Container Runtime Hardening: Rootless, Read-Only, and Fewer Capabilities
Scanning tells you what is inside the image. These four settings decide what it can do once it is running — and what breaks when you turn them on.
4 min readRead post →
blog
All posts
30 articles on building and operating reliable systems.
Showing 30 of 30 articles
Container Supply Chain: How I Stopped Trusting Base Images
Tags move underneath you and nobody tells you. Pinning digests, gating on real CVEs, emitting an SBOM, and signing what my pipeline actually built.
4 min readRead post →
Kill the Long-Lived Cloud Keys in Your Pipeline
An access key sitting in CI secrets has no expiry and no owner. Replacing it with OIDC federation means the pipeline authenticates per run instead of carrying a permanent password.
3 min readRead post →
Kubernetes Security Baseline: RBAC, Pod Security, and Default-Deny
Out of the box a cluster lets almost anything run as root with a mounted token and an open network. Three labels, one role cleanup, and a default-deny policy fix most of it.
3 min readRead post →
Security Gates in CI That Don't Make Every Pull Request Crawl
A scanner that blocks on every historic finding gets bypassed within a week. Baselines, severity floors, and the split between fast PR checks and slow nightly ones.
3 min readRead post →
AI in the Pipeline: What Actually Sticks
AI code review, agentic CI, generated tests — I tried the lot. Here's what survived a year of real repositories, and what quietly got turned off.
4 min readRead post →
eBPF: Observability Without the Sidecar Tax
Kernel-level metrics, traces, and network policy with no agents in your pods — how eBPF quietly moved from research project to default infrastructure.
4 min readRead post →
OpenTofu and the New Rules of IaC
The Terraform fork that became a Linux Foundation project, state encryption built in, and how to decide between tofu and terraform without starting a religion war.
3 min readRead post →
Platform Engineering Without the Hype
Golden paths, internal developer portals, and the honest question of whether your team needs a platform at all — what platform engineering actually buys you.
4 min readRead post →
WebAssembly Beyond the Browser
WASM at the edge, Wasm plugins in proxies and databases, and whether containers should be looking over their shoulder — where WebAssembly actually earns its keep in 2026.
4 min readRead post →
Feature Flags: Deploy on Friday Without the Drama
Trunk-based development with flags instead of release branches — how we ship code continuously but expose features only when we're ready.
4 min readRead post →
Shell Scripts That Don't Embarrass You at 3 AM
set -euo pipefail, quoting like you mean it, and other bash habits that turn fragile one-liners into scripts you can trust when it matters.
3 min readRead post →
Secrets Management Habits That Keep You Out of Trouble
The .env file I committed once, how I cleaned it up, and the boring habits that keep API keys out of git history for good.
3 min readRead post →
Debugging Production With CloudWatch (Without SSHing Anywhere)
Logs Insights queries, metric filters, and alarms that matter — finding root cause from CloudWatch alone, the way you have to when SSH is not an option.
3 min readRead post →
RDS Backups: The Kind You'll Wish You Had at 2 AM
Automated backups, point-in-time recovery, snapshots versus replicas — and why you should restore a database on purpose before you need to by accident.
3 min readRead post →
Right-Sizing EC2 Before It Bites Your Bill
Burstable instances, credit balances, and CloudWatch graphs — how to pick an EC2 size you won't regret, and how to shrink one you already regret.
3 min readRead post →
S3 Storage Classes Without the Alphabet Soup
Standard, IA, Glacier tiers, lifecycle rules, and the retrieval fees that ruin your day — how I stopped overpaying for object storage.
3 min readRead post →
How I Locked Myself Out of AWS (and What IAM Taught Me)
A botched inline policy, an expired access key, and an empty permission set — the IAM story every cloud engineer seems to live through once.
3 min readRead post →
VPC Networking, Explained for People Who Hate Networking
Subnets, gateways, route tables, security groups — the AWS networking basics I wish someone had drawn on a whiteboard for me the first time.
3 min readRead post →
Building a CI/CD Pipeline That Actually Holds Up
Stop shipping pipelines held together with duct tape. A practical playbook for CI/CD that teams trust on day one — and still trust six months later.
2 min readRead post →
Docker Networking Explained the Way It Finally Clicked for Me
Bridge networks, port publishing, and why localhost lies to you inside a container — the mental model that made container networking stop being magic.
3 min readRead post →
Kubernetes Deployment Strategies: Rollouts That Don't Wake SRE
Recreate, rolling, blue-green, canary. How to pick the right Kubernetes deployment strategy — and what can go wrong with each one.
2 min readRead post →
Postmortems Nobody Dreads Writing
Blameless timelines, action items that ship, and the meeting structure that turns outages into engineering instead of finger-pointing.
4 min readRead post →
Route 53 Basics Every DevOps Engineer Should Know
Aliases, TTLs, health checks, and failover routing — the DNS mechanics behind every domain cutover, including the ones you'll do at midnight.
4 min readRead post →
Docker Images: From 1.2GB to Under 100MB Without Losing Sanity
Multi-stage builds, distroless bases, and layer hygiene. A practical guide to shrinking Docker images the right way.
2 min readRead post →
Terraform Environments Done Right: Workspaces Are a Trap
How to structure Terraform for multiple environments without copy-pasting modules or stepping on production state.
2 min readRead post →
Observability That Answers Questions, Not Dashboards
Dashboards are how you OBSERVE, not what you're building. Design observability around golden signals, SLOs, and concrete questions.
2 min readRead post →
GitOps on K8s: Argo CD in Production Without the Horror Stories
Git is the source of truth. Argo CD syncs reality to git. A field-tested setup — repos, apps, sync waves, and the gotchas.
3 min readRead post →
Linux Server Hardening: The 20% That Stops 80% of Attacks
Effective Linux hardening isn't a security checklist that makes the machine unusable. It's SSH config, patching, least privilege, and logging.
2 min readRead post →
Cloud Cost Optimization: Cut 30% by Asking Three Questions
Right-sizing, lifecycle, and reserved coverage. Cloud cost cuts don't come from dashboards — they come from three decisions made weekly.
2 min readRead post →