Helm Without the YAML Soup
Master Helm templating sanity. Values files, smart defaults, when to skip Helm entirely, and why nested variables aren't always the answer.
Tag: devops
All the articles with the tag "devops".
Garrul: The Audit Found My Rate Limiter
A security audit of Garrul, my Cloudflare Workers comment system, found 2 critical bugs. Both had the same root cause as one I had already fixed in June.
Bots Ate 90% of My Worker Quota
A WordPress login bot burned 90% of my Cloudflare Workers free tier in two hours attacking a site that has never run PHP. Here's what actually stopped it.
Kaniko & Buildah: Daemonless Container Builds
Daemonless OCI image builds in CI without Docker-in-Docker risks. Kaniko vs Buildah compared, when each fits, and which one suits your pipeline.
3-2-1-1-0: The Backup Strategy That Survives Ransomware
3-2-1 backups aren't enough anymore. The 3-2-1-1-0 rule adds immutable & offline copies plus verified restores, here's how to implement it.
regclient: Container Image Lifecycle Without a Daemon
regctl, regbot, and regsync give you tag retention policies, registry replication, and manifest surgery, no Docker daemon required.
dbt-core for Self-Hosters: SQL With Tests, Without dbt Cloud
Run dbt-core free with Postgres, DuckDB, or ClickHouse. SQL transformations, tests, docs, and star schemas without the dbt Cloud price tag.
Your Agent Doesn't Need a Shell
Coding agents get unrestricted shell access by default because it's easy, not because they need it. Here's the short list of what actually breaks without one.
Durable Objects: Stateful Serverless
Cloudflare Durable Objects solve the one thing serverless can't: coordination. Storage API, WebSocket hibernation, gotchas, and a working rate limiter build.
ArgoCD ApplicationSets: One Manifest, Many Clusters
ArgoCD ApplicationSets let one template generate dozens of GitOps Applications across clusters. Covers List, Cluster, Git, Matrix, and PR generators with real patterns.
Multi-Arch Docker Builds With QEMU & buildx
Build Docker images that run on amd64 and arm64 from one command. QEMU emulation, native multi-node builders, CI caching, and manifest lists explained.
OPA & Rego: Policy as Code Beyond Kubernetes
OPA and Rego aren't just Kubernetes gatekeepers. Block :latest tags in CI, enforce Terraform resource tags, and filter HTTP APIs.