DevOpsOctober 202610 min read
How to Secure a Docker Container: 7 Steps for Beginners
How to secure a Docker container for beginners: non-root user, read-only filesystem, cap-drop, no image secrets, pinned versions and scans, plus checks.
Read MoreBlog
DevOps & Cloud Infrastructure
Articles on CI/CD pipelines, Docker, Kubernetes, cloud infrastructure, and observability — practical DevOps engineering notes from real production systems.
193 articles
DevOpsOctober 202610 min read
How to Roll Back a Docker Deploy on a VPS (Beginner Guide)
Beginner guide to rolling back a Docker deploy on a VPS: unique image tags, record the old version, deploy with --wait, restore the tag, verify, and the limits.
Read More
DevOpsOctober 202610 min read
Docker Swarm vs Kubernetes: A Small Team Load Test Verdict
Docker Swarm vs Kubernetes for a small team, decided with my own load test and a home-built autoscaler: what HPA adds, where Swarm stops being enough.
Read More
DevOpsOctober 202610 min read
How to Deploy Docker Compose in Production for Beginners
Beginner guide to deploy Docker Compose in production: restart policy, .env, loopback port, memory limit, health check, safe updates and a table of fixes.
Read More
DevOpsOctober 202610 min read
How to Turn a Plain Dockerfile into a Docker Multi-Stage Build
How to build a Docker multi-stage image for beginners: split a Dockerfile into stages, copy only what runs, drop root, and measure the image size yourself.
Read More
DevOpsOctober 202610 min read
How to View Docker Logs: Tail, Follow and Compose Guide
How to view docker logs for beginners: tail, follow, since, timestamps, docker compose logs, a restarting container, and max-size log rotation.
Read More
DevOpsOctober 202610 min read
How to Create CI/CD with GitHub Actions: 7 Beginner Steps
How to set up CI/CD with GitHub Actions for beginners: write a first workflow, chain jobs with needs, add typecheck, lint and test gates, and block bad merges.
Read More
DevOpsOctober 202610 min read
How to Fix Docker No Space Left on Device (7 Steps)
How to fix Docker no space left on device, step by step: read docker system df, prune safely, keep the newest images, cap logs and the journal.
Read More
DevOpsOctober 202611 min read
How to Store Docker Secrets and Environment Variables Safely
How to store secrets and environment variables in Docker safely: why ENV and ARG leak, then env_file, secret mounts, GitHub Actions and key rotation.
Read More
DevOpsOctober 202610 min read
Learn Docker from Scratch: First Container in 6 Steps
Learn Docker from scratch hands-on: build your first image, run a container, publish a port, read logs and keep data with a volume without guessing at errors.
Read More
DevOpsOctober 202611 min read
How to Deploy Next.js to a VPS with Docker and GitHub Actions
How to deploy Next.js to a VPS: a standalone Docker image, GHCR and GitHub Actions over SSH, with copy-paste commands and a table of common errors.
Read More
DevOpsOctober 202610 min read
How to Log In to a VPS Over SSH and Secure It (Beginner Guide)
How to log in to a VPS over SSH as a beginner: first login, a sudo user, an SSH key, password and root login off, a ufw firewall, and avoiding a lockout.
Read More
DevOpsOctober 202610 min read
How to Set Up Nginx Reverse Proxy for Docker and Cloudflare
Beginner guide to nginx reverse proxy setup for a Docker app behind Cloudflare: proxy_pass, headers, SSL mode, real IP, and a table of 502 and 504 fixes.
Read More
DevOpsOctober 202612 min read
Autoscale vLLM on Kubernetes with KEDA: Queue Depth, Not GPU %
AWS's EKS ScaledObject for vLLM read closely: queue depth and p95 triggers, activation thresholds, the load test behind 25 and 5, and what breaks first.
Read More
DevOpsOctober 202612 min read
AI Code Review Bottleneck: What CMU and Stanford Measured
AI doubled output per developer but reviewers grew only 1.5x. A CMU and Stanford study of 196,212 PRs found written review feedback fell from 39% to 21%.
Read More
DevOpsOctober 202611 min read
npm Trusted Publishing: 48-Hour Expiry and issue_comment Ban
npm now expires unvalidated trusted publishing configurations after 48 hours and rejects issue_comment tokens. Here is what changed and how to migrate a release workflow.
Read More
DevOpsOctober 202612 min read
kubectl-ai Guide: Confirmation Gate, Limits and MCP Server Risk
kubectl-ai read from its source: how the confirmation gate classifies commands, what quiet mode and maxIterations do, and why the MCP HTTP server needs OAuth.
