Blog
Technical notes on infrastructure, backend and AI
Practical content on infrastructure, backend and AI systems, based on real projects.
Get new articles by email
One email when a new article on infrastructure, backend and AI is published. No spam, unsubscribe anytime.
Agent Substrate, gVisor and OpenRL at CNCF: governance and agent platform adoption
What the Agent Substrate, gVisor and OpenRL donation to CNCF means for agent platform governance, portability, security and production adoption.
Agent Substrate, gVisor, and OpenRL: a cloud-native agent architecture
Explore how Agent Substrate, gVisor, and OpenRL fit together through execution contracts, trusted evaluation, security, and Kubernetes operations.
OpenKruise Agents: managing agent sandboxes on Kubernetes
Explore OpenKruise Agents, SandboxSet, SandboxClaim and warm pools, with Kubernetes examples and production guidance on security, observability and reliability.
How to Evaluate AI Agent Isolation on Kubernetes
Evaluate AI agent isolation on Kubernetes through runtime, identity, network, data and resource tests, with independent evidence and release criteria.
LLMJacking: how compromised credentials drive unexpected LLM costs
Understand LLMJacking and protect LLM spending with IAM, EKS workload identity, financial admission controls, observability, and incident response.
How to evaluate an AI traffic proxy with policies and sensitive data redaction
Evaluate AI proxies with policy enforcement, sensitive data redaction, streaming tests, tenant isolation, observability, and safe Kubernetes operations.
Getting started with OpenTelemetry eBPF Instrumentation on Linux
Instrument Linux services with OpenTelemetry eBPF Instrumentation: an OTLP lab, Kubernetes canary, security controls, troubleshooting, and production operations.
How to size Kubernetes networking for ephemeral AI agent sandboxes
Plan Kubernetes IP capacity, DNS, connections, and egress for ephemeral AI agent sandboxes, with sizing calculations, isolation guidance, and NetworkPolicy examples.
Designing ephemeral sandboxes for AI agents on Kubernetes
Design ephemeral Kubernetes sandboxes for AI agents with runtime isolation, network controls, bounded Jobs, reliable cleanup, and production observability.
OTTL v1 in practice: transforming traces, metrics, and logs in the Collector
Transform traces, metrics, and logs with OTTL v1 in the OpenTelemetry Collector, with practical YAML, testing, Kubernetes, security, and rollback guidance.
Kamaji and HAMi: testing multi-tenant Kubernetes for GPU workloads
Build a Kamaji and HAMi lab to validate multi-tenant Kubernetes, GPU sharing, isolation, quotas, performance, and failure recovery before production.
Kyverno v1.19.2: a practical roadmap for evaluating and upgrading clusters
Plan a Kyverno v1.19.2 upgrade with security review, Kubernetes compatibility checks, CRD ownership, policy tests, Helm deployment and controlled rollback.
llm-d 1.0 lab: distributed inference on Kubernetes and production readiness for agents
Build an llm-d 1.0 Kubernetes lab and evaluate routing, KV caching, availability, security, and cost before running agent workloads in production.
Graviton or x86 on EKS: when moving to arm64 pays off
How to decide between Graviton (arm64) and x86 instances on EKS: the savings AWS advertises, what usually blocks the move, how to run a canary with Karpenter, and how to measure the real gain per request.
Savings Plans or Reserved Instances: which one for your EKS cluster
The practical differences between Compute Savings Plans, EC2 Instance Savings Plans and Reserved Instances (Standard and Convertible), when each fits with Karpenter and Spot, and the mistakes that leave commitment unused.
TorchTPU in practice: running PyTorch on TPUs and evaluating migration
Explore TorchTPU, its differences from PyTorch/XLA and CUDA, and how to assess compatibility, performance, cost, and Kubernetes operations.
Hidden EKS costs: NAT Gateway, cross-AZ traffic and forgotten EBS volumes
Where the items that most surprise people on an EKS bill come from, how to find each one in Cost Explorer and what to fix first: S3 and ECR endpoints, topology-aware routing and volume cleanup.
Which workloads in your cluster can run on Graviton? An open source tool to find out
graviton-readiness reads manifests and the images in the registry and tells which Kubernetes workloads can run on Graviton (arm64) nodes and what blocks the rest. See the rules, the image check and the limits.
Karpenter or Cluster Autoscaler: which to use on your EKS cluster
How each node autoscaler decides, where they differ on Spot, consolidation and governance, when to keep Cluster Autoscaler and a safe path to migrate to Karpenter.
Practical MCP server security checklist: exposure, authentication, and trust boundaries
Secure MCP servers with exposure controls, OAuth, per-tool authorization, Kubernetes isolation, and practical tests of application trust boundaries.
Requests, limits and PodDisruptionBudget: how to read a Kubernetes manifest without fooling yourself
What each field really does, how requests drive cost and scheduling, why a badly written PDB blocks upgrades or protects nothing, and how to check all of it in your manifests.
