02 / writing
Notes from the platform
22 posts on cloud cost, Kubernetes, CI/CD and the things I learned breaking production so you don't have to.
featured / 3
★ featured · awsAug 26, 2026
Stop Using 0.0.0.0/0 in Your Security Groups
Open-to-the-world rules are a lazy security shortcut that leads to inevitable data exfiltration. Here is how to lock down your VPC traffic effectively.
AWSSecurity+88 min read
★ featured · backendAug 25, 2026
Stop Allowing PostgreSQL Connections to Balloon
Unbounded connection pools are a silent killer; here is how to use PgBouncer to prevent your database from buckling under a sudden spike in traffic.
postgresqlpgbouncer+99 min read
★ featured · kubernetesAug 10, 2026
Stop Over-Provisioning Your K8s Requests and Limits
If you aren't measuring actual container utilization, you’re burning 40% of your cloud budget on idle CPU and RAM. Here is how to stop the waste.
8 min read
all posts / 22
Sep 5, 2026Stop Using nodeSelector for Node PlacementStop hardcoding infrastructure layouts in your manifests. It creates brittle clusters that fail to scale when your instance types change.kubernetes7 min readAug 26, 2026★ Stop Using 0.0.0.0/0 in Your Security GroupsOpen-to-the-world rules are a lazy security shortcut that leads to inevitable data exfiltration. Here is how to lock down your VPC traffic effectively.aws8 min readAug 25, 2026★ Stop Allowing PostgreSQL Connections to BalloonUnbounded connection pools are a silent killer; here is how to use PgBouncer to prevent your database from buckling under a sudden spike in traffic.backend9 min readAug 10, 2026★ Stop Over-Provisioning Your K8s Requests and LimitsIf you aren't measuring actual container utilization, you’re burning 40% of your cloud budget on idle CPU and RAM. Here is how to stop the waste.kubernetes8 min readAug 6, 2026Stop Relying on Default EKS Node Termination HandlersIf you aren't gracefully handling Spot instance interruptions, your users are seeing 500s every time AWS reclaims capacity.kubernetes8 min readJul 27, 2026Stop Using latest Tags in Your Docker ImagesUsing 'latest' is a production anti-pattern that hides deployment drift and makes rollbacks a guessing game. Use semantic versioning or commit hashes instead.docker7 min readJul 17, 2026Stop Ignoring Kubernetes Liveness and Readiness ProbesIf your pods restart randomly or lose traffic during deployments, you don’t have an infrastructure problem—you have a probe problem.kubernetes7 min readJul 14, 2026Stop Using Cluster-Admin for EverythingIf your service account can delete every pod in the cluster, you’re one compromised workload away from a cluster-wide incident.kubernetes7 min readJul 9, 2026Stop Storing AWS Keys in GitHub SecretsUse OpenID Connect to let GitHub Actions assume an AWS IAM role and push to ECR — no long-lived access keys, ever.aws9 min readJul 3, 2026Scoping Down an AWS IAM Wildcard PolicyA wildcard IAM policy isn't least privilege - it's a promise to get burned later. Here's how to scope permissions down with Access Analyzer and CloudTrail.aws8 min readJun 17, 2026Container Security: Running as Non-RootWhy most containers run as root, why that's a security risk, and how to switch to a non-root user in your Dockerfile in about 5 minutes.kubernetes8 min readJun 7, 2026Your Cache Is Making Things WorseHow a bad caching strategy creates more problems than it solves, and the questions worth asking before you reach for Redis or a CDN.backend9 min readJun 2, 2026Vendor Lock-in: Speed vs. FlexibilityAsk this one question before choosing a managed cloud service-it might save you months of migration work later.aws8 min readMay 26, 2026Stop Hardcoding AWS Keys.For EC2 workloads, attach an IAM role via an instance profile so your app obtains temporary credentials automatically. No hardcoded keys needed.devops7 min readMay 20, 2026I Panicked Over Nothing For An HourA debugging story from when I started with Kubernetes at my old job. I thought I'd broken everything. Turns out I was just looking in the wrong place.devops13 min readMay 17, 2026Communication Is a Skill Engineers NeedEngineers often fail not because they can't code, but because they can't explain what broke and why. Here's how to communicate better with stakeholders.career8 min readOct 19, 2025The State of Hiring, AI, and 2025Hiring Trends 2025: AI's impact on recruitment, engineering talent market, and what DevOps/backend engineers should know about hiring evolution.career8 min readFeb 12, 2024Docker Layers, Caching & Multi-Stage Builds ExplainedDocker Layer Caching: How Docker builds work, multi-stage builds, build optimization, and reducing image size with efficient layer management strategies.docker15 min readFeb 5, 2024Dockerfile Labels: A Comprehensive GuideDockerfile Labels Guide: Metadata, versioning, maintainer info, and organizational best practices for Docker images and container orchestration.docker10 min readJan 29, 2024Base Images: The Secret to Smaller Docker ImagesDocker Base Images Guide: Alpine, distroless, slim variants explained. Learn how choosing the right base image cuts container size by 50–80% or more.docker12 min readJan 22, 2024Compressed vs. Uncompressed Docker ImagesDocker Image Optimization: Explore compressed vs uncompressed layers, size reduction strategies, and how Docker storage works to build efficient containers.docker8 min readJan 15, 2024How to Create and Run a Docker ContainerLearn how to create a Docker container step by step: write a Dockerfile, build an image, and run and manage containers with the exact commands you need.docker12 min read
One post when I break something worth writing about
No cadence promises. No newsletter padding.