Blog

After a server migration, builds against a self-hosted package registry got two minutes slower and every report pointed at the move. Every failing request was a 500 in 45 milliseconds; the entire regression was npm's retry backoff. The root cause was one row out of 63,000 still pointing at an object store that no longer existed, and the check written to catch exactly that iterated a hand-written list of tables and missed it.

Anthropic shipped Opus 5.5 today at $4/$20 per million tokens, and its own table puts it ahead of Fable 5.1 and GPT-6 Astra on agentic coding. The independent numbers are smaller, the code-quality numbers are mixed, and thinking can no longer be turned off. Sonnet 5.5 is not out yet.

S3 has no empty directories, and in a fully packed git repository the refs directories are exactly that: empty. A file-by-file sync carried every object intact and dropped the two directories git requires to call something a repository, so 84 of 517 came back unreadable while the database still said they had commits. The migration's health checks stayed green the whole time, because none of them ever open a repository.

A topology spread constraint is only ever a statement about the population its selector matches, and an operator-set label can quietly pool sibling Deployments into one shared count. Three collectors each satisfied their hard zone spread while the union of them left a zone empty, and the standard repair converged on the same wrong answer every time.

Object storage bills per operation, and a ClickHouse part on an S3 disk is not one object but one per column. So the cost of a cold tier is a function of how many parts exist, not how many bytes they hold, and every setting that starves merges becomes a line on the bill. Two chart defaults did exactly that, and the fix that stopped it had never been committed.

A Kafka client wrapper that recovers by counting errors and panicking past a threshold is recovery proportional to traffic: stream processors trip it in seconds, quiet request-driven producers never do, and so they latch the last error and serve it indefinitely while every health signal stays green. The tell is in the error's own digits: an elapsed-time value that is byte-identical across occurrences is one cached event, not a recurring failure.

Databricks LakeBase Postgres is real, wire-compatible Postgres: standard drivers, pgvector, PostGIS, unmodified query engine. The marketing headline is database branching, Git for your database. That is the side effect. The mechanism is that the commit path moved off the machine: a transaction acks when a quorum of safekeepers accepts the WAL record, not when a local SSD flushes. Branching, scale-to-zero, and point-in-time recovery all fall out of that one sentence, and so do the costs.

Omarchy launched this summer and 37signals is moving the whole company to it on a three-year horizon. The interesting part is not the Linux part; it is that the distribution is the first one I have seen where the personality is the lead feature. The portable rule: the same opinionated default is a feature when its reasoning is visible and a bug when its reasoning is hidden.

Liquid AI shipped LFM2.5-DSpark on August 20: three draft models under the lfm1.0 license, with a 2.67× mean speedup on H100 and a 57% function-calling latency reduction on Apple Silicon. The headline number is the least interesting thing about the release. The interesting thing is why this kind of release can ship at all. Speculative decoding is exact under greedy decoding, which means it does not change the output. That property is the whole game.

During a parallel-run validation, a side-by-side per-service span count showed the new pipeline losing ~0.2% of spans per service across a 60-minute window. Read as regression in the new pipeline, it would have triggered a rollback. Read correctly, it was the old pipeline ingesting tens of thousands of duplicate rows in a few-second window. The storage layer has no unique constraint on the thing being counted; the unit it exposes as 'count' is not the unit the operator thinks it is.

A note in the project's knowledge bundle said the image was amd64-only and might not run on Graviton. Three independent checks agreed. The image was not amd64-only, and a native arm64 build succeeded with zero source changes. A claim that has been verified three times is the most dangerous kind of wrong claim.

Three times in one week I made a claim about a live migration by reading a config file, a name prefix, or a template, and twice the claim was wrong. The artefact and the live system are two views of the same thing, and they can agree for reasons the artefact can't tell you. Only one of the views is the truth.

A terraform plan came back clean for a managed observability stack after an incident fix had been applied by hand. The fix was live, the fix was in the file, and state alone was behind. A plan is a diff between two views, but the system has three. Reading all three before you plan is what turns the green diff from a guess into a decision.

We re-derived a collector config, confirmed it was byte-for-byte identical to the one running in production, and shipped it with a stack of green checks behind it. It crash-looped on startup. Byte-identical is a real property; it just answers a question nobody was asking.

