Blog
Articles on CI/CD pipelines, Docker, Kubernetes, cloud infrastructure, and observability — practical DevOps engineering notes from real production systems.
107 articles
How feature flags make trunk-based development safe — decoupling deploy from release, short-lived branches, kill switches, and the flag hygiene that keeps it all from rotting.
The two ways to stop copy-pasting CI YAML across repos, and the rule I use to pick between them.
How I autoscale ephemeral GitHub Actions runners on Kubernetes with ARC — queue-driven scaling, scale-to-zero, dind vs kubernetes mode, and the settings that actually control cost.
System containers give you a persistent, full-OS Linux box that shares the host kernel. Here is when Incus/LXC beats both Docker and a VM, with a comparison table and real commands.
Ingress crammed the load balancer and routing rules into one annotation-heavy resource. The Gateway API splits them into role-oriented pieces, GatewayClass, Gateway, and HTTPRoute, and it is now the recommended path after ingress-nginx reached end of life.
A hands-on comparison of restic and BorgBackup for encrypted, deduplicated backups: repositories, backends, prune and retention, and restore speed.
Our Bitbucket Pipelines release flow had load testing, autoscaling, and dashboards, but no automated performance check before production. Here's the one pipeline step that fixed it.
How I ship to Kubernetes with Argo Rollouts — canary and blue-green strategies, Prometheus-driven analysis, and automatic rollback when an SLO breaks.
How I replaced a wall of copy-pasted docker build commands with one declarative HCL bake file — matrix targets, scoped caching, and a GitHub Actions workflow that stays identical to my local build.
After HashiCorp's BSL relicense, is switching to OpenTofu worth it? A hands-on look at compatibility, state, the registry, and the actual migration commands.
How I ship Prometheus metrics to Grafana Mimir over remote_write for horizontally scalable, multi-tenant long-term storage that queries fast.
How Terraform import blocks and the -generate-config-out flag turn a painful manual chore into a reviewable, config-driven workflow — plus the limits that still bite.
Promtail and Grafana Agent are both dead — here is how I moved a real Docker logging pipeline to Grafana Alloy, its OpenTelemetry Collector components, and the config syntax that replaces YAML.
How a dual-backend observability stack let me watch application latency and infrastructure load in real time, then localize a bottleneck all the way down to a single Postgres tuple lock.
A practical walkthrough of architecting an OpenTelemetry Collector pipeline, from receivers and processors to tail-based sampling and multi-backend exporting.
How to connect servers, laptops, and a homelab into a single private network with Tailscale's WireGuard mesh, then self-host the control plane with Headscale.
Docker Swarm has no Kubernetes-style Horizontal Pod Autoscaler, so during my SGU thesis I built one myself: a Bash daemon with asymmetric streak consensus and a cooldown window.
A practical guide to configuring Renovate for painless dependency updates, covering grouping, automerge rules, scheduling, and lockfile maintenance so pull requests stay useful instead of noisy.
When to move from Prometheus to VictoriaMetrics for long-term retention: storage efficiency, MetricsQL, resource use, and a safe migration path.
During my SRE research at Commsult Indonesia, doubling Docker Swarm replicas cut latency but barely moved throughput, until pg_stat_activity revealed a single locked database row was the real bottleneck.
High-cardinality labels quietly eat your Prometheus server's RAM until it OOMs. Here is how recording rules, label hygiene, and relabeling keep the TSDB small and PromQL fast.
How distroless base images and multi-stage builds cut Docker image size and CVE surface, plus how to debug a container that has no shell at all.
Long-lived AWS and GCP keys sitting in repository secrets are a standing liability. Here is how to replace them with GitHub Actions OIDC federation, trust policies, and subject claim scoping.
Deploy Dockerized apps to any VPS with Kamal 2 — kamal-proxy zero-downtime rollouts, Postgres and Redis accessories, secrets, and instant rollback, no Kubernetes required.
A hands-on comparison of Coolify and Dokploy for self-hosting apps on a VPS, covering architecture, database management, git deploys, and resource use.
