Topic
107 posts tagged “DevOps”.
Chisato · · 4 min read Incident severity levels rank outages by impact so teams respond proportionally. What SEV1 through SEV4 typically mean and how to set the scale.
Chisato · · 4 min read Init containers run to completion before a pod's main containers start, making them the standard way to handle setup steps and startup ordering.
Chisato · · 4 min read Logical replication streams row-level changes between Postgres databases instead of copying raw disk blocks — enabling selective sync, upgrades, and CDC.
The Lycoris Team · · 4 min read Ingress is traffic entering a network or system; egress is traffic leaving it. The distinction shapes firewall rules, cloud billing, and security posture.
Chisato · · 4 min read OpenTelemetry is a vendor-neutral standard for instrumenting apps with traces, metrics, and logs — one API, any observability backend.
The Lycoris Team · · 4 min read Rolling back reverts to the last known-good deploy; rolling forward ships a fix on top of the bad one. How to choose, and why database changes complicate both.
Chisato · · 4 min read VMs virtualize hardware with a full guest OS per instance; containers share the host kernel and isolate processes. What that trade-off costs and buys you.
Chisato · · 4 min read Linux namespaces isolate what a process can see; cgroups limit what it can use. Together they're the kernel primitives that make a container a container.
Chisato · · 5 min read Docker's default bridge network isolates containers with NAT; host mode shares the host's network stack; overlay connects containers across hosts.
Chisato · · 4 min read Kubernetes offers four Service types for exposing pods on the network. How ClusterIP, NodePort, LoadBalancer, and ExternalName each route traffic.
Chisato · · 5 min read Vulnerability scanning automatically finds known weaknesses; penetration testing has a human actively try to exploit them. When to use each.
The Lycoris Team · · 5 min read Terraform's state file maps your config to real infrastructure. How it works, why remote state and locking matter, and what causes state drift.
The Lycoris Team · · 4 min read Load testing measures how a system behaves under expected and peak traffic, revealing bottlenecks and capacity limits before real users do.
Chisato · · 5 min read On-call rotations spread responsibility for production incidents across a team on a schedule, paired with a defined incident response process for when alerts fire.
Chisato · · 4 min read Nginx and Apache both serve HTTP traffic, but Nginx's event-driven model and Apache's process-per-connection design lead to real differences under load.
Chisato · · 4 min read VPC peering connects two virtual private clouds so resources in each can talk over private IPs, without traffic ever touching the public internet.
The Lycoris Team · · 4 min read Container image scanning checks a container's layers for known vulnerabilities and secrets before it ships. How it works and where to run it.
Chisato · · 4 min read A cloud landing zone is a pre-configured, secure baseline environment for provisioning new cloud accounts and workloads at scale. How it works.
Chisato · · 4 min read FinOps is the practice of making engineering, finance, and business teams jointly accountable for cloud spend. How it works and what it actually changes.
Chisato · · 4 min read Helm templates and packages Kubernetes manifests with a templating language; Kustomize patches plain YAML declaratively, with no templates at all.
Chisato · · 4 min read Docker runs containers through a persistent root daemon; Podman runs them daemonless and rootless by default. What that architectural split changes.
Takina · · 4 min read A devcontainer defines a project's dev environment as code — tools, extensions, and dependencies — so every contributor gets an identical setup.
The Lycoris Team · · 5 min read A Kubernetes CRD (CustomResourceDefinition) extends the API with new resource types, letting the cluster manage custom objects like native ones.
The Lycoris Team · · 4 min read An availability zone is an isolated data center (or cluster of them) within a cloud region, designed so one zone's failure doesn't take down another.
Chisato · · 5 min read Taints repel pods from a node; tolerations let specific pods ignore that repulsion. How the two work together to control scheduling.
Chisato · · 3 min read Kubernetes is the feature-rich default for container orchestration; HashiCorp's Nomad trades some of that breadth for a simpler operational model.
Chisato · · 4 min read RPO limits how much data you can afford to lose; RTO limits how long you can afford to be down. How the two targets shape a disaster recovery plan.