Are your CPU and memory requests inflated? An open source tool to find out
rightsizing-check compares the requests in your manifests with observed usage, from files or straight from Prometheus, and tells you what to set instead. See how to get the usage, the rules, the recommendation and the limits.
Spot or Savings Plans on Kubernetes: how to combine them without wasting commitment
What each AWS pricing model covers, why Savings Plans do not apply to Spot, the order to follow (right-size, commit the base, Spot on the elastic part) and the mistakes that leave commitment unused.
LangGraph and PostgreSQL: testing recovery and controlling checkpoint growth
Test LangGraph recovery after crashes and interrupts, verify idempotency, and manage PostgreSQL checkpoint growth with retention, monitoring, and safe maintenance.
Open-weight models on Google Cloud: architecture with llm-d, vLLM, and NVIDIA Dynamo
Explore how vLLM, llm-d, and NVIDIA Dynamo reshape Google Cloud inference with GKE, KV caching, prefill/decode separation, security, reliability, and cost control.
GKE runtime security with Wiz: evaluating the eBPF sensor on Standard and Autopilot
Evaluate the managed Wiz Runtime Sensor on GKE Standard and Autopilot: eBPF coverage, deployment, credentials, performance, costs, and rollback.
Temporal on Cloud Run: architecture and criteria for on-demand workers
Design reliable Temporal workers on Cloud Run with Worker Pools, scale-to-zero, retries, security, and practical production deployment criteria.
AI FinOps in BigQuery: control generative function costs with daily token quotas
Configure daily BigQuery token quotas, estimate generative function costs, and build production controls for usage, observability, and failure recovery.
AWS Lambda Web Functions in practice: a Hono API, latency and cost
Deploy a Hono HTTP API on AWS Lambda Web Functions and evaluate concurrency, cold starts, latency, observability, security, rollback and execution costs.
Which workloads in your cluster can run on Spot? An open source tool to find out
spot-readiness reads manifests or your cluster and tells which Kubernetes workloads tolerate Spot, what to fix first and in what order. See the rules, the plan, the limits and a real case.
kagent laptop lab: create, run, and validate an agent
Explore kagent on local Kubernetes, create and run an agent, and capture evidence while separating verified documentation from untested execution results.
Karpenter v1.15.0 in practice: VPA prediction, disruption and provisioning
Understand the actual state of VPA prediction in Karpenter v1.15.0, disruption metrics, provisioning changes and practical safeguards for production upgrades.
Designing AI agents for security operations: evidence, inference, and recommendations
Design AI agents for security operations with traceable evidence, verifiable inference, controlled recommendations, and Kubernetes isolation.
Argo CD v3.5.4: security assessment and upgrade planning checklist
Assess the critical Argo CD v3.5.4 fixes, including the Kustomize remote-reference vulnerability, and plan testing, backup, upgrade, and safe recovery.
How to prepare vulnerability disclosure for AI-generated or AI-assisted reports
How to receive, triage and reproduce AI-generated or AI-assisted vulnerability reports: policy, security.txt, report template, an isolated GKE lab with gVisor, observability and costs.
Amazon EKS 1.37 upgrade guide: checklist, testing and safe rollback
How to upgrade Amazon EKS from 1.36 to 1.37 in production: Upgrade Insights, version skew, backup, bake period, node groups, add-ons, Rollback Readiness and rollback strategies.
OpenClaw Control Plane on Kubernetes: installation, architecture and topologies
How to install and understand the OpenClaw Control Plane on Kubernetes: reconciliation, Compute Drivers, AgentRevision, Agent isolation, node pools, NetworkPolicy, observability and topologies.
GKE Agent Sandbox for Reinforcement Learning: gVisor, warm pools and cold-starts
How to build a GKE Agent Sandbox for RL and AI agent workloads: dedicated node pools, gVisor, taints and tolerations, Gymnasium, OpenTelemetry observability and a cold-start comparison.
AI in DevOps: using Jev as a decision layer for pipelines, incidents and Kubernetes
How TypeSafe AI's System One model can classify pipeline failures, triage Kubernetes incidents and cut AI costs by deciding instead of generating text.
Cutting MTTR: building an AI agent for incident triage and automatic resolution
How an agent integrated with Slack and Datadog cut initial incident triage from minutes of log analysis down to seconds, saving the team 15h/week.
Technical engineering assessment: how to map risks and bottlenecks before they become incidents
A practical technical assessment methodology for infrastructure, backend and operations — what to review, how to prioritize, and what to deliver at the end.
Karpenter: how to cut Kubernetes costs without sacrificing performance
How Karpenter provisions nodes based on real pod demand, with sample NodePool and EC2NodeClass, Spot, consolidation, troubleshooting and a production checklist.
From 1.2s to 180ms: how we refactored microservices to handle 4x more requests
The playbook used to diagnose concurrency bottlenecks and inefficient queries, cutting an API's average latency from 1.2s to 180ms without changing infrastructure.