Tools & systems, tested in practice.
Practical DevOps guides and honest reviews of the tools, software and gear I use. What works, what gets in the way, and what I learned.
UGREEN Uno Qi2 charger — a little robot with a useful job
A playful robot design, magnetic phone charging and a place for your earbuds. The UGREEN Uno makes an everyday accessory more interesting. My rating: 8/10.
Yamaha RX-V683 — an Atmos receiver with room to grow
Dolby Atmos, sensible calibration and a generous range of connections. A capable foundation for a home cinema, with some older HDMI limits to keep in mind. My rating: 8/10.
Bose SoundTouch 20 — a compact speaker with lasting appeal
Room-filling music, a compact design and controls that make sense. The SoundTouch 20 earns my 9/10, even as its software platform moves into a different chapter.
Building an internal developer platform without a big team
You don't need fifty engineers to build a platform. You need one good golden path.
I set up Backstage. Here's what happened
A software catalog, a template and docs in one place. And the parts nobody warns you about.
A fresh environment for every pull request
Shared staging slows everyone down. Preview environments fix that, if you control the cost.
Kubernetes as a control plane for everything: Crossplane v2
What if developers could order a database the same way they deploy an app?
AI agents in my pipeline: what actually works
Agents that fix builds and open pull requests are real now. Here's how I let them in, safely.
Can AI help at 3 a.m.? AI in incident response
AI can read logs faster than me. But who decides whether to roll back?
From a container to Kubernetes: serving models for real
Next step in my MLOps journey: running models on Kubernetes, with GPUs and autoscaling.
I asked AI to write my Terraform. A reality check
Looks right, runs fine, and opens your database to the world. What linters catch that AI doesn't.
Watching an AI app in production
Next in my MLOps journey: tracing prompts, tokens, cost and quality.
Scaling on Kubernetes: HPA, VPA, KEDA and Karpenter
Four autoscalers, each with its own job. When to use which, and how they work together.
Requests and limits: the settings everyone gets wrong
Why your pod got killed, why it's slow, and whether CPU limits are a good idea at all.
Kubernetes errors I see every week, and how I fix them
CrashLoopBackOff, ImagePullBackOff, Pending. A practical fix list, with a cheat sheet.
Smaller, safer container images
Your image is probably ten times bigger than it needs to be. How I shrink and harden mine.
Kubernetes at home: Talos, k3s and a homelab
A small cluster on cheap hardware, and what it teaches you about production.
Locking down GitHub Actions after real attacks
One compromised action leaked secrets from thousands of repos. What I changed in mine.
My CI/CD pipeline, from commit to production
Build, test, scan, deploy, verify. A complete pipeline you can copy.
Releasing without fear: canary, blue-green and feature flags
Ship to 5% first, watch, then decide. How progressive delivery works.
Faster CI pipelines: from 40 minutes to 8
The caching, splitting and runner tricks that make the biggest difference.
Pipelines in real code with Dagger
Tired of YAML that only works in CI? Write your pipeline in Go or Python and run it anywhere.
Database changes that don't break deployments
Code rolls back easily. Databases don't. How to change schemas safely.
Version numbers and changelogs on autopilot
Let commit messages decide the version and write the changelog.
Keeping dependencies up to date without the pain
Renovate and Dependabot can update everything. The setup that keeps it calm.
How I structure Terraform projects
Modules, environments and state, organised so the next person can understand them.
Testing infrastructure code
We test application code. Why not infrastructure? The tools and the trade-offs.
Pulumi, Terraform or CDK?
The same infrastructure written three ways, and what I learned.
Someone clicked in the console: fixing drift
When reality doesn't match your code. How to find drift, and stop it happening.
Terraform state, explained
The file that knows everything about your infrastructure, and how to keep it safe.
Terraform in CI: plan on PR, apply on merge
Stop running Terraform from laptops. How I automated it.
Terraform modules others actually want to use
Reusable, documented, versioned, and not over-engineered.
Servers you never patch: golden images with Packer
Replace servers instead of fixing them. How immutable infrastructure works.
Stop putting secrets in CI variables
Vault, OpenBao and External Secrets: where secrets should really live.
Security in the pipeline, not after it
Scanning code, dependencies and images on every commit, without annoying developers.
My Kubernetes security checklist
RBAC, network policies, runtime security. The settings I check on every cluster.
Rules as code: OPA, Kyverno and built-in policies
No more "please don't use the latest tag" in the wiki. Enforce it automatically.
Audits without screenshots: compliance as code
Turning SOC 2 and ISO 27001 controls into automatic checks.
OpenTelemetry from the ground up
Traces, metrics and logs with one standard, and no vendor lock-in.
A monitoring stack with Prometheus 3 and Grafana
What's new in Prometheus 3, and the stack I'd set up today.
When the monitoring bill beats the server bill
How to cut observability costs without flying blind.
Where should logs live? Loki, Elasticsearch or ClickHouse
Three ways to store logs, with very different bills.
Breaking things on purpose: chaos engineering
The best time to find a weakness is before your users do.
Profiling in production: where the CPU actually goes
Metrics say something is slow. Profiles say why.
Cutting the cloud bill by a third
The quick wins and long-term habits that make a cloud bill smaller.
What does each team's Kubernetes cost?
OpenCost and Kubecost answer the question finance keeps asking.
When a region goes down: disaster recovery that works
A backup you've never restored is just hope. How to plan and test recovery.
Why one AWS account isn't enough
Landing zones and multi-account setups, explained.
The Linux commands I use every day
The short list that covers most of my troubleshooting, plus a cheat sheet.
Networking basics every DevOps engineer needs
DNS, TLS, load balancers and subnets, explained the way I wish someone had explained them to me.
Bash scripts that don't surprise you
The habits that make shell scripts safe, and when to switch to Python.
Python for everyday automation
Small Python tools that save hours, from cloud cleanup to Kubernetes reports.
HTTPS on autopilot with cert-manager
Certificate lifetimes are getting shorter. Automation is no longer optional.
It's always DNS
Why DNS breaks so much, and how to make it break less.
Git tricks that saved me
Rebase, bisect, reflog. The commands that get you out of trouble.
"Works on my machine," solved with Nix?
Reproducible environments for everyone on the team.
Docs and runbooks people actually read
Docs-as-code, runbooks and decision records that stay up to date.
iPhone Air, one year later
Sleek, sturdy without a case, and a battery that lasts exactly one day. My verdict after a year.
Samsung HW-Q995GF, six months later
Awesome, immersive Atmos sound for movies, gaming and music. Heavy, but worth it.
Samsung Odyssey G7 37", six months later
Sharp 4K, a perfect curve and vivid HDR for gaming and editing. Just not enough ports.
Insta360 Link 2, six months later
A 4K gimbal webcam with AI tracking and great mics. The best webcam I've used.
Canon EOS 4000D
The entry-level DSLR I learned photography on. Who it's for, and when to move on.
Nikon Z5
Full-frame mirrorless for portraits and low light.