Run Dokploy as a Heroku-style, self-hosted PaaS on a single VPS. Here is what runs under the hood, and how app deploys, databases, Traefik routing, and backups fit together.
Package manager installs shouldn't re-download from scratch on every commit. BuildKit cache mounts let npm, apt, pip, and Go caches survive across builds without bloating your final image.
How to let a Node.js backend list, start, and create Docker containers directly with dockerode — and why mounting the Docker socket is a security decision, not a shortcut.
A working 3-2-1 backup setup for VPSs: restic to S3-compatible object storage, database dumps done right, retention, and restore drills that prove it works.
Docker --memory and --cpus flags are just files in the cgroups v2 tree. Understanding memory.max, cpu.max, and the OOM killer makes your limits predictable.
You do not need a service mesh for safe deploys. Blue-green and canary releases work on a single VPS with nginx and Docker Compose — here is how I run both.
Uptime Kuma replaces paid uptime services with one Docker container: 90+ notification channels, status pages, and checks for everything you run on a VPS.
Dependency caches, Docker layer caches, and build caches each fail differently. Here are the GitHub Actions caching patterns that halved my CI times.
A comprehensive guide to building an Internal Developer Platform (IDP) using Backstage, golden path templates, and DORA metrics. Learn how platform teams reduce cognitive load for developers, improve deployment frequency, and implement Team Topologies principles in practice.
Caddy gives you automatic HTTPS in two lines; Nginx plus certbot gives you control and raw ecosystem depth. Here is how I decide between them per VPS.
Docker Compose Watch syncs code into running containers in milliseconds. Here is how I replaced messy bind mounts with sync, rebuild, and sync+restart rules.
A practical guide to deploying a production k3s Kubernetes cluster on affordable Indonesian VPS providers, covering installation, storage with Longhorn, TLS ingress, and cost-optimized high availability for teams running on Rp 200k–600k/month per node.
Indonesian companies are hemorrhaging cloud spend on over-provisioned instances, forgotten dev environments, and unattached EBS volumes. This guide applies the FinOps Framework's Inform-Optimize-Operate cycle with practical AWS CLI scripts, Python cost anomaly detection, and Reserved Instance strategies tailored to Indonesian cloud usage patterns.
Indonesia's Pusat Data Nasional (PDN) program consolidates thousands of government data centers into four strategic regional hubs. This guide explains the regulatory framework, security classification tiers, and practical steps developers need to migrate workloads to the national cloud infrastructure.
Set up a free professional custom domain email using Cloudflare Email Routing for inbound and SMTP2Go for outbound — no Google Workspace needed.
A hands-on comparison of Google Cloud and DigitalOcean from a developer who runs production workloads on both — covering pricing, managed services, and when to use each.
Set up a production-grade Grafana and Prometheus monitoring stack on a VPS using Docker Compose, with Node Exporter, alerting via Telegram, and real PromQL dashboards.
Implement blue-green deployments on a single VPS using NGINX and Docker — swap live traffic between two containers with a shell script and achieve true zero-downtime releases.
Set up automatic HTTPS with Certbot and Let's Encrypt on Ubuntu, configure NGINX as a TLS terminator, and never manually renew an SSL certificate again.
Build a complete self-hosted observability platform on a single DigitalOcean Droplet — Prometheus metrics, Loki log aggregation, Grafana dashboards, and Telegram alerting for under $25/month.
A pragmatic guide to running production Kubernetes on GKE Autopilot as a solo developer — avoiding common pitfalls, minimizing cost, and setting up a CI/CD pipeline that actually works.
A practical, battle-tested Docker setup using multi-stage builds and Compose that I apply to every NestJS and Next.js project from day one.
A practical decision framework for choosing between Cloud Run, GKE, Cloud SQL, and raw Compute Engine VMs—based on real workloads rather than marketing copy.
How to build a robust event-driven system using Apache Kafka and NestJS — from topic design to consumer groups, error handling, and production tuning.
A data-driven comparison of gRPC and REST for internal service-to-service communication — with benchmarks, NestJS examples, and an honest guide to when each is the right choice.
