Tag
50 articles tagged #DevOps.
P.01A compromised maintainer account on August 4 turned keyv and cacheable into a self-propagating npm worm that stole cloud, CI, and GitHub credentials from packages with tens of millions of weekly downloads. Here's what happened and how to check if you were hit.
P.02A deserialization flaw in TeamCity's agent polling protocol lets an attacker with no credentials run commands as the build server. CISA confirmed active exploitation on August 5. Here's what's affected and how to patch it.
P.03Researchers at Black Hat USA 2026 showed how an untrusted GitHub issue reached CI runner secrets in Claude Code, Gemini CLI, and OpenAI Codex. Gemini CLI's flaw scored a perfect 10.0 CVSS. Here's what happened and how to check your own pipelines.
P.04A single checkout request might touch five services and nobody can say which one is slow. Distributed tracing fixes that by tagging every hop with one trace ID. Here's how spans, trace IDs, and context propagation actually work, with OpenTelemetry examples.
P.05An SLA is a promise with a penalty. An SLO is the internal target that keeps you inside that promise. An error budget is what's left before you breach it. Here's how the three fit together, with the math worked through on a real example.
P.06A one-line control-flow change meant to patch CVE-2026-29146 quietly broke Tomcat's cluster encryption instead. CISA confirmed active exploitation on August 4 and set an August 7 remediation deadline. Here's what happened and what to patch.
P.07Four different philosophies for the same problem: getting a database schema from what it is to what it should be, safely, in a team. Here's how Flyway, Liquibase, Prisma Migrate, and Atlas actually differ, and which one fits your stack.
P.08A 3-hour-33-minute CloudFront VPC Origins failure on July 16, 2026 knocked out at least ten unrelated services worldwide. The root cause was a single-ingress design decision, and it's a pattern worth checking your own architecture for.
P.09Kubernetes 1.36 shipped 70 enhancements with no headline rewrite, just years of accumulated work reaching stable. Here's what actually changes for platform teams, and what's safe to skip for now.
P.10Enforcement of actions/checkout's new pull_request_target protections landed July 20, 2026, closing the exact hole the AsyncAPI attack used six days earlier. Here's what changed, who needs to act, and how to check your own workflows.
P.11A unit-pricing bug in AWS's billing estimate subsystem sent some customers cost projections in the billions and trillions on July 16. Invoices were unaffected, but automation wired to those estimates wasn't. What happened, and how to build cost alerting that fails safely.
P.12npm's trusted publishing lets GitHub Actions and GitLab CI publish packages via short-lived OIDC tokens instead of a long-lived npm token in your CI secrets. Here's the exact setup and what changed in the May 2026 config update.
P.13A hacker claimed to steal 35GB from Accenture in July 2026, including source code, RSA and SSH keys, and Azure access tokens. The source code isn't the risk. The credentials filed next to it are. Here's the audit worth running on your own repos this week.
P.14Platform engineering has its own hiring cluster now, distinct from DevOps, SRE, and cloud architecture. Here's how to define the role correctly, screen candidates for product thinking over ticket-taking, and avoid paying platform-engineer money for ops-with-a-new-title.
P.15npm v12, shipped July 8, 2026, blocks preinstall/install/postinstall scripts, Git dependencies, and remote tarball installs unless you explicitly allow them. Here's what breaks, why it's happening now, and the exact commands to migrate a real project.
P.16Chaos engineering means deliberately injecting failure into a running system to find weaknesses before an outage does. Here's what it actually involves, what tools make it practical, and when a smaller team should and shouldn't bother.
P.17DevSecOps is a distinct discipline from DevOps and from security engineering. Here's what the role actually covers, what skills to screen for, and why supply chain security is now the core competency.
P.18Site Reliability Engineering is a specific discipline, not a synonym for DevOps. Here is how to define the role correctly, screen for the right skills, and avoid hiring an ops generalist and calling them an SRE.
P.19Both tools keep your dependencies current automatically. Here is how they actually differ, where each one breaks down, and which to choose based on your team's setup.
P.20The 'DevOps engineer' title now covers three distinct jobs: platform engineer, SRE, and CI/CD specialist. Here's what each role actually does, what to screen for, and what the market pays.
P.21A practical guide to setting up metrics collection with Prometheus and visualization with Grafana for backend services — what to instrument, what to skip, and what the dashboards should actually show.
P.22Dev Containers let you define your entire development environment in a JSON file. New team members are productive in minutes, not days. Here's how to set them up properly.
P.23Vulnerability scanning catches known CVEs in your base images and dependencies before they reach production. Here's how to set up Trivy and Snyk, understand their output, and act on what they find.
