Tag
52 articles tagged #DevOps.
P.01An unauthenticated attacker can inject code through a GitLab GraphQL directive and delete or modify public projects and user data. CVSS 9.4, patched in 19.2.4. Here's what's affected and how to check your instance.
P.02A log line that's just a sentence is fine until you have to search a million of them at 2am. Here's how structured logging actually works, how to thread a correlation ID through a request, and which fields are worth the storage cost.
P.03The keyv and cacheable attack poisoned 2,234 package versions in one day, and it won't be the last. Here's the concrete checklist for install scripts, provenance, lockfile audits, and CI token scoping that actually reduces your exposure.
P.04A compromised maintainer account on August 4 turned keyv and cacheable into a self-propagating npm worm that stole cloud, CI, and GitHub credentials from packages with tens of millions of weekly downloads. Here's what happened and how to check if you were hit.
P.05A deserialization flaw in TeamCity's agent polling protocol lets an attacker with no credentials run commands as the build server. CISA confirmed active exploitation on August 5. Here's what's affected and how to patch it.
P.06Researchers at Black Hat USA 2026 showed how an untrusted GitHub issue reached CI runner secrets in Claude Code, Gemini CLI, and OpenAI Codex. Gemini CLI's flaw scored a perfect 10.0 CVSS. Here's what happened and how to check your own pipelines.
P.07A single checkout request might touch five services and nobody can say which one is slow. Distributed tracing fixes that by tagging every hop with one trace ID. Here's how spans, trace IDs, and context propagation actually work, with OpenTelemetry examples.
P.08An SLA is a promise with a penalty. An SLO is the internal target that keeps you inside that promise. An error budget is what's left before you breach it. Here's how the three fit together, with the math worked through on a real example.
P.09A one-line control-flow change meant to patch CVE-2026-29146 quietly broke Tomcat's cluster encryption instead. CISA confirmed active exploitation on August 4 and set an August 7 remediation deadline. Here's what happened and what to patch.
P.10Four different philosophies for the same problem: getting a database schema from what it is to what it should be, safely, in a team. Here's how Flyway, Liquibase, Prisma Migrate, and Atlas actually differ, and which one fits your stack.
P.11A 3-hour-33-minute CloudFront VPC Origins failure on July 16, 2026 knocked out at least ten unrelated services worldwide. The root cause was a single-ingress design decision, and it's a pattern worth checking your own architecture for.
P.12Kubernetes 1.36 shipped 70 enhancements with no headline rewrite, just years of accumulated work reaching stable. Here's what actually changes for platform teams, and what's safe to skip for now.
P.13Enforcement of actions/checkout's new pull_request_target protections landed July 20, 2026, closing the exact hole the AsyncAPI attack used six days earlier. Here's what changed, who needs to act, and how to check your own workflows.
P.14A unit-pricing bug in AWS's billing estimate subsystem sent some customers cost projections in the billions and trillions on July 16. Invoices were unaffected, but automation wired to those estimates wasn't. What happened, and how to build cost alerting that fails safely.
P.15npm's trusted publishing lets GitHub Actions and GitLab CI publish packages via short-lived OIDC tokens instead of a long-lived npm token in your CI secrets. Here's the exact setup and what changed in the May 2026 config update.
P.16A hacker claimed to steal 35GB from Accenture in July 2026, including source code, RSA and SSH keys, and Azure access tokens. The source code isn't the risk. The credentials filed next to it are. Here's the audit worth running on your own repos this week.
P.17Platform engineering has its own hiring cluster now, distinct from DevOps, SRE, and cloud architecture. Here's how to define the role correctly, screen candidates for product thinking over ticket-taking, and avoid paying platform-engineer money for ops-with-a-new-title.
P.18npm v12, shipped July 8, 2026, blocks preinstall/install/postinstall scripts, Git dependencies, and remote tarball installs unless you explicitly allow them. Here's what breaks, why it's happening now, and the exact commands to migrate a real project.
P.19Chaos engineering means deliberately injecting failure into a running system to find weaknesses before an outage does. Here's what it actually involves, what tools make it practical, and when a smaller team should and shouldn't bother.
P.20DevSecOps is a distinct discipline from DevOps and from security engineering. Here's what the role actually covers, what skills to screen for, and why supply chain security is now the core competency.
P.21Site Reliability Engineering is a specific discipline, not a synonym for DevOps. Here is how to define the role correctly, screen for the right skills, and avoid hiring an ops generalist and calling them an SRE.
P.22Both tools keep your dependencies current automatically. Here is how they actually differ, where each one breaks down, and which to choose based on your team's setup.
P.23The 'DevOps engineer' title now covers three distinct jobs: platform engineer, SRE, and CI/CD specialist. Here's what each role actually does, what to screen for, and what the market pays.
