95 articles tagged with "devops"
GitHub-hosted runners are boring in the best way. Self-hosted runners promise speed, cache locality, and cheaper minutes — and quietly hand you a fleet to patch, secure, and babysit. Here's how to tell if the trade is actually worth it.
Node upgrades and cluster autoscaler scale-downs are supposed to be boring. Without a PodDisruptionBudget, Kubernetes is happy to evict every replica of your app at once to get there. Here's how PDBs actually work, where they quietly do nothing, and the mistakes that turn a routine drain into an incident.
A practical, no-nonsense checklist for auditing your AWS bill line by line — orphaned EBS volumes, zombie load balancers, NAT gateway tax, and the other quiet ways cloud spend creeps up on you.
We instrument every microservice with traces and dashboards, then treat the CI/CD pipeline that ships them as an unobservable black box you just \"re-run and hope.\" Here's how to bring the same rigor to your pipelines — and what changed once we did.
kubectl get postgresqlcluster feels like magic until you realize it's just a controller watching etcd in a loop and yelling reconcile at itself. Here's what a CRD and an operator actually are, why you'd build one, and the footguns that only show up after you do.
cluster-admin for everyone is not a permissions model, it's a liability with YAML syntax. Here's how to design Kubernetes RBAC that actually scopes access, survives an audit, and doesn't turn every incident into a game of 'who could have done this.'
A misconfigured retry loop, a forgotten dev environment, or a runaway Lambda can turn into a five-figure surprise before anyone notices. Here's how to catch it in hours instead of at month-end, with real tools and thresholds that actually work.
Turning on a default-deny NetworkPolicy is the easiest way to feel like a security hero for exactly four minutes, right before DNS stops resolving and your on-call phone starts screaming. Here's how to roll out network policies without setting your own pager on fire.
-v /var/run/docker.sock:/var/run/docker.sock is the most casually-copy-pasted line in every CI tutorial on the internet. It's also functionally a root grant to your host. Let's talk about why, and what to do instead.
AWS gives you two ways to pre-commit for a discount, and the console makes them look almost identical. They are not. Here's the difference that actually matters, and the mistake that costs teams real money.
\"Works on my machine\" isn't a joke, it's a confession that your local environment and production have quietly drifted apart. Here are the parity tricks that actually close the gap — and the ones that just feel productive while doing nothing.
A test that passes 9 times out of 10 isn't 90% reliable — it's 100% untrustworthy. Here's how to actually find your flaky tests, prove they're flaky instead of just suspecting it, and quarantine them without quietly deleting your safety net.
Every FROM line in your Dockerfile is a trust decision you probably made without thinking. Here's why 'it pulled and it ran' is not the same as 'it's safe', and how to actually clean up your base image habits.
Your container runs fine locally, then face-plants in prod with 'permission denied' on a volume mount that definitely exists. Welcome to the UID/GID gotcha club — where numbers, not names, decide who owns your files.
Staging is a lie everyone agrees to tell. Ephemeral preview environments spin up a full stack per pull request and tear it down on merge - here's how to build them without setting your cloud bill on fire.
Everyone name-drops the circuit breaker pattern in system design interviews. Far fewer have actually tuned one that survives contact with production. Here's what the tutorials skip: half-open state thrash, per-dependency breakers, and why a breaker with no fallback is just a fancier 500.
You've heard of Chaos Monkey. You do not have Netflix's infrastructure budget, on-call rotation, or risk appetite. Here's how to do real chaos engineering with a cron job, a `tc` command, and the nerve to run it in staging first.
The cloud bill isn't a finance problem that got outsourced to engineering. It's an engineering problem that finance is being blamed for. Here's how to think about cost like a system property, not a monthly surprise.
Your container isn't as isolated as you think. seccomp and AppArmor create a second wall between your app and the host kernel — here's how to actually use them before your next audit finds out you haven't.
A 503 page is not a resilience strategy. Learn how to design services that deliver reduced-but-real value when dependencies fail — fallback chains, stale caches, and the art of saying 'here's what I can still do.'
The gap between your laptop and production is where bugs hide in plain sight. Here are the tools and tricks I use at Cubet to keep local dev embarrassingly close to the real thing.
IAM policies control what identities can do — but SCPs control what's even possible. Here's why Service Control Policies are the most underused security tool in AWS Organizations, and how to actually use them.
