Archives

Lean platform teams run on trust until the day they need to grow. What hiring an SRE taught me about access, merit, and the tooling that betrays your ramp-up plan.

A vague ticket is not a planning problem. It is future rework wearing a nice title, and the ambiguity you leave in it comes back as defects, delay and incidents. Writing a clear ticket is reliability work.

Engineers argue about nines. The business does not buy nines, it buys revenue that survives an outage and customers who still trust you tomorrow. The technical leader's job is to frame reliability as the money-and-risk decision it actually is.

What a VPC really is, how physical networking concepts map onto cloud abstractions, and why the failure modes change when your network becomes an API call instead of a cable you can trace.

A failing build tells you something. A hanging build tells you nothing, burns a runner, and slowly teaches the team to hit retry instead of reading. Here is one that hung for a stupid reason, and how a thread dump found it.

Everyone agrees with least privilege and almost nobody ships it, because the broad grant is always the easier path. Fix that, make scoping the path of least resistance, and the security follows for free.

A replication pipeline reported healthy for weeks while it quietly wrote NULLs into a column that mattered. No error, no alert, no page. That gap between a service failing and data failing is exactly why data needs SRE too.

Running Calico in policy-only mode on top of the AWS VPC CNI, why two network layers in one cluster is the right call, and the one flag that stops Calico from breaking your cluster.

A pretty dashboard is not observability. Here is the difference, and why it matters the next time production breaks.

A bus factor of one is the real risk here. A partner team was blocked, and the tidy fix looked like granting repo access. It was the wrong lever, because knowledge trapped in one person's head does not transfer through a repository.

Moving multi-tenant analytics off an always-on database onto a serverless lakehouse with Parquet, Iceberg and Athena, keeping tenant isolation as a first-class security property, and cutting the bill by more than half as a side effect.

Seniority is not just about knowing more tools. It is about reducing confusion, risk and rework when systems, people and priorities get messy.

Remote work gets blamed for communication problems it did not create. The office was hiding them. Team Topologies gives you the vocabulary to make team interactions explicit, and remote is what forces you to use it.

Kubernetes can scale pods, but that does not mean your TCP connections, clients, queues and failover model are ready to scale with it.

Peering, transit gateways, and site-to-site VPNs are the cloud's answer to the leased line. Here is how they fit together, when to use which, and why CIDR planning decides whether any of it works.

A VPN authenticates you once and then drops you onto the internal network with reach to everything. That is not access control. It is a flat network with a login screen, and I have written before about what flat networks cost.

One AWS account feels simple until production, staging, logs, experiments and the monthly bill start sharing the same blast radius.

A visual walk through every hop a request takes from load balancer to pod, why the service is a fiction, and why so many cluster network failures are silent.

AWS WorkMail is not in the official AWS provider. I needed to manage it in a fully Terraform environment, so I built the provider that was missing.

I wanted to understand how Terraform providers actually work, so I built one for Slack and shipped it to the registry. Here is what the lifecycle really looks like.

CoreDNS CPU was pegged and name resolution failed at random across the cluster. Nothing in the app changed. The load came from a default nobody chose, quietly turning one lookup into five.

A deep how-to on locking down and tuning a Linux server that runs many tenants on one box, kernel semaphores and all

A retrospective on running staff workstations with no local disk booted over PXE with home directories on highly available iSCSI storage

How we rebuilt a Brazilian hosting datacenter from a flat unmanaged network into a segmented one and what that actually changed

The story of FAN2, a homegrown high availability setup for Asterisk built on a floating IP years before HA became a cloud checkbox

I didn't start in the cloud. Fifteen years from telecom and firewalls to SRE, and why the old layers still make me better at the new ones.