The Lycoris Team · · 4 min read Multi-stage builds let a Dockerfile use one stage to compile code and a separate, minimal stage to ship it — cutting image size and attack surface.
Chisato · · 4 min read Requests reserve CPU and memory for scheduling; limits cap what a container can use. Getting the two wrong causes throttling or evictions.
The Lycoris Team · · 4 min read Multi-tenancy lets one system serve many customers from shared infrastructure. The isolation models that keep tenants' data and performance separate.
Chisato · · 4 min read Kubernetes NetworkPolicies control which pods can talk to which, at the network layer. Here's how they work and why pods are open by default.
The Lycoris Team · · 4 min read A blameless postmortem examines an incident's causes without assigning fault, so teams surface real fixes instead of hiding mistakes.
Chisato · · 4 min read Site reliability engineering applies software engineering to operations — error budgets, SLOs, and automating incident response at scale.
The Lycoris Team · · 3 min read CI/CD automates building, testing, and shipping code on every change. How continuous integration and continuous delivery/deployment fit together.
Takina · · 4 min read A Makefile defines targets, dependencies, and shell commands so `make` only rebuilds what changed. Here's how the rule syntax and dependency graph work.
The Lycoris Team · · 4 min read An internal developer platform packages infrastructure into self-service tools so developers ship without filing tickets or learning Kubernetes.
Takina · · 4 min read Trunk-based development merges small changes into main constantly; Git Flow routes work through long-lived branches. How each affects releases and CI.
Chisato · · 5 min read GitHub Actions and GitLab CI both run pipelines from YAML, but differ in runner model, marketplace ecosystem, and platform integration depth.
Chisato · · 5 min read A Kubernetes PersistentVolume is real storage; a PersistentVolumeClaim is a pod's request for it. How the two connect and why they're separate.
Chisato · · 5 min read Admission controllers intercept requests to the Kubernetes API server after authentication, validating or mutating objects before they're persisted.
Chisato · · 5 min read A SIEM collects logs from across an organization, correlates them, and alerts on suspicious patterns. How it works and what feeds it.
Chisato · · 4 min read Kubernetes RBAC controls who can do what in a cluster using Roles, ClusterRoles, and bindings. How the pieces fit together, with a worked example.
Chisato · · 5 min read Docker volumes are managed by Docker and portable; bind mounts map a host path directly into a container. When to use each for persistent data.
Chisato · · 5 min read A Kubernetes namespace is a virtual cluster partition that scopes names, quotas, and access so teams and environments can share one cluster safely.
Chisato · · 4 min read Continuous delivery keeps code always releasable, with a human approving the final push. Continuous deployment removes that gate and ships automatically.
The Lycoris Team · · 4 min read Point-in-time recovery restores a database to any moment between backups by replaying transaction logs, undoing bad deploys and accidental deletes.
The Lycoris Team · · 3 min read Docker Compose defines multiple containers, networks, and volumes in one YAML file so you can start a whole application stack with a single command.
Chisato · · 4 min read A container escape is when code running inside a container breaks out to access the host system, defeating the isolation containers are meant to provide.
Chisato · · 4 min read A Kubernetes Job runs a pod to completion once; a CronJob runs Jobs on a recurring schedule. How each controller works and when to use them.
Chisato · · 4 min read A Kubernetes DaemonSet runs exactly one copy of a pod on every node in the cluster, automatically, for tasks like logging and monitoring agents.
Chisato · · 3 min read A runbook is a step-by-step document for handling a specific operational task or incident, turning tribal knowledge into a repeatable procedure.
Chisato · · 4 min read ConfigMaps store non-sensitive configuration; Secrets store credentials with base64 encoding and tighter access controls. When to use each.
Chisato · · 4 min read A NAT gateway lets private-subnet resources reach the internet outbound while staying unreachable from it, translating private IPs to a public one.