A pragmatic guide to PostgreSQL sharding and partitioning — covering table partitioning, Citus distributed tables, and the honest truth about when you actually need to shard.
A practical comparison of RabbitMQ and BullMQ for Node.js backend systems — covering architecture, use cases, NestJS integration, and when each is the right tool.
How to implement an API gateway in NestJS microservices — covering request routing, authentication aggregation, rate limiting, and the trade-offs of building vs buying.
How to instrument a NestJS microservices application with OpenTelemetry for end-to-end distributed tracing — covering auto-instrumentation, custom spans, and backend choices.
How to implement the circuit breaker pattern in NestJS using nestjs-resilience4j or a custom implementation — preventing cascading failures and building self-healing services.
A practical guide to CQRS and event sourcing in NestJS — what the patterns actually solve, how to implement them with @nestjs/cqrs, and Martin Fowler's honest warning about when to skip them.
How to horizontally scale a WebSocket server using Redis Pub/Sub and Socket.IO — covering the sticky session problem, Redis adapter setup, and what happens when Redis becomes the bottleneck.
A practical OWASP Top 10 2021 checklist from a developer who hardens production systems — covering real CVEs, code-level mitigations, and what actually gets exploited.
An honest comparison of JWT and session-based authentication for production APIs — covering security trade-offs, revocation, storage, and what I implement for ERP systems.
ORMs prevent most SQL injection but not all — learn the raw query pitfalls, Prisma safe patterns, and the real-world injection scenarios I test for in every ERP system.
Properly configuring CORS for Next.js frontends and NestJS APIs — covering origins, credentials, preflight caching, and the misconfigurations that create real security holes.
Go beyond basic Let's Encrypt setup — HSTS preloading, TLS 1.3, OCSP stapling, cipher suite hardening, and the SSL misconfigurations I find on production servers.
Practical NestJS API security — rate limiting, input validation, security headers, audit logging, and the specific controls I configure for every production API deployment.
How to prevent secrets from entering your git history — pre-commit hooks, GitHub Secret Scanning, gitleaks, and what to do when you have already committed credentials.
Integrate Trivy container vulnerability scanning into your Docker workflow — covering CI/CD integration, base image selection, and reducing your container attack surface.
A developer's introduction to penetration testing — the tools, methodologies, and mindset I took away from competing in PwC's Capture the Flag security competition.
A practical comparison of Nginx and Traefik as reverse proxies — covering performance, auto-discovery, Docker integration, and when each tool actually makes sense.
A practical Linux server hardening checklist covering SSH lockdown, firewall rules, automatic updates, and fail2ban — steps I apply to every DigitalOcean and GCP instance.
A real-world comparison of GitHub Actions and GitLab CI/CD covering pricing, runner performance, YAML syntax, and when each platform makes more sense for your team.
A developer's honest comparison of PostgreSQL and MySQL for production use — covering performance benchmarks, licensing, JSON support, and why PostgreSQL is now the default choice.
Practical Redis caching patterns for NestJS — cache-aside, write-through, and cache invalidation strategies with real code examples and performance measurements.
A practical guide for small teams deciding between Docker Compose and Kubernetes — covering complexity, cost, and the right progression from one to the other.
How to set up monitoring and alerting as a solo DevOps engineer — Prometheus, Grafana, Uptime Kuma, and Telegram alerts without the enterprise complexity.
A practical SSH hardening guide for VPS owners — disable password auth, change ports, configure fail2ban, and lock down sshd_config before your server gets compromised.
A practical PostgreSQL backup strategy for VPS deployments — covering pg_dump, pg_basebackup, WAL archiving, and automated offsite backup with real configuration examples.
A practical Nginx performance tuning guide covering worker processes, connections, kernel parameters, gzip, and caching — with real configuration you can apply today.
Set up fail2ban on Ubuntu VPS to automatically block SSH brute-force attacks, protect Nginx, and configure custom jails — with real configuration examples.
How to write production-ready systemd service files for Node.js, NestJS, and background workers — with restart policies, resource limits, and environment variable management.
How to set up WireGuard VPN to create a private overlay network between cloud servers and development machines — faster than OpenVPN with a fraction of the configuration.
