In-Depth Guides & Analysis
Deep technical dives into cloud architecture, Kubernetes, CI/CD pipelines, and infrastructure best practices.
Showing 1-30 of 125 articles
Page 1 of 5
How You Overpay on AWS by Choosing the Wrong Service
Six AWS pairs where the pricier service is sized for a problem you may not have, what drives each bill, and read-only commands to check which side you are on.
Read articleMoving EKS to Production, and the Five Bills Nobody Budgets
Five recurring AWS charges that switch themselves on when an EKS cluster reaches production, what starts each one, and how to see where you stand.
Read articleA cPanel Account With Email Access Can Reach Root, and Every Supported Version Is Affected
CVE-2026-67401 lets an authenticated cPanel account holder with mail privileges create arbitrary files and run code as root. cPanel lists all supported versions as affected and has shipped patched builds. The precondition is an ordinary customer account, which on a hosting platform anyone can buy.
Read articleThe Magento Hotfix Is Out, and Adobe Wants Your Payment Gateway Keys Rotated Too
Adobe published APSB26-146 on 7 September for CVE-2026-75650, a CVSS 10.0 unauthenticated code execution flaw it confirms is being exploited. The fix is a composer hotfix rather than a version bump, and Adobe's own remediation asks you to rotate credentials at your payment provider as well.
Read articleWho Holds REPLICATION on Your Postgres, and Why CVE-2026-6471 Makes It Matter
CVE-2026-6471 turns a PostgreSQL replication grant into code execution on the database host. It needs an account you already created, the patch has been out since 13 August, and the useful question is not the version number but who in your database still holds REPLICATION.
Read articleA Magento Zero-Day Is Being Exploited Now, and the First Victim Was Fully Patched
StyleSmuggler is an unauthenticated remote code execution flaw in every current version of Magento Open Source and Adobe Commerce. Attacks started on September 4 and the first confirmed victim was fully up to date. Written while no patch existed; Adobe has since shipped one as CVE-2026-75650.
Read articleWhat Your Startup Runs, and What You Are Paying For
Two lists settle the cloud question for an early team: what the product runs, and what the platform is priced around. DigitalOcean and AWS on Kubernetes.
Read articleThe GitHub to GitLab Migration Nobody Warns You About
GitLab imports your repositories, reviews and history almost completely. It imports none of your GitHub Actions. What moves, what you rewrite, and when.
Read articleHow to Give Applications AWS Credentials Without Storing Any
Every long-lived access key in your account is a copy waiting to leak, and no amount of rotation discipline fixes that. The alternative is to have no key at all, because each place an application normally needs credentials already has a mechanism that hands it fresh ones on demand. This walks through instance profiles on EC2, task roles on ECS, EKS Pod Identity and IRSA on Kubernetes, and OIDC federation for a CI pipeline, with the trust policy shape for each. It also covers the one condition in the CI trust policy that decides whether the whole thing is secure or theatre.
Read articleHow to Reach a Private RDS Without a Bastion Host
A jump host with a public IP and an open SSH port is the most commonly attacked thing in a lot of AWS accounts, and it exists only so somebody can occasionally run a query. Systems Manager forwards a local port through a managed node to any host that node can reach, so the database stays in its private subnet and nothing accepts inbound connections. This covers the exact command, the agent version and permissions it needs, how it works with no NAT gateway at all, and how to drop the stored database password as well.
Read articleHow to Recover an EC2 Instance You Can No Longer SSH Into
When a box stops answering there is an order to work through, and two of the options only exist if somebody enabled them on a calm afternoon months earlier. This covers what the status checks are telling you, reading console output, the serial console and everything it needs configured in advance, and the volume detach and reattach route as the last resort. The part worth reading before you need it is which mechanisms have prerequisites, because that decides what is available to you at 2am.
Read articleHow to Make an S3 Bucket That Cannot Be Deleted by Accident
Protecting a bucket against a mistake and protecting it against a stolen credential are two different jobs, and the settings that do one do not do the other. This walks through versioning, MFA delete and Object Lock in both of its modes, what each one can and cannot be undone by, and where an attacker with the right permission walks straight through your protection. Several of these settings cannot be reversed once enabled, including one where AWS says the only remaining way to delete the data is to close the account, so the warnings sit next to the commands.