Error budgets promised to reduce on-call stress. For most teams they just renamed the anxiety. Here's how to implement burn-rate alerting and budget-driven pushback so the budget protects engineers instead of just measuring them.
Infrastructure drift is the gap between what Terraform thinks exists and what's actually running in your cloud. Here's how to detect it, fix it, and stop it from biting you at 2 AM.
Your service is drowning in traffic. Most systems respond by slowing everyone down until nothing works. Load shedding flips the script — deliberately drop low-priority requests so high-priority ones keep flying.
Terraform state is the source of truth for your infrastructure. Corrupt it, race-condition it, or lose it — and you're in for a very bad day. Here's how to lock it, share it safely, and recover when things go sideways.
Hardcoded AWS credentials in Docker containers and .env files are a breach waiting to happen. Workload identity gives your services cloud access without a single long-lived key in sight.
Your 8-core VM is running at 3% CPU. Your Kubernetes pods are OOMKilled every Tuesday. Right-sizing fixes both — but only if you stop guessing and start measuring what your workloads actually need.
If your infra repo has a staging/ and prod/ folder with 95% identical Terraform code, you've already lost. Terragrunt fixes that — and a few other things Terraform makes surprisingly painful.
Every time you copy a .env file into a Docker image or run pip install with a private token, you're writing credentials into an immutable layer that anyone with docker history can read. Here's how BuildKit secrets actually fix this.
You wouldn't eat food without knowing what's in it. So why are you shipping software without a bill of materials? Here's how to generate an SBOM and actually use it before your own Log4Shell moment lands.
Your CI pipeline takes 12 minutes to install npm packages every single run. There's a better way — and it won't require a PhD in DevOps.
Your pod is running. Your app is 'fine'. Users are screaming. Sound familiar? Kubernetes liveness and readiness probes are the lie detectors your cluster desperately needs — here's how to use them before your on-call rotation becomes a horror movie.
Most Node.js apps die like a rude dinner guest — abruptly, mid-sentence, leaving a mess behind. Learn how to implement graceful shutdown so your server wraps up its work, says goodbye properly, and doesn't drop a single request.
Your Docker image weighs 2GB and takes 8 minutes to pull. Meanwhile, your actual app is 20MB. Multi-stage builds are the diet plan your containers desperately need.
Liveness, readiness, and startup probes are the unsung heroes of Kubernetes reliability — and also the source of some truly spectacular 3 AM incidents. Here's how to stop your cluster from killing healthy pods and serving traffic to broken ones.
Your Docker images are the size of a small planet, and you're shipping your build tools, dev dependencies, and maybe even your lunch to production. Multi-stage builds are the diet plan your containers desperately need.
Your Docker image is the size of a small country's GDP in bytes. Multi-stage builds are the diet plan it never knew it needed — and your CI pipeline will thank you.
The classic excuse that haunts every engineering team. Your laptop runs the app flawlessly; production explodes on deploy. Docker Compose is the cure — if you wire it up correctly. Let's build a local environment so tight that 'it works on my machine' becomes a flex, not an apology.
Your CI pipeline is downloading 847 npm packages on every single commit. There's a better way. Learn how GitHub Actions caching can slash your build times from 8 minutes to under 90 seconds.
GitHub Actions can go from a 20-minute flaky nightmare to a 3-minute green machine. Here are the tricks seasoned DevOps engineers don't always share.
Your server is like a surgeon mid-operation — you wouldn't yank the power cord. Learn how to implement graceful shutdown so Node.js finishes what it started before going offline.
Your Docker image is 2.4 GB. Production is crying. Your SRE is crying. The cloud bill is crying. Let's fix that with multi-stage builds — the single best Docker trick most developers skip.
Your Docker image is 1.4GB. Production doesn't need your node_modules, your compiler, or the entire Ubuntu kitchen sink. Here's how multi-stage builds shrink that to under 100MB — and make your team actually happy.
Your Docker image is 2GB and your app is 20MB. Something has gone terribly wrong. Learn how multi-stage builds let you build fat, ship thin, and stop embarrassing yourself in production.
Your Docker images are probably 10x bigger than they need to be. Multi-stage builds are the single easiest win in container optimization — and most developers skip them entirely. Here's how to fix that today.