A VPC in one account couldn't resolve names in a private zone owned by another. Peering was healthy, routes were right, the DNS-resolution flag was checked. Every signal was green, and the answer was still NXDOMAIN, because two different DNS layers were wearing the same green light.

For weeks a terraform plan showed drift I couldn't fix on an S3 bucket that was already configured correctly. I filed it under 'AWS provider quirk' and worked around it. The provider was innocent. My own code was lying to me before Terraform ever saw it.

Our CI pipeline was minting a valid EKS token, presenting it cleanly, and getting rejected. The problem was not AWS creds. It was EKS access control, and the failure was hiding in plain sight in the cluster's RBAC.

Hermes Agent runs on my mini-PC, drives my Mac, and handles the logistics around my blog, YouTube, and taxes, so I can spend my time on the parts that actually need me. Here is how it works.

Opus 5 shipped on July 24 as Anthropic's new default model. The benchmark table is a rounding error away from Fable 5 at half the cost. But the thing that will actually change your day is quieter: thinking is on by default now, and that breaks a few assumptions you have been carrying since 4.8.

A public endpoint went down twice in three days, and the same five-minute fix worked both times: delete an orphaned AAAA record. The real bug was a DNS record that can never own itself, sitting at the apex of a delegated zone.

Same instance type, half the pod density. Raising max pods on a live EKS cluster means a launch template the node group can never gain, a CNI setting that has to land first, and a Terraform plan carrying changes nobody asked for.

I wanted to know what changed architecturally between Sonnet 5 and Sonnet 4.6. Anthropic won't say. So I read the 146-page system card, and ended up writing a plain-English guide to every benchmark in it.

Every view that touched the cache returned 500 while the health check stayed green. The cause was a Service named redis and enableServiceLinks, a Docker-era Kubernetes default that injects environment variables you never asked for.

Databricks open-sourced Omnigent, a meta-harness that wraps any agent harness behind a unified API with policies, sessions, and shared state. If you have deployed stateful services to Kubernetes before, the path to self-hosting it is shorter than you think.

Every operator promises a simpler setup. The real payoff shows up later, when a replica loses its control file or a certificate is three weeks from expiring. Here is what StackGres and Strimzi actually changed about running PostgreSQL and Kafka on Kubernetes.

A green CI pipeline while the live gateway serves 404s is not a test failure. It is a silent reload gap. Here is the cross-release checksum pattern that closes it in helmfile.

I built a pipeline that reads my blog's RSS feed and posts informative Instagram carousels without me touching anything. The interesting part is not the automation. It is how agents built it and what they broke.

The government pulled the plug on Fable 5 and Mythos 5 seventy-two hours after launch over a jailbreak claim. If you build on closed AI APIs, this week should make you uncomfortable.

More than 25 open-weight model releases dropped last week across every modality. A breakdown of what each one does, which ones are actually deployable, and what the week means for infrastructure teams.

AI coding tools don't just write code faster. They generate dramatically more Git activity, pipeline runs, and context overhead than humans do. GitLab's Transcend 2026 announcements finally address that.

For years the advice was clear: pick a lane, go deep, become indispensable. Then AI agents arrived and quietly rewrote the rules.

Nous Research's self-improving AI agent running in a production-grade EKS setup. Private ECR, IRSA, API key secrets, and a custom Helm chart built from scratch.

Transit Gateway is the default everyone reaches for. For a handful of VPCs in a single region, peering is dramatically cheaper — and here's the math.

I built a full-stack Proxmox dashboard through vibe coding with Claude Code: 11K lines, 123 tests, 14 commits. Here's what the experience taught me about what actually matters in software engineering.

Attempting to delete a Kubernetes namespace and discovering it perpetually stuck in a Terminating state? The culprit typically involves finalizers — special metadata fields that prevent resource deletion until cleanup tasks complete.

Exploring Terraform's templatefile() function and its advantages over Jinja2 templating for infrastructure-as-code workflows. Why Terraform's minimalist approach to templating is intentional and beneficial.

How Kubernetes Operators automate complex operational tasks in containerized environments, addressing challenges that arise from managing microservices at scale.

The transition to WebGPU for AI and GPU computation represents a pivotal shift in how we'll experience artificial intelligence technology — democratizing access to advanced capabilities.

How Machine Learning Operations (MLOps) transforms AI development by streamlining model creation and deployment compared to conventional cloud-based approaches.