DevOpsarticles
Infrastructure, deployments, observability, and the operational practices that keep systems running. 95 articles and counting.
How Terraform Works Internally: HCL Parsing, Dependency Graph Execution, and the Provider Protocol Behind Infrastructure as Code
A deep dive into Terraform's internal architecture covering HCL parsing, the expression evaluation engine, DAG-based dependency resolution, the gRPC provider plugin protocol, state mechanics, and the plan/apply lifecycle.
How Docker Works Internally: Namespaces, Cgroups, Union Filesystems, and the OCI Runtime Behind Every Container
A deep dive into what happens when you run docker run: Linux namespaces for process isolation, cgroups v2 for resource enforcement, overlay2 union filesystem for layered images, the OCI runtime spec and how runc spawns containers, content-addressable storage, the containerd shim architecture, and networking with veth pairs.
How Kubernetes Works: Pods, Scheduling, and the Reconciliation Loop
A deep dive into Kubernetes internals covering the control plane architecture, etcd watch mechanics, the scheduler's filter and score phases, controller manager reconciliation loops, kubelet pod assignment, the CRI and CNI plugin models, and production considerations for resource requests, pod disruption budgets, and cluster autoscaler behavior.
How Docker Works: Namespaces, Cgroups, Union Filesystems, and the Container Runtime from Build to Execution
A deep dive into Docker internals covering Linux namespace isolation, cgroup resource constraints, OverlayFS copy-on-write layer mechanics, Dockerfile build cache invalidation rules, the containerd and runc OCI runtime stack, and production considerations for image hardening and startup latency.
How Containers Actually Work: Namespaces, Cgroups, and the Linux Primitives Behind Docker
A deep dive into the Linux kernel primitives that make containers possible: PID, network, and mount namespaces for isolation, cgroups v2 for resource enforcement, union filesystems for layered images, and how to debug resource limit failures in Kubernetes production workloads.
AI-Assisted Development Workflows in Production: Integrating Coding Agents, Automated Review, and Human Oversight Into Your SDLC
How engineering teams are restructuring their SDLC around AI coding agents: workflow patterns, CI/CD pipeline changes, effectiveness metrics, team structure shifts, and production guardrails that actually work.
AI FinOps for Engineering Teams: Cost Observability, Budget Enforcement, and Runaway Detection for LLM Infrastructure
How engineering teams build cost governance for AI infrastructure, covering per-team token budget enforcement, real-time cost dashboards, rogue agent detection, shadow AI spend, zombie resource cleanup, and multi-model billing consolidation.
MCP Security in Production: Protocol Vulnerabilities, Tenant Isolation Patterns, and Hardening AI Agent Tool Connections
66% of MCP servers have code smells and 14.4% contain bug patterns. Asana's tenant isolation flaw hit 1,000+ enterprises. This is what the MCP attack surface actually looks like and how to harden it.
Securing Your AI Supply Chain: How a Trusted Library Compromised a $10 Billion Startup and What It Means for Your Stack
The Mercor/LiteLLM incident exposed a class of vulnerability most engineering teams have not yet addressed: AI-specific dependency risk. This article covers dependency pinning, SBOM generation, automated vulnerability scanning in CI/CD, and the practical controls that would have caught the attack before it reached production.
Securing Agentic AI in Production: Permission Scoping, M2M Traffic Monitoring, and Preventing the Next Kiro-Style Outage
47% of organizations have delayed AI agent releases due to API security concerns. This guide covers the concrete engineering patterns that fix the problem: permission scope boundaries, M2M traffic observability, and human approval gates for high-risk agent actions.
EU AI Act Compliance for Engineering Teams: Risk Classification, Technical Documentation, and Building Audit-Ready AI Systems Before August 2026
A practical engineering guide to EU AI Act compliance before the August 2, 2026 enforcement deadline. Covers risk classification, Annex IV technical documentation, logging architecture for agent decisions, human oversight patterns, and a realistic timeline for teams starting now.
Nix for Development Environments: Flakes, Dev Shells, and Reproducible Builds That Eliminate Configuration Drift
Docker dev containers and asdf get you close to reproducibility, but not all the way. Nix flakes close the remaining gap: exact package versions, hermetic builds, and per-project toolchains that activate automatically. This guide covers flake.nix structure, devShells, direnv integration, CI parity, overlays, and the real downsides before you commit.