How to configure logrotate for production Linux servers — preventing disk full outages, managing app logs, and setting up monitoring for log rotation health.
Why plain environment variables are not safe for Docker secrets, and how to use Docker secrets, external secret managers, and encrypted files to protect credentials in production.
A practical comparison of Cloud Run and Cloud Functions from real production deployments — covering cold starts, pricing, concurrency, and when each platform wins.
How to design, structure, and version Terraform modules that your team can reuse across projects — with real patterns from production multi-environment deployments.
How to write, structure, and safely run Ansible playbooks for production server automation — with role-based organization, Vault secrets, and idempotency testing.
Practical cloud cost optimization techniques from actual production deployments — rightsizing, committed use discounts, storage tiering, and FinOps habits that stick.
An honest look at multi-cloud for small engineering teams — when it makes sense, when it does not, and how to manage two cloud providers without drowning in operational overhead.
A practical guide to configuring Cloudflare as a CDN for static assets — cache rules, TTLs, cache hit optimization, and tiered caching that actually cuts origin load.
A complete Nginx load balancer configuration guide for production — upstream groups, passive health checks, least-conn routing, SSL termination, and safe reload without downtime.
A practical VPS disaster recovery plan with automated backups, defined RTO/RPO targets, and a recovery runbook you can actually execute when things go wrong at 2 AM.
Google shut down Container Registry on March 18, 2025. Here is how to migrate to Artifact Registry, set up vulnerability scanning, and build a proper Docker image management workflow.
Understand VPC networking concepts — subnets, routing tables, firewall rules, peering, and NAT — with practical examples for GCP and DigitalOcean deployments.
An honest comparison of managed cloud object storage (GCS, S3) versus self-hosted MinIO — covering cost, performance, operational overhead, and the licensing change that changes the calculus.
How to set up, secure, and scale GitHub Actions self-hosted runners on your own VPS or GCP instance — with ephemeral mode, runner groups, and the security practices that matter.
How to deploy and configure HashiCorp Vault for production secrets management — dynamic credentials, audit logging, auto-unseal, and integrating with Kubernetes and CI/CD.
How to configure Prometheus AlertManager for production on-call alerting — routing trees, inhibition rules, grouping, Telegram integration, and high-availability setup.
How to deploy and operate a self-hosted Elastic Stack for centralized logging — Elasticsearch cluster setup, Logstash pipelines, Kibana dashboards, and the operational pitfalls to avoid.
A comprehensive guide to implementing unified logging and metrics with Loki and Prometheus for Kubernetes observability.
Google Cloud Storage egress fees eating your budget? Migrate to Cloudflare R2 for zero egress costs. Step-by-step guide with rclone, real cost calculations, and S3-compatible SDK migration.
Shift security left with DevSecOps: embed SAST, DAST, SCA, container image scanning, and secrets detection directly into your GitHub Actions CI/CD pipeline with real workflow examples.
Master Site Reliability Engineering concepts: define meaningful SLOs and SLAs, calculate error budgets, build multi-window burn-rate alerts, and balance reliability with feature delivery velocity.
Implement GitOps for Kubernetes using ArgoCD and Flux CD — where Git is the single source of truth. Compare both tools with real manifests and automated image update examples.
Provision and manage cloud infrastructure declaratively using Terraform. Master HCL syntax, remote state, reusable modules, and automated CI/CD pipelines for multi-cloud deployments.
Automate server provisioning, configuration management, and app deployment with Ansible. Real playbook examples for Node.js, Docker, and Nginx setups.
Docker Swarm vs Kubernetes: when Swarm wins, how to set up a multi-node cluster, deploy services, and manage rolling updates without the K8s complexity.
Production-ready Docker practices: multi-stage builds, minimal base images, secrets management, health checks, and image optimization techniques.
Master Blue-Green, Canary, and Rolling deployments in Kubernetes. Learn when to use each strategy and how to implement them with real YAML examples.
Build a complete CI/CD pipeline with GitHub Actions — automated tests, Docker builds, and zero-downtime deployments from first push to production.