Read More
DevOpsOctober 202611 min read
Argo CD 3.5: mTLS, Source Integrity and Helm 4 Upgrade Guide
A close reading of the Argo CD 3.5 release and upgrade notes: repo-server mTLS, Source Integrity, Helm 4 OCI changes, ApplicationSet concurrency and what to audit on 3.4.
Read More
DevOpsOctober 202612 min read
Flux 2.9: CLI Plugins, SSA Ignore Rules and OIDC Webhooks
A close reading of the Flux 2.9 release: the CLI plugin system, server-side apply ignore rules, post-quantum age keys for SOPS, OIDC webhook Receivers and the upgrade traps.
Read More
DevOpsOctober 202611 min read
Terraform 1.16: What's New and How to Upgrade Safely
Terraform 1.16 adds module import blocks, a terraform_data store block, destroy = false and Mermaid graphs. See what changed and what to test first.
Read More
DevOpsOctober 202611 min read
OpenTofu 1.13: convert, assume and Upgrade Breaking Changes
OpenTofu 1.13 upgrade notes: base64gzip output change, WinRM removal, convert and assume functions, experimental linting, Windows ARM64 and 32-bit end.
Read More
DevOpsOctober 202612 min read
KubeCon North America 2026 Guide: AI Track, Co-located Days
A platform engineer's guide to KubeCon + CloudNativeCon North America 2026 in Salt Lake City: dates, passes, the new AI Inference + Agentic track and Monday rooms.
Read More
DevOpsOctober 202612 min read
OpenTofu Ephemeral Resources and Write-Only Attributes
How OpenTofu 1.11 ephemeral resources, ephemeral variables and write-only attributes keep secrets out of state, plus the enabled meta-argument, with HCL.
Read More
DevOpsOctober 202612 min read
ingress-nginx Retirement: Contour or Gateway API Migration
What the March 2026 ingress-nginx retirement means, how Contour and Gateway API compare, the five quirks that cause 404s, and what to do on Monday.
Read MoreMore in this category
- Ingress2Gateway 1.0: Migrate ingress-nginx to Gateway API
- kube-proxy ipvs Deprecated: Migrate to nftables by v1.40
- Kubernetes MCP Server: read_only, Toolsets, Denied Resources
- Kubernetes HPA Scale to Zero for GPU Queue Workers (1.37)
- Kubernetes 1.37 Release: What Breaks When Upgrading From 1.36
- KYAML in Kubernetes 1.37: Stable YAML Subset, kubectl -o kyaml
- DORA AI-Assisted Development: Throughput Up, Instability Up
- PagerDuty SRE Agent: Virtual Responder Setup and Guardrails
- Copilot Fix Failing GitHub Actions: Setup and Review Rules
- HolmesGPT Kubernetes Alerts: Runbooks Beat the Model Choice
- Agentic Workflow CI Failure Triage with gh-aw CI Doctor
- GitHub Agentic Workflows: Markdown Automation with gh aw
- Terraform MCP Server GA: A Safe Agent Setup Since 1.1.0
- Grafana MCP Server: OAuth Scopes for Claude Code and Cursor
- Grafana Assistant Investigations: Alert-Triggered RCA Setup
- NVIDIA Run:ai Open Source: KAI Scheduler, GPU Fractioning
- Volcano Scheduler GPU Gang Preemption: v1.15 DRA Queue Quota
- Kubernetes DRA GPU Fallback: Prioritized List in 1.36
- Kubernetes 1.37 DRA Extended Resources GA: Run example.com/gpu Without a Device Plugin
- Kubernetes Gang Scheduling Beta in 1.37: What Works, What Not
- Gateway API Inference Extension: EPP Moves to llm-d, What Now
- llm-d on Kubernetes: Distributed Inference and v0.10 Hardening
- Anthropic Replaced Git With Scion: What Agent-Scale Source Control Changes
- Design a Metrics and Monitoring System: A Prometheus Pipeline
- SLI vs SLO vs SLA: Definitions, Error Budgets and Burn Rates
- Load Balancing Algorithms: Round Robin, Least Conn, IP Hash
- AWS Bedrock AgentCore Guide: Runtime, Gateway, Memory, Policy
- Codex SDK Tutorial: Automate Coding Tasks in TypeScript
- Easypanel vs Coolify vs Dokploy: Self-Hosted PaaS on a VPS
- OpenTelemetry GenAI Semantic Conventions: Agent Spans in Tempo
- Reading Production Logs Without SSH on a Managed PaaS
- Zero-Downtime Schema Migrations on a Rolling Deploy
- Build Gates: Architecture Rules a README Cannot Enforce
- Docker Build Cache: Faster PaaS Deploys From a Cold Builder
- Claude Code Plugin Upgrades: Version Pinning and Rollback
- Claude Code Plugin Release Automation in GitHub Actions
- AI DevOps Assistants for Kubernetes Production Triage
- Self-Hosting n8n and Flowise on an IDR-Billed Platform
- How a PaaS Build Engine Auto-Writes Your Dockerfile
- Claude Code Environment Variables That Actually Matter
- Claude Code OpenTelemetry: Metrics, Events and Cost
- Claude Code Network Config: Proxies, mTLS and Domains
