Practical articles on AI, DevOps, Cloud, Linux, and infrastructure engineering.
A request leaving a laptop somehow lands on a server 20ms away. Here is what actually decides which point of presence answers.
A shared API key between two internal services proves nothing about who is calling. mTLS makes every service present a cryptographic identity instead.
You run docker run, and it refuses to bind port 8080. Something already owns that port. Here is how to find the holder and get your container up.
Our failover config looked perfect in the console and did nothing during a real outage. Here's the health-check design that actually flipped regions when it mattered.
We moved 40 services off the nginx Ingress controller onto Gateway API without a single dropped connection. Here's the routing overlap trick that made it boring.
A single NAT Gateway quietly billed us $2,900 in one month, mostly for data processing on traffic that never needed to leave the VPC. Here's how we found it and cut it.
We had 140 engineers with 300 static public keys scattered across authorized_keys files nobody could audit. Moving to SSH certificates with short TTLs made access reviewable again.
Our proxy topped out at 40k connections while the CPU sat half-idle. The bottleneck was kernel defaults tuned for 2009, not the hardware.
Static service tokens leaked into logs and never rotated. SPIFFE identities plus SPIRE-issued SVIDs gave us short-lived certs and killed the shared-secret sprawl.
Default-deny, namespace isolation, egress control — the patterns we use, the gotchas around DNS, and where Cilium changed our calculus.
When the service is slow and the network is suspect, these are the tools we reach for, in this order, with the exact flags that find the answer.
Three terms that get mixed up constantly. The actual differences, where each one sits in the request path, when you reach for which, and where the same tool plays all three roles.