GitHub Actions is the Swiss Army knife of CI/CD — and like a Swiss Army knife, most people only ever use the scissors. Here are the tips that'll transform your 20-minute pipelines into lean, mean, green-checkmark machines.
Your GitHub Actions pipelines are probably wasting half their time re-installing the same npm packages, re-building unchanged Docker layers, and running tests that have nothing to do with the files you touched. Let's fix that.
Your Docker images are carrying around build tools, dev dependencies, and half a Node.js ecosystem that your app never needs at runtime. Multi-stage builds are the diet your containers deserve.
Most Node.js apps crash-quit like a toddler flipping a table. Learn how to shut down gracefully — draining connections, finishing requests, and leaving no user behind.
Your Docker image is not a suitcase — you don't need to pack everything in it. Learn how multi-stage builds can slash your image size by 97%, speed up deployments, and make your ops team actually like you.
Your Docker image is 4GB. Production is crying. Your ops team has filed a formal complaint. Let's fix that with multi-stage builds — the Marie Kondo method of containerization.
Ever had a Kubernetes node go dark because one rogue pod decided it deserved ALL the memory? Resource requests and limits are the seatbelts of K8s — boring until they save your life. Here's how to actually set them correctly.
Your CI pipeline is slow, flaky, and secretly plotting against you. Here's how to make GitHub Actions fast, reliable, and maybe even fun — with real-world tips that'll save your sanity and your Friday afternoons.
Your Docker image shouldn't weigh more than a car. Learn how multi-stage builds slash image sizes from gigabytes to megabytes — and why your production container has no business knowing what a compiler is.
Your Docker image doesn't need a compiler, 47 dev dependencies, and the ghost of npm install past. Let's talk multi-stage builds and how they'll shrink your containers from \"moving truck\" to \"carry-on luggage\".
Your Docker image weighs 2GB but your actual app is 20MB. Sound familiar? Multi-stage builds are the diet plan your containers desperately need — no gym membership required.
Most Node.js apps get killed like a power cord yanked from the wall. Learn how to shut down gracefully so you stop dropping requests, corrupting data, and making your users sad.
Your Docker image shouldn't weigh more than your laptop. Learn how multi-stage builds can shrink 1.2GB bloated containers down to lean 80MB production images — and why your ops team will finally stop giving you the side-eye.
GitHub Actions is powerful, free-ish, and occasionally infuriating. Here are the tips that separate pipelines that just work from ones that page you at 2am every Friday.
You wouldn't pack your entire garage into your suitcase for a weekend trip. So why are you shipping compilers, dev dependencies, and build tools to production? Let's fix that with Docker multi-stage builds.
I once deployed a Node.js app with no resource limits to a shared cluster. It leaked memory overnight and took down 12 other services by 9 AM. Here's what I learned so you don't repeat my Monday morning.
Every time your CI pipeline reinstalls 847 npm packages from scratch, a DevOps engineer cries. Here's how to use GitHub Actions caching properly so your builds go from 12 minutes to 2.
Spent a whole Sunday debugging why 30% of user requests returned 502 errors — turns out our pods were 'Running' but completely brain-dead. Kubernetes health probes would have caught it in seconds. Here's everything I wish I'd known.
Your Docker images are probably enormous, and you don't even know why. Multi-stage builds are the diet plan your containers desperately need — cut image size by 90%, ship faster, and stop embarrassing yourself in production.
Every time you SIGKILL your Node.js server, someone's request dies mid-flight. Learn how to shut down gracefully so your users never notice the lights going out.
Your CI pipeline shouldn't feel like waiting for a dial-up modem. Learn how GitHub Actions caching can slash build times from minutes to seconds — with real configs you can steal today.
Your pod says it's Running. Your users say the app is down. Kubernetes probes are the lie detector your cluster desperately needs — here's how to wire them up correctly.
Skipping resource limits in Kubernetes is like driving without a seatbelt — fine until it isn't. I learned this the hard way when one rogue pod starved the entire cluster at 2 AM. Here's what I wish I knew sooner.
Your pod keeps dying with OOMKilled and you have no idea why? After getting paged at 3 AM more times than I care to admit, I learned that Kubernetes resource limits aren't optional — they're the difference between a stable cluster and a cascading meltdown.