P.24A practical guide to setting up metrics collection with Prometheus and visualization with Grafana for backend services — what to instrument, what to skip, and what the dashboards should actually show.
P.25Dev Containers let you define your entire development environment in a JSON file. New team members are productive in minutes, not days. Here's how to set them up properly.
P.26Vulnerability scanning catches known CVEs in your base images and dependencies before they reach production. Here's how to set up Trivy and Snyk, understand their output, and act on what they find.
P.27A bloated Docker image costs you in pull times, storage fees, and attack surface. Here's how to build images that are small, fast to rebuild, and genuinely production-ready.
P.28The fear of vendor lock-in leads to over-engineering. Here's a practical framework for deciding when to abstract cloud dependencies and when accepting lock-in is the right call.
P.29Vercel dominates frontend hosting. AWS dominates enterprise infrastructure. Between those two extremes, Fly.io and Railway are the most practical choices for backend-heavy full-stack apps in 2026.
P.30Git worktrees let you have multiple branches checked out simultaneously in separate directories. No stashing, no context switching, no 'just a second while I save my work.'
P.31Blue-green and canary deployments give you a way to release software without taking down your service or discovering a bug when it's already affecting everyone. Here's how they work and when to use each.
P.32Standardized commit messages unlock automatic changelogs, version bumps, and release notes. Here's the full setup — from writing commits to shipping releases without manual steps.
P.33eBPF lets you attach programs to any kernel hook — network packets, system calls, function calls — without patching the kernel or rebooting. Here's what application developers actually need to know.
P.34Tailscale creates a private mesh network across any combination of cloud servers, developer laptops, and office machines — without port forwarding, firewall rules, or dedicated VPN hardware.
P.35Multi-cloud gets pitched as the default choice for serious companies. The reality is more nuanced — and for most teams, the complexity cost is higher than the lock-in risk it's supposed to prevent.
P.36OpenTelemetry is the observability standard now. Most tutorials show you how to install the SDK and emit traces. Fewer explain which signals actually matter for web applications and which add noise without helping you debug anything.
P.37HPA scales on CPU and memory. But most production workloads don't scale well on those signals. KEDA, VPA, and Goldilocks fill the gaps that HPA leaves open.
P.38k6 is a developer-friendly load testing tool with JavaScript scripting, CI integration, and clear metrics. Here's how to write meaningful load tests, interpret the results, and catch performance regressions before they reach production.
P.39CodeRabbit, GitHub Copilot code review, and similar tools have changed the first-pass review. Here's what they actually catch, where they fail, and the workflow that combines both effectively.
P.40From .env files to Vault to AWS Secrets Manager: a practical guide to storing credentials, API keys, and certificates without waking up to a breach notification.
P.41Site reliability engineering was designed for teams of hundreds. Most of its principles translate directly to teams of 5. Here is what a practical incident response process looks like when nobody has 'SRE' in their title.
P.42Leaked credentials are the most preventable category of security breach. Here is an honest look at when you need a dedicated secrets manager, which tool to pick, and what to do if you're still on .env files.
P.43Service meshes promise secure, observable microservice communication. But most teams that adopt one do so before they need it. Here is how to decide, and what each option actually costs you.
P.44Running containers in production without scanning them is the equivalent of shipping code without running tests. Here's how teams scan images, generate SBOMs, and add runtime protection, from the CI step to the cluster.
P.45Most teams treat their CI pipeline as a black box that occasionally fails. A few hours of optimization can cut your CI time by 40-60% and your GitHub Actions bill by a similar margin. Here's exactly how to do it.
P.46HashiCorp moved Terraform to a Business Source License in August 2023. OpenTofu forked it under the MPL. Pulumi took a different path entirely. Two and a half years on, the dust has settled enough to make a clear-headed choice.
P.47Data-driven analysis of platform engineering adoption in 2026. Compare Backstage, Port, and Cortex IDPs, golden paths, self-service infrastructure, and how to measure platform success with DORA metrics.
P.48EditorPickEveryone said WebAssembly would kill Docker. Two years later, they coexist — and the teams using both are shipping faster. A reality check on Wasm, containers, and the containerd shim approach.
P.49Trunk-based, Git Flow, GitHub Flow — we have tried them all. Here is the simple Git workflow that works for teams under 10 and the mistakes to avoid.
P.50GitOps adoption hit 64% in 2025, and the next evolution is integrating real-time cost visibility into every infrastructure pull request. We break down why GitOps plus FinOps is the operational model serious teams are adopting in 2026.
P.51Monorepos are mainstream, but choosing between Turborepo, Nx, and pnpm workspaces is confusing. Here's a practical guide to picking the right tool for your team.
P.52Most agencies disappear after deployment. Here is our exact 90-day post-launch process — from day-one monitoring to month-three handoff — with the checklists, tools, and escalation paths we use for every project.