Chisato · · 4 min read Deployments manage interchangeable, stateless pods; StatefulSets give each pod a stable identity and storage. When each one actually belongs.
Chisato · · 5 min read Multi-cloud spreads workloads across public cloud providers; hybrid cloud connects private infrastructure to a public cloud. How they differ and why it matters.
Chisato · · 5 min read A Kubernetes operator encodes operational knowledge into software, automating tasks a human admin would otherwise do by hand for a specific application.
The Lycoris Team · · 4 min read Distributed tracing follows a single request as it crosses service boundaries, using spans and trace IDs to reconstruct the full call path and find where time goes.
Chisato · · 5 min read Exponential backoff spaces retries further apart after each failure so clients stop hammering a struggling service. How it works, and why it needs jitter.
Chisato · · 5 min read Logs, metrics, and traces each answer a different question about a running system — what each captures, and how they work together.
Chisato · · 5 min read Terraform and Ansible solve different infrastructure problems: declarative provisioning versus procedural configuration. When to use each, and when to use both.
Chisato · · 4 min read A monorepo holds all projects in one repository; a polyrepo splits them apart. Trade-offs in tooling, ownership, and CI/CD for each approach.
The Lycoris Team · · 4 min read An SBOM is a complete inventory of every component in a piece of software, including its dependencies. Why it matters for tracking vulnerabilities at scale.
Chisato · · 4 min read Active-active runs every region live and load-balanced; active-passive keeps a standby idle until failover. How each affects cost, consistency, and recovery.
The Lycoris Team · · 3 min read A container registry stores and distributes container images by content-addressed layers, letting Docker and Kubernetes pull only what's changed.
Chisato · · 5 min read SAST scans source code for flaws before it runs; DAST attacks a running application from the outside. How the two testing approaches differ and when to use each.
Chisato · · 4 min read The twelve-factor app is a set of principles for building portable, scalable cloud software. Each factor explained, and why they still hold up today.
Chisato · · 4 min read Ingress and Gateway API both route external traffic into a Kubernetes cluster. Gateway API is the more expressive successor — here's how they differ.
Chisato · · 4 min read Log aggregation collects logs from every service into one searchable system, so debugging a distributed app doesn't mean SSHing into a dozen machines.
Chisato · · 4 min read Kubernetes HPA scales pod replica count; VPA resizes CPU and memory requests per pod. How each autoscaler works and when to use them together.
Chisato · · 6 min read JetBrains patched CVE-2026-63077, an unauthenticated RCE affecting all TeamCity On-Premises versions. Why a CI/CD server is a supply-chain crown jewel.
Chisato · · 4 min read A VPC is an isolated, software-defined network inside a public cloud. How subnets, routing, and security groups fit together to keep resources private.
Chisato · · 4 min read Infrastructure drift is when a system's real-world state diverges from what its infrastructure-as-code declares. Causes, detection, and how to prevent it.
Chisato · · 5 min read A Helm chart bundles a Kubernetes application's manifests into a templated, versioned package you can install, upgrade, and roll back as one unit.
Chisato · · 4 min read Secrets management stores API keys, passwords, and certificates in a dedicated system instead of config files, with access control, rotation, and audit logs.
Chisato · · 4 min read A liveness probe restarts a stuck container; a readiness probe pulls it from traffic without restarting it. How Kubernetes uses each one.
Chisato · · 4 min read Infrastructure as code defines servers, networks, and services in version-controlled files instead of manual setup. How IaC works and why teams use it.
Chisato · · 4 min read Docker images are stacks of read-only layers cached by content hash. How layer order affects build speed, cache hits, and final image size.
Chisato · · 4 min read Horizontal scaling adds more machines; vertical scaling adds more power to one machine. How each works, their limits, and when to use which.
The Lycoris Team · · 4 min read Object, block, and file storage organize data differently and suit different workloads. How each one works and how cloud providers implement them.
Chisato · · 4 min read An API gateway and a reverse proxy both sit in front of your services, but a gateway adds API-specific logic a plain proxy doesn't. Here's the difference.