P.24A bloated Docker image costs you in pull times, storage fees, and attack surface. Here's how to build images that are small, fast to rebuild, and genuinely production-ready.
P.25The fear of vendor lock-in leads to over-engineering. Here's a practical framework for deciding when to abstract cloud dependencies and when accepting lock-in is the right call.
P.26Vercel dominates frontend hosting. AWS dominates enterprise infrastructure. Between those two extremes, Fly.io and Railway are the most practical choices for backend-heavy full-stack apps in 2026.
P.27Git worktrees let you have multiple branches checked out simultaneously in separate directories. No stashing, no context switching, no 'just a second while I save my work.'
P.28Blue-green and canary deployments give you a way to release software without taking down your service or discovering a bug when it's already affecting everyone. Here's how they work and when to use each.
P.29Standardized commit messages unlock automatic changelogs, version bumps, and release notes. Here's the full setup — from writing commits to shipping releases without manual steps.
P.30eBPF lets you attach programs to any kernel hook — network packets, system calls, function calls — without patching the kernel or rebooting. Here's what application developers actually need to know.
P.31Tailscale creates a private mesh network across any combination of cloud servers, developer laptops, and office machines — without port forwarding, firewall rules, or dedicated VPN hardware.
P.32Multi-cloud gets pitched as the default choice for serious companies. The reality is more nuanced — and for most teams, the complexity cost is higher than the lock-in risk it's supposed to prevent.
P.33A practical guide to transactional email for web apps in 2026 — comparing Resend, Amazon SES, and SendGrid, with a focus on SPF/DKIM/DMARC setup and the common deliverability mistakes teams make.
P.34OpenTelemetry is the observability standard now. Most tutorials show you how to install the SDK and emit traces. Fewer explain which signals actually matter for web applications and which add noise without helping you debug anything.
P.35HPA scales on CPU and memory. But most production workloads don't scale well on those signals. KEDA, VPA, and Goldilocks fill the gaps that HPA leaves open.
P.36k6 is a developer-friendly load testing tool with JavaScript scripting, CI integration, and clear metrics. Here's how to write meaningful load tests, interpret the results, and catch performance regressions before they reach production.
P.37CodeRabbit, GitHub Copilot code review, and similar tools have changed the first-pass review. Here's what they actually catch, where they fail, and the workflow that combines both effectively.
P.38From .env files to Vault to AWS Secrets Manager: a practical guide to storing credentials, API keys, and certificates without waking up to a breach notification.
P.39Site reliability engineering was designed for teams of hundreds. Most of its principles translate directly to teams of 5. Here is what a practical incident response process looks like when nobody has 'SRE' in their title.
P.40Leaked credentials are the most preventable category of security breach. Here is an honest look at when you need a dedicated secrets manager, which tool to pick, and what to do if you're still on .env files.
P.41Service meshes promise secure, observable microservice communication. But most teams that adopt one do so before they need it. Here is how to decide, and what each option actually costs you.
P.42Running containers in production without scanning them is the equivalent of shipping code without running tests. Here's how teams scan images, generate SBOMs, and add runtime protection, from the CI step to the cluster.
P.43Most teams treat their CI pipeline as a black box that occasionally fails. A few hours of optimization can cut your CI time by 40-60% and your GitHub Actions bill by a similar margin. Here's exactly how to do it.
P.44HashiCorp moved Terraform to a Business Source License in August 2023. OpenTofu forked it under the MPL. Pulumi took a different path entirely. Two and a half years on, the dust has settled enough to make a clear-headed choice.
P.45Data-driven analysis of platform engineering adoption in 2026. Compare Backstage, Port, and Cortex IDPs, golden paths, self-service infrastructure, and how to measure platform success with DORA metrics.
P.46EditorPickEveryone said WebAssembly would kill Docker. Two years later, they coexist — and the teams using both are shipping faster. A reality check on Wasm, containers, and the containerd shim approach.
P.47Trunk-based, Git Flow, GitHub Flow — we have tried them all. Here is the simple Git workflow that works for teams under 10 and the mistakes to avoid.
P.48GitOps adoption hit 64% in 2025, and the next evolution is integrating real-time cost visibility into every infrastructure pull request. We break down why GitOps plus FinOps is the operational model serious teams are adopting in 2026.
P.49Monorepos are mainstream, but choosing between Turborepo, Nx, and pnpm workspaces is confusing. Here's a practical guide to picking the right tool for your team.
P.50Most agencies disappear after deployment. Here is our exact 90-day post-launch process — from day-one monitoring to month-three handoff — with the checklists, tools, and escalation paths we use for every project.