubernetes API.
Terraform Infrastructure as Code Best Practices
Practical Terraform best practices for 2026: repository layout, remote state with native S3 locking, version pins and the lock file, data sources instead of hardcoded IDs, secrets kept out of state, terraform test, and a CI pipeline that applies the plan you reviewed.
How to Check if a File, Directory, Variable or Command Exists in Bash
The Bash tests you use in almost every script: check if a directory or file exists, if a variable is set or empty, if a string contains a substring, how to compare text without case, and if a program is installed.
What Does "2>&1" Mean in Linux and Bash?
Learn what the 2>&1 redirection operator means, how stdout and stderr work, and how to send all output to a file, to the screen and a file with tee, to a protected file with sudo, or only to stderr.
Docker: How to Change Repository Name or Rename an Image
Learn how to rename a Docker image or change its repository name using simple Docker CLI commands. This guide covers real-world scenarios and best practices.
How to List and Remove Docker Containers and Images
List running and stopped containers, fix "name is already in use", remove old containers and images safely, delete every local image, find where Docker stores its data, and free disk space when Docker fills the disk.
How to Loop Through File Lines, Arrays and Number Ranges in Bash
Read a file line by line without losing spaces or backslashes, keep variables set inside the loop, loop safely over file names, iterate over arrays, and loop over a number range stored in variables.
How to Manage Kubernetes Environments: Namespaces, Contexts, Clusters
Separate staging, QA and production with namespaces or clusters, switch kubectl between namespaces and clusters such as GKE and minikube, reach Services in other namespaces, and sign in to a cluster web UI.
How to Restart, List and Keep Containers Running in a Kubernetes Pod
Kubernetes has no command to restart one container. Learn the ways that work, how to restart pods after a ConfigMap or Secret change, how to list containers, run several commands, keep a container running, and use local images.