- Claude Code Dev Containers: Isolation That Holds
- Claude Code in GitLab CI/CD: Jobs, OIDC and MRs
- Claude Code Scheduled Tasks: Loops, Cron and Routines
- Claude Code Self-Hosted Runners: Cloud Sessions, Your Box
- Running the Hermes Agent as an Autonomous Coder on a VPS
- A Deterministic Merge Gate for a Self-Merging AI Agent
- Debugging a Production VPS Incident With Claude Code
- AI Code Review Tools Compared for 2026
- Parallel Claude Code Agents With Git Worktrees
- Claude Code GitHub Actions: Issue to Merged PR
- Claude Code Headless Mode for CI/CD Pipelines
- Helm 4 Migration Guide: What's New and How to Upgrade
- Load Testing Node.js APIs with k6 and Grafana Dashboards
- Podman Quadlets: Replace Docker Compose with systemd
- KEDA: Event-Driven Autoscaling & Scale-to-Zero on K8s
- Kubernetes In-Place Pod Resize: CPU & Memory No Restart
- kubectl debug: Fix CrashLoopBackOff & Distroless Pods
- Prometheus 3.0: OTLP, Native Histograms, UTF-8 & New UI
- uv: The Fast Rust Python Package Manager Replacing pip
- Kubernetes Native Sidecar Containers: A Practical Guide
- Feature-Flag-Driven Trunk-Based Development
- Reusable Workflows vs Composite Actions in GitHub Actions
- Autoscaling GitHub Actions Runners on Kubernetes with ARC
- Incus/LXC System Containers vs Docker Application Containers
- Kubernetes Gateway API vs Ingress: Why It Replaces Annotations
- restic vs BorgBackup: Encrypted, Deduplicated Backups
- k6 SLO Quality Gate for Bitbucket Pipelines CI/CD
- Progressive Delivery with Argo Rollouts: Canary & Blue-Green
- Docker Buildx Bake: Declarative Multi-Platform Image Builds
- OpenTofu vs Terraform: Migrating After the License Change
- Scaling Prometheus Storage with Grafana Mimir
- Import Existing Infrastructure into Terraform Without Hand-Writing HCL
- Migrating to Grafana Alloy from Promtail and Agent
- Finding a Postgres Row-Lock Bottleneck with Prometheus + InfluxDB
- OpenTelemetry Collector: Designing a Telemetry Pipeline
- Tailscale: A Mesh VPN for Your Servers and Homelab
- Building a Custom CPU Autoscaler for Docker Swarm
- Renovate: Automated Dependency Updates Done Right
- VictoriaMetrics vs Prometheus for Long-Term Metrics
- Docker Swarm Load Testing: Why More Replicas Didn't Fix Throughput
- Prometheus Cardinality: Recording Rules That Save Your TSDB
- Distroless Docker Images: Smaller, Safer Containers
- GitHub Actions OIDC: Keyless Cloud Auth for CI/CD
- Kamal 2: Zero-Downtime Docker Deploys Without Kubernetes
- Coolify vs Dokploy: Choosing a Self-Hosted PaaS
- Dokploy: A Self-Hosted PaaS for Your Own VPS
- Docker BuildKit Cache Mounts: Cut CI Build Times in Half
- Controlling Docker From Your Backend: dockerode and the Socket
- Practical 3-2-1 Backups for VPSs with Restic and Object Storage
- What cgroups v2 Really Does When You Set Docker Memory Limits
- Blue-Green vs Canary Deployments on a Budget (No Kubernetes)
- Uptime Kuma: Self-Hosted Uptime Monitoring That Just Works
- GitHub Actions Caching Strategies That Actually Cut CI Minutes
- Platform Engineering and Internal Developer Platforms: Building the Paved Road for Your Team
- Caddy vs Nginx for Automatic HTTPS: When Each One Wins
- Docker Compose Watch: Instant Feedback for Local Container Dev
- k3s Lightweight Kubernetes for Indonesian Startups: Production Setup on Budget VPS
- FinOps for Indonesian Cloud Teams: A Practical Cost Optimization Guide
- Indonesia's PDN (Pusat Data Nasional): What Developers Need to Know About Government Cloud Migration
- Free Custom Email: Cloudflare Routing + SMTP2Go
- Google Cloud vs DigitalOcean: A Practical Guide for Side-Project Developers
- Grafana + Prometheus Monitoring Stack for Your VPS: Complete Setup Guide
- Zero-Downtime Deployments with NGINX Blue-Green on a Single VPS
- Automate SSL Certificate Renewal with Certbot and NGINX
- Self-Hosted Observability Stack on DigitalOcean: Metrics, Logs, and Alerts
- Kubernetes for the Solo Developer: A Practical GKE Guide Without the Overhead
- The Docker Workflow I Use on Every Project
- Google Cloud Managed Services vs Raw Compute: When to Use Which
- Event-Driven Architecture with Kafka and NestJS: A Production Guide
- gRPC vs REST for Internal Microservices APIs: A Practical Comparison
- PostgreSQL Sharding Strategy: When and How to Scale Your Database
- Message Queues in Node.js: RabbitMQ vs BullMQ — Which Should You Choose?
