Tag: #devops

← All posts

• Anatomy of an AI agent harness — 35 files that make the rules enforce themselves

  Same model, yet in one repository the accidents repeat and in another they do not. The difference is the harness. A file-by-file dissection of the harness in a repository where an AI accumulated 1,491 commits alongside a

  2026-09-11 · 13 min read #ai#agent#harness#claude-code#ci-cd

• What a bastion is in the cloud, and how to use one well on AWS — ProxyJump measured, SSM Session Manager, EC2 Instance Connect Endpoint

  A bastion is the host that reduces the doors into a private network to one. Go through a jump host with OpenSSH ProxyJump in a homelab and measure what the target server actually sees, then compare the two things AWS rec

  2026-09-10 · 8 min read #aws#bastion#ssh#ssm#security

• Three ways to put a proxy cache in front of Docker Hub — registry:2, Nexus, ECR pull-through cache

  Read the Docker Hub rate-limit headers yourself, stand up registry:2 as a pull-through cache and pull the same image three times, then sort out where a Nexus proxy/group repository and an ECR pull-through cache each fit,

  2026-09-10 · 7 min read #docker#registry#nexus#ecr#devops

• LabHub — I opened a hands-on platform where you learn on a real server, in the browser

  Some things do not stick from reading. There is no substitute for attaching to a server, typing a command, getting it wrong, and finding out why. LabHub is a learning platform that puts that loop inside the browser. Pres

  2026-08-20 · 8 min read #labhub#kubernetes#devops#education#hands-on

• Open Source Worth Watching Right Now (3) Infrastructure and Databases

  Databases and infrastructure are the field where license changes and forks redrew the board. From analytics engines and embedded databases to Postgres extensions, Kubernetes operators, and IaC, this post introduces 11 op

  2026-08-12 · 5 min read #open-source#database#infrastructure#postgresql#kubernetes

• Open Source Worth Watching Right Now (6) What Star Counts Do Not Tell You

  A star count is a popularity metric, not a risk metric. This post lays out the signals you actually have to check before you bring an open source project into production: recent commits and release cadence, issue respons

  2026-08-12 · 6 min read #open-source#governance#supply-chain#risk#devops

• Bus Factor Is Not the Number of People Who Know the Code but the Number of People Who Can Decide

  The Nixpkgs core team disbanded after ten months. In a repository with thousands of contributors, the people holding delegated decision-making authority numbered two, and when those two stepped down that jurisdiction was

  2026-08-09 · 9 min read #devops#open-source#governance#nix#supply-chain

• You Added Registry Instances and Availability Did Not Move — What zot Scale-Out Actually Sells

  Taking zot as the example, this post takes apart the scaling design of a container registry. A structure that assigns repositories to instances by consistent hashing and has non-owner nodes proxy the request onward is sh

  2026-08-09 · 8 min read #devops#oci#registry#zot#container

• Secrets Management — Why a .env File Is Not Enough, the Paths Environment Variables Leak Through, and How to Design Rotation

  Adding .env to .gitignore does not make a secret safe. The process environment is readable verbatim from the same host through /proc/PID/environ, it rides out in crash reports, debug pages and CI logs, and it stays forev

  2026-07-26 · 16 min read #security#secrets#devops#vault#kubernetes

• Docker Network Modes and Connection Problems — bridge, host, overlay, and the 127.0.0.1 Trap

  Unpacks the situation where the container is up but nothing can connect, mode by mode. It covers why containers cannot find each other by name on the default bridge and how the embedded DNS on a user-defined network chan

  2026-07-26 · 13 min read #docker#docker-network#iptables#networking#devops

• Shrinking Docker Images — The Truth About Layers, Multi-Stage Builds, and What a Base Image Really Costs

  Start by pinpointing, layer by layer with dive, exactly where a Docker image balloons to 1.9GB. This piece covers why the union filesystem makes RUN rm incapable of removing a single byte from an image, exactly what a mu