Read articleHow to Stop Paying for NAT Gateway Traffic You Do Not Need
A large share of NAT gateway spend on a typical account is traffic to AWS services that could have reached those services privately, and it shows up as one anonymous line on the bill. This shows how to tell AWS-bound traffic from internet-bound traffic in Cost Explorer, how to find the exact destination in flow logs, and which endpoint type actually removes the charge. It also covers the traps, including why a bucket in another Region keeps going out through the NAT after you add the endpoint.
Read articleHow to Set Up Budgets and Anomaly Detection Before the Bill Surprises You
Finding out about a spend problem from the invoice means finding out weeks late. AWS gives you two different mechanisms for catching it earlier, and they are not interchangeable. A budget fires when a number you chose is crossed, while Cost Anomaly Detection models what your spend normally looks like and tells you when the shape changes. This walks through setting up both from the CLI, the delay each one carries between the spend happening and the alert arriving, who should be on which notification, and the charges neither one will catch for you.
Read articleHow to Choose Between ALB, NLB and CloudFront for Your Traffic
The three services sit at different layers, accept different protocols, and a handful of the choices you make when you create them cannot be changed afterwards. This is what each one is actually for, where the protocol list makes the decision for you, the two cases where the right answer is a pair of them working together, and the settings that mean rebuilding rather than editing if you get them wrong.
Read articleHow to Run Multi AZ So It Actually Survives an AZ Failure
Most AWS accounts are multi AZ on paper already, and then a zone has a bad day and the site goes down anyway. Spreading a deployment across zones and keeping it serving when one disappears are two different properties. This covers what the managed services really do during a zone failure, including which failovers reset every open connection and how long each one takes, the single points that quietly survive a multi AZ design, and the commands to rehearse all of it on purpose.
Read articleHow to Migrate a Server to AWS Without a Big Bang Cutover
A big bang cutover is a plan with exactly one attempt in it. The incremental version costs a little more elapsed time and keeps a working rollback available until the very last step. This walks through the inventory that decides whether the cutover is clean, continuous replication that runs while the old server keeps serving, a dress rehearsal you can repeat, the DNS time to live arithmetic you have to do backwards from the cutover date, and the single action that ends the rollback window for good.
Read articleHow to Set Up Least Privilege IAM Without Blocking Your Own Team
Least privilege earns its reputation for costing a week of tickets whenever someone writes the minimal policy first and discovers what was missing by breaking people's work. The order that avoids that is the reverse. Cap the blast radius, let the team work, collect evidence about what was actually used, and tighten against the evidence. This covers the AWS reporting that supplies the evidence, exactly what data each report is built from and what it silently omits, and the checks that catch an over-tightened policy before it ships.
Read articleHow to Upgrade PostgreSQL Major Versions With Almost No Downtime
An in-place major upgrade takes your database down for as long as the upgrade runs, and once it has started there is no way back. Logical replication turns that into a cutover you can measure in seconds, with the old server still consistent and still able to take traffic if the first minute goes badly. The method works because the new server is built and caught up while the old one keeps serving. The risk is entirely in what logical replication declines to carry across, so this guide spends most of its time on sequences, DDL, large objects and tables without a replica identity.
Read articleHow to Change a Schema on a Busy MySQL Table Without Locking It
A plain ALTER on a large InnoDB table can hold up every writer until it finishes, which on a busy table means an outage nobody scheduled. Modern MySQL does far more instantly than most teams realise, so the first job is checking whether you need a tool at all. When you do, the copy-and-swap approach builds a shadow table, keeps it in step from the binary log, and swaps the two at the end. This guide covers what the table has to look like for that to work, and how to stop a migration safely once it is running.
Read articleHow to Run Ephemeral CI Runners on Your Own Hardware
A build that passes because of something left behind by the previous build is not a passing build, it is a coincidence. Ephemeral runners remove that class of problem by giving every job a machine that has never run anything else. GitHub supports this directly through single-use runner registration and just-in-time configuration, so the runner deregisters itself after one job and your automation disposes of the host. This guide covers both approaches, the Kubernetes version, and the one situation where self-hosted runners are the wrong answer.