I used to maintain 47 nearly-identical Kubernetes YAML files across dev, staging, and prod. One typo in the wrong file caused a 4-hour outage. Then I discovered Helm — and my Kubernetes configs finally became manageable.
Your GitHub Actions pipeline taking 20 minutes to deploy a one-line change? Yeah, we've all been there. Here's how to stop the bleeding.
Most Node.js apps shut down like a drunk person falling off a barstool — sudden, messy, and leaving a trail of dropped requests behind. Graceful shutdown is the cure.
CI/CD pipelines are supposed to make your life easier. So why does every team have at least one war story about a 3am deployment gone wrong? Here are the real-world lessons that will save your weekends.
Your logs are a crime scene — and right now they read like a toddler's diary. Let's fix that with structured logging in Node.js so you can actually debug production without losing your mind.
Your Kubernetes pod crashed but it's still getting requests? After watching production apps silently die while Kubernetes kept routing traffic to them, I finally understood liveness and readiness probes - and you need them too.
Your GitHub Actions workflows are slow, expensive, and secretly judging you. Here's how to cut build times in half with caching, smart triggers, and a few tricks your team probably doesn't know yet.
Your Docker image shouldn't weigh more than a car. Learn how multi-stage builds let you ship lean, mean containers without the build-time baggage — no PhD in Dockerfile sorcery required.
Your Docker images are probably way too fat. Learn how multi-stage builds let you compile, test, and ship lean production images — without the 2GB bloat that comes from dragging your build tools into production.
Your pods are vanishing into thin air, your logs say OOMKilled, and your on-call rotation is a nightmare. Let's fix that — with resource limits you'll actually understand.
Your cluster is running slow, nodes are OOMKilled at 3am, and nobody knows why. Spoiler: it's your pods with no resource limits set. Here's how to fix it before your on-call rotation turns into a nightmare.
Your Docker image is 2GB and you're shipping a Node.js app. Something has gone terribly wrong. Multi-stage builds are the cure — let's shrink that beast down to something you'd actually want to run in production.
Your Docker images are bloated, slow, and carrying more baggage than a European backpacker. Multi-stage builds are here to put your containers on a diet — without the suffering.
One carefully crafted string can bring your Node.js server to its knees for minutes. Regular Expression Denial of Service is the vulnerability hiding in your validation logic — and it's embarrassingly easy to trigger.
Shipping a 2GB Docker image to production because it has the full Node.js dev toolchain, test runners, and your lunch order from 2019 is not a personality. Multi-stage builds are here to save you from yourself.
Stop treating GitHub Actions like a black box. Here are battle-tested tips that'll turn your pipelines from spaghetti workflows into lean, mean, CI/CD machines.
You deleted that .env file three commits ago. You think you're safe. You are not. Let's talk about why git never forgets, how attackers find your secrets in seconds, and how to actually fix it.
Your Docker image doesn't need gcc, npm, and the entire internet to run a Node.js app. Multi-stage builds let you build fat, ship lean — here's how to stop deploying a 1.2GB monster when 80MB will do.
Most Node.js apps get SIGTERM'd and just... die. Mid-request. Mid-transaction. Mid-chaos. Here's how to shut down like a professional — finishing what you started before turning off the lights.
Your Docker image doesn't need gcc, npm, and three years of build cache to run a Node.js app in production. Multi-stage builds let you keep the build mess out of your final image — here's how to actually use them.
Your CI pipeline shouldn't take longer to run than your morning coffee break. Learn the GitHub Actions caching tricks that cut build times from 12 minutes to under 2 — and keep your team (and your wallet) happy.
Your Docker images are bloated, your attack surface is massive, and your CI pipeline cries every time it pushes 2GB to a registry. Multi-stage builds are the cure — and they're easier than you think.
Skipped setting resource requests and limits? Your cluster is a ticking time bomb. After watching production nodes get OOM-killed at 3am, I learned the hard way - here's how to set sane limits before your pods eat each other alive.
Your Docker images are too fat. Like, embarrassingly fat. We're talking 1.2GB images to serve a 'Hello World' endpoint fat. Multi-stage builds are the diet plan your containers desperately need.
Your Docker images are too fat. Like, embarrassingly fat. Let's fix that with multi-stage builds and shrink those containers from gigabytes down to megabytes.