  2026-07-26 · 12 min read #docker#dockerfile#multi-stage-build#container#devops

• Mistakes That Keep Repeating in Dockerfiles — Running as root, PID 1, and Secrets Left in the Image

  Works through the Dockerfile problems that pass the build and only blow up in production, starting from their causes. Containers running as root because no USER was set, the latest tag and reproducibility, why ADD should

  2026-07-26 · 12 min read #docker#dockerfile#container-security#pid1#devops

• Why the Docker Build Cache Keeps Breaking — Layer Cache Keys, ARG, and BuildKit Cache Mounts

  Explains, at the level of cache keys, why npm ci runs for five minutes again after you changed a single line of code. It covers the difference between a RUN cache key being the command string and a COPY cache key being a

  2026-07-26 · 11 min read #docker#buildkit#build-cache#ci-cd#devops

• Talos Linux 1.13 — How a Shell-less Immutable OS Ended Up Shipping a Debug Shell

  Talos Linux, the Kubernetes-only immutable OS, shipped 1.13 on April 27, 2026. The release brings a kernel built with Clang/ThinLTO, reproducible disk images, machine-wide container image signature verification, and its

  2026-07-17 · 13 min read #linux#kubernetes#talos#immutable-infrastructure#devops

• How Far Has OpenBao Actually Diverged from Vault — Tracing the Fork Through Release Notes, Up to v2.6's Namespace Sealing

  Exactly two years have passed since OpenBao's v2.0.0 GA (2024-07-17), and v2.6.0 shipped three days ago. This post sets aside the tribal framing — 'BUSL betrayal' versus 'sustainability' — and checks where the fork actua

  2026-07-17 · 10 min read #security#open-source#devops#licensing

• Flux 2.9 and Two Years After Weaveworks — How a GitOps Project Survives Losing Its Sponsor

  When Weaveworks, the company that created Flux, shut down in early 2024, a GitHub discussion appeared asking: is the project future at risk? Two and a half years later, on 2026-06-30, Flux shipped 2.9.0. This post recons

  2026-07-17 · 12 min read #devops#gitops#fluxcd#kubernetes#open-source

• systemd v261 — Staged Rollout Comes to PID 1, Cloud IMDS Absorption, and a Finished dlopen Migration

  systemd v261, released 2026-06-19, ships ConditionFraction= (turns a unit on for only a set fraction of the fleet), ConditionMachineTag= (splits machines into rings via machine tags), and a new IMDS subsystem that pulls

  2026-07-17 · 16 min read #linux#systemd#devops#cloud#sysadmin

• The Version After MySQL 9.7 Is 26.7 — How MySQL and MariaDB Tidied Up Their Release Models in Spring 2026 ♪ Listenable

  On April 21, 2026, MySQL 9.7.0 shipped as GA, opening a new LTS line for the first time in almost two years since 8.4 — and that same month, Extended Support for MySQL 8.0 ended, dropping it into Sustaining Support. Then

  2026-07-16 · 20 min read #mysql#mariadb#database#versioning#devops

• Debian Has Started Blocking Unreproducible Packages From Migrating to Testing — What the Gate Actually Blocks, and What It Doesn't ♪ Listenable

  On May 9, 2026, Debian's release team wired its migration software, britney, to reproducibility checks. The sentence that hit the mailing list the next day was "Debian must ship reproducible packages," but what's actuall

  2026-07-16 · 20 min read #devops#reproducible-builds#debian#supply-chain#ci-cd

• OpenTofu 1.12's Dynamic prevent_destroy — Where the Lifecycle Block's Static Constraint Loosens, and What It Costs

  Terraform's lifecycle block accepts only literal values by design. HashiCorp's docs explain why: lifecycle settings are processed while building the dependency graph, before variables can be evaluated — and the request t

  2026-07-16 · 12 min read #opentofu#terraform#iac#devops#state-management