Tag: devops

Garrul: The Audit Found My Rate Limiter

A security audit of Garrul, my Cloudflare Workers comment system, found 2 critical bugs. Both had the same root cause as one I had already fixed in June.

Bots Ate 90% of My Worker Quota

A WordPress login bot burned 90% of my Cloudflare Workers free tier in two hours attacking a site that has never run PHP. Here's what actually stopped it.

Kaniko & Buildah: Daemonless Container Builds

Daemonless OCI image builds in CI without Docker-in-Docker risks. Kaniko vs Buildah compared, when each fits, and which one suits your pipeline.

3-2-1-1-0: The Backup Strategy That Survives Ransomware

3-2-1 backups aren't enough anymore. The 3-2-1-1-0 rule adds immutable & offline copies plus verified restores, here's how to implement it.

regclient: Container Image Lifecycle Without a Daemon

regctl, regbot, and regsync give you tag retention policies, registry replication, and manifest surgery, no Docker daemon required.

dbt-core for Self-Hosters: SQL With Tests, Without dbt Cloud

Run dbt-core free with Postgres, DuckDB, or ClickHouse. SQL transformations, tests, docs, and star schemas without the dbt Cloud price tag.

Your Agent Doesn't Need a Shell

Coding agents get unrestricted shell access by default because it's easy, not because they need it. Here's the short list of what actually breaks without one.

Durable Objects: Stateful Serverless

Cloudflare Durable Objects solve the one thing serverless can't: coordination. Storage API, WebSocket hibernation, gotchas, and a working rate limiter build.

ArgoCD ApplicationSets: One Manifest, Many Clusters

ArgoCD ApplicationSets let one template generate dozens of GitOps Applications across clusters. Covers List, Cluster, Git, Matrix, and PR generators with real patterns.

Multi-Arch Docker Builds With QEMU & buildx

Build Docker images that run on amd64 and arm64 from one command. QEMU emulation, native multi-node builders, CI caching, and manifest lists explained.

OPA & Rego: Policy as Code Beyond Kubernetes

OPA and Rego aren't just Kubernetes gatekeepers. Block :latest tags in CI, enforce Terraform resource tags, and filter HTTP APIs.

Convoy: Self-Hosted Webhook Delivery That Doesn't Drop Events

Convoy is a self-hosted webhook gateway with retries, dead-letter queues, HMAC signing, and fan-out. Deploy it with Docker Compose in minutes.