- API Gateway Pattern with NestJS: Routing, Auth, and Rate Limiting in Production
- Distributed Tracing with OpenTelemetry: A Practical NestJS Implementation
- Circuit Breaker Pattern in NestJS: Building Resilient Microservices
- CQRS and Event Sourcing with NestJS: When Complexity is Worth It
- Scaling WebSockets with Redis Pub/Sub: From One Server to Many
- OWASP Top 10 Developer Checklist: What I Actually Implement
- JWT vs Session Authentication in Production: What I Actually Use
- SQL Injection Prevention with ORMs: Why Prisma and TypeORM Still Need Your Help
- CORS Configuration for Next.js and NestJS: Getting It Right in Production
- HTTPS and TLS Beyond Certbot: Hardening Your SSL Configuration
- API Security in NestJS Production: The Controls I Actually Deploy
- Secret Scanning and Preventing Credentials Leaks in GitHub
- Docker Container Security Scanning with Trivy: A Production Guide
- Penetration Testing Basics for Developers: What I Learned from PwC CTF
- Nginx vs Traefik: Choosing the Right Reverse Proxy for Your Stack
- Linux Server Hardening Checklist: What I Do on Every Fresh VPS
- GitHub Actions vs GitLab CI: Which CI/CD Platform Should You Choose?
- PostgreSQL vs MySQL in Production: Which Database Should You Choose?
- Redis Caching Patterns for NestJS: From 450ms to 42ms API Response Times
- Docker Compose vs Kubernetes for Small Teams: When to Use Each
- Monitoring and Alerting for Solo DevOps: A Practical Stack That Works
- SSH Security Hardening for VPS: Stop the Brute Force Before It Starts
- PostgreSQL Backup Strategy for VPS: From pg_dump to WAL Archiving
- Nginx Performance Tuning: From Default Config to 50,000 Req/s
- Fail2ban on VPS: Automate Brute Force Protection in 15 Minutes
- Systemd Services for Background Jobs: The Right Way to Run Node.js in Production
- WireGuard VPN for Private Cloud Networking: Simple, Fast, Secure
- Log Rotation in Linux: Managing Production Logs Before They Fill Your Disk
- Docker Secrets in Production: Stop Putting API Keys in Environment Variables
- Cloud Run vs Cloud Functions: Which Google Serverless Platform Should You Use?
- Building Reusable Terraform Modules: A Production IaC Guide
- Ansible Playbooks in Production: Real Automation Patterns That Scale
- How I Cut Cloud Costs by 40%: Real Optimization Strategies That Work
- Multi-Cloud Strategy for Small Teams: Is It Worth the Complexity?
- CDN with Cloudflare: How to Properly Serve Static Assets at the Edge
- Nginx Load Balancer in Production: Configuration, Health Checks, and Failover
- Disaster Recovery Planning for VPS: Backups, RTO, and Actual Tested Recovery
- Container Registry Strategy on GCP: From GCR to Artifact Registry
- VPC Networking for Developers: A Practical Guide to Cloud Network Isolation
- Cloud Storage vs MinIO: Choosing Your Object Storage for Production
- GitHub Actions Self-Hosted Runners: Complete Setup and Security Guide
- HashiCorp Vault for Production Secrets Management: Setup and Best Practices
- Prometheus and AlertManager: Building an On-Call Alert System That Works
- Elastic Stack (ELK) Self-Hosted: Production Setup and Operational Lessons
- Mastering Observability: Loki and Prometheus Integration for Horizontally Scaled Environments
- Cut GCS Egress Costs: Migrate to Cloudflare R2
- DevSecOps: Integrating Security into CI/CD
- SRE: SLOs, SLAs & Error Budgets Explained
- GitOps with ArgoCD and Flux CD Explained
- Infrastructure as Code with Terraform
- Ansible Infrastructure Automation Guide
- Docker Swarm: Container Orchestration for Smaller Teams
- Docker Best Practices for Production Containers
- Kubernetes Deployment Strategies Explained
- CI/CD with GitHub Actions: From Zero to Production