Chisato · · 5 min read A database migration is a version-controlled script that changes a schema incrementally. How migration tools track state and apply changes safely.
Chisato · · 4 min read Immutable infrastructure replaces servers instead of patching them in place — every change ships as a new, versioned artifact. How it works and why.
Chisato · · 4 min read The circuit breaker pattern stops a service from hammering a failing dependency, failing fast instead and giving the downstream system room to recover.
Takina · · 4 min read A feature flag is a runtime switch that turns functionality on or off without a deploy, used for gradual rollouts, A/B tests, and instant kill switches.
Chisato · · 3 min read The sidecar pattern runs a helper container alongside your app in the same pod, adding logging, proxying, or security without touching app code.
Chisato · · 4 min read GitOps uses a Git repository as the single source of truth for infrastructure state, with an automated agent reconciling the live system to match it.
Chisato · · 4 min read An SLI measures reliability, an SLO sets an internal target for it, and an SLA is the contractual promise built on top. Here's how the three fit together.
Chisato · · 4 min read Chaos engineering deliberately injects failures into production-like systems to find weaknesses before real outages do. How it works in practice.
Chisato · · 4 min read Edge computing runs code and stores data near where it's generated instead of in a centralized data center, cutting latency and bandwidth costs.
Chisato · · 4 min read Observability is the ability to understand a system's internal state from its external outputs — built from logs, metrics, and traces working together.
Chisato · · 4 min read A cron job runs a command automatically on a fixed schedule defined by a five-field expression. How cron syntax works and where it's still used today.
Chisato · · 4 min read Blue-green deployments switch traffic all at once between two environments; canary deployments shift it gradually. How each works and when to use them.
Chisato · · 5 min read A reverse proxy sits in front of servers, forwarding client requests and hiding backend topology. TLS termination, caching, and load balancing explained.
Chisato · · 4 min read A service mesh is a dedicated infrastructure layer that handles service-to-service traffic, retries, and encryption without changing app code.
Chisato · · 4 min read One faulty CrowdStrike update blue-screened 8.5 million Windows machines and grounded flights. A teardown of how a config file became a global outage.
Chisato · · 5 min read Pods, Deployments, and Services are the three Kubernetes objects every beginner must understand. What each one does and how they fit together.
The Lycoris Team · · 4 min read Monoliths ship faster early; microservices buy independent scaling and team autonomy at the cost of distributed complexity. How to choose.
Chisato · · 5 min read Docker builds and runs containers; Kubernetes orchestrates fleets of them. What each tool does, how they work together, and when Compose is enough.
Chisato · · 5 min read Stop deploying by hand. Learn how to set up continuous integration and deployment with GitHub Actions — tests on every push, deploys on every merge.
The Lycoris Team · · 5 min read Platform engineering transforms DevOps into a product mindset, giving developers self-service golden paths so they can ship without becoming Kubernetes experts.
The Lycoris Team · · 4 min read Apache Kafka is a distributed event-streaming platform built on a durable, append-only log. How topics, partitions, and consumers power real-time pipelines.
The Lycoris Team · · 4 min read Terraform lets you declare cloud infrastructure as code and provision it reproducibly across AWS, GCP, and Azure. How plan/apply, state, and modules work.
The Lycoris Team · · 5 min read Supply chain attacks exploit your dependencies, not your code. Learn SBOMs, SLSA, and Sigstore to defend against them before a CVE drops.
Chisato · · 2 min read Docker packages your app and everything it needs into one portable container. Learn the core concepts and ship your first containerized app in minutes.
The Lycoris Team · · 4 min read Serverless means deploying code without managing servers — the platform scales it and you pay per use. How it works and where it fits.
Chisato · · 5 min read eBPF runs sandboxed programs inside the Linux kernel without recompiling it. How it works and why it reshaped observability, networking, and security.
Chisato · · 6 min read Kubernetes (K8s) is the open-source system for deploying, scaling, and managing containers. A plain-English definition, core concepts, and when to use it.