Read articleHow to Keep a Build Cache That Survives Ephemeral Runners
Throwing away the runner after every job is the right call, and it costs you the build cache unless the cache lives somewhere else. On GitHub Actions it already does, which means the real work is writing keys that hit instead of keys that always miss. This guide covers restore-keys and how partial matching actually resolves, the hidden part of a cache key that nobody sets, why a cache saved on a feature branch is invisible to main, and what to do when a bad cache entry starts poisoning every run.
Read articleHow to Handle Secrets in CI Without Leaking Them Into Logs
The safest credential in your pipeline is the one that does not exist between jobs. OpenID Connect lets a workflow authenticate directly to a cloud provider and receive a token that expires on its own, which removes the stored key entirely. Masking is the backstop for everything left over, and it is worth knowing exactly where it stops working, because it relies on finding an exact match for the value. This guide covers the short-lived credential setup, the limits of redaction, and what to actually do in the ten minutes after a secret reaches a log.
Read articleHow to Restore One Table From a Full Cluster Backup
Somebody emptied one table and the rest of the database is still taking orders. Restoring the whole backup over production would throw away every write since the dump, to fix damage that lives in a single table. This is the side restore instead, with the format choice that decides whether selective restore is even possible, the pg_restore flags that behave differently from the pg_dump ones you know, and the foreign keys and sequences that turn a successful restore into a broken application an hour later.
Read articleWhat a Real Disaster Recovery Drill Looks Like on a Tuesday
A recovery plan gets tested one of two ways, on a Tuesday morning with a scenario and a stopwatch, or at three in the morning with a customer on the phone. This is the first version, run in working hours and announced in advance, because the failures worth finding are missing documents and expired credentials rather than whether anyone can be woken up. What to scope, the four numbers to measure, what counts as a pass, and the failures a drill turns up nearly every time.
Read articleHow to Patch on a Schedule Without a Maintenance Window
A quarterly maintenance window means three months of known vulnerabilities waiting for a Saturday night, and then forty machines changing at once while everyone is asleep. Patching continuously and restarting in waves gets fixes on faster and removes the outage entirely. Here is the configuration that actually applies updates rather than only downloading them, how the machine tells you whether a reboot is genuinely required, and how to build waves so no two hosts behind the same load balancer ever go down together.
Read articleHow to Read a CVE and Decide in Ten Minutes If It Touches You
An alarming headline and a severity score are not a decision, and the score cannot become one because the part of it that would describe your environment is the part nobody filled in. This is the ten minute route from a CVE number to a defensible answer, covering what the scoring specification actually says, why your installed version number may be lying about whether you are patched, and which public sources report real exploitation rather than the possibility of it.
Read articleHow to Configure Varnish for Magento So It Stops Caching the Wrong Thing
Varnish in front of Magento serves anonymous pages without touching PHP. The wrong Varnish in front of Magento serves one shopper's cart to everybody, which is worse than having no cache at all. Magento generates its own configuration and most of the work is using that rather than something copied from a forum. This covers what the generated file refuses to cache and why, how invalidation actually works as a ban rather than a purge, the two ways it silently fails, and how to prove a page came from cache.
Read articleHow to Back Up and Restore etcd Before You Need It
A verified etcd snapshot is the difference between a control plane you rebuild in twenty minutes and a cluster you reassemble from memory over a weekend. This walks through taking a snapshot on a self-managed cluster, proving the file is actually restorable rather than merely present, and bringing a cluster back that no longer comes up. It also covers the commands that moved between binaries in recent etcd releases, because the old ones are the ones everybody copies.
Read articleHow to Run Postgres on Kubernetes With Point in Time Recovery
A nightly dump cannot answer the question that actually gets asked after an incident, which is to put the database back the way it was at 10.42, just before the migration ran. Continuous archiving can. This is an operator based setup on Kubernetes with base backups and write ahead log shipped to object storage, plus recovery to a named timestamp. It also flags the configuration change that makes most copied CloudNativePG YAML out of date.
Read article