Notes on platform engineering, AI tooling and craft.
September 2, 2026
Kubernetes v1.37 was released on 26 August 2026. Most of the changes being attributed to it landed in v1.34 and v1.35, one is still a release away in v1.38, and the one that can genuinely leave pods stuck in ContainerCreating is barely being mentioned. Here is the ledger, the audit to run before you upgrade, and the runbook.
Read article →August 27, 2026
Kubernetes 1.37 shipped one deprecation and it is kube-proxy's ipvs mode. Off by default in 1.40, source deleted in 1.43. Here is the switch to nftables, the kernel floor, the four behaviours that change, and the trap that catches clusters not running ipvs at all.
Read article →August 24, 2026
containerd 1.7 leaves extended support in September 2026, and that extension only ever covered Kubernetes versions that are already end of life. Here is the version-3 config rewrite, the registry conversion that breaks clusters, and the one branch worth upgrading to.
Read article →August 23, 2026
systemd 258 removed cgroup v1 outright, so your hosts now boot unified whether or not anything asked them to. Here is the audit, the file-by-file conversion, and the four claims about this migration that are simply wrong.
Read article →August 21, 2026
systemd 260 deleted the sysv-generator, rc-local.service and systemd-sysv-install. Every /etc/init.d script and every /etc/rc.local on your fleet is now on a clock. Here is how to find them and convert them properly.
Read article →August 20, 2026
The API floor moved twice, the image store only changes on fresh installs, and every container's file-descriptor limit quietly dropped from 1048576 to 1024. Nine months of fallout, checked against upstream.
Read article →August 17, 2026
The upgrade path opens on 27 August with 26.04.1. Six defaults changed underneath you, and one of them can leave a cloud instance that never boots again.
Read article →August 16, 2026
Key agreement is solved and shipping; signatures are not. A working guide to auditing and fixing SSH and TLS on real infrastructure.
Read article →August 15, 2026
The controller that fronts about half of all cloud native environments was archived in March 2026. A practical migration guide: what actually breaks, what ingress2gateway will not convert, and a rollout you can reverse.
Read article →August 14, 2026
What the MCP specification already mandates, what the 2026 coding-agent CVEs actually broke, and the controls that hold: audience validation, tool pinning, sandboxing, egress policy and audit.
Read article →August 5, 2026
A documented history from DevOps to MLOps and LLMOps, plus a production guide to prompts, RAG, evaluations, observability, security and cost.
Read article →Agentic AI is less about bigger models and more about reliable tool use. A field guide to the open-weight stack — Nous Research’s Hermes and NVIDIA’s Nemotron — and how to build agents that do not fall over.
Read article →Microsoft Fabric puts your data in OneLake; Copilot Studio lets you build agents on top of it. Here is how the two connect — grounding, the SQL endpoint, Fabric data agents — and the traps to avoid.
Read article →Data lakes are cheap but messy; warehouses are fast but rigid. The lakehouse pattern — Delta Lake, Unity Catalog and the medallion architecture — is how Databricks fuses both. Here is what actually matters.
Read article →Published May 24, 2026
Two decades of IAM experience condensed into a candid comparison: licensing maths, protocol flexibility, Conditional Access, migration pain, and why most enterprises end up running both.
Read article →Published May 27, 2026
A hands-on comparison of the two leading open-source AI agents: persistent memory vs plugin ecosystem, seven-layer security vs plugin CVEs, skills vs 5,700 plugins, and why Hermes wins for long-term workflows.
Read article →Published May 21, 2026
A candid look at SailPoint’s real value: certification excellence vs implementation pain, BeanShell debt, upgrade nightmares, and when you should pick something else.
Read article →Published May 18, 2026
The real-world pain of BeanShell rules and custom connectors in SailPoint IdentityIQ: null traps, silent failures, BuildMap errors, and what changes when you move to ISC.
Read article →Published May 15, 2026
The hard truths about migrating from SailPoint IdentityIQ to Identity Security Cloud: what breaks, what gets lost, and why your custom Java rules are now a liability.
Read article →May 10, 2026
Production patterns for running Keycloak in HA mode: database replication, Infinispan rebalancing, load balancer config, and what happens when a node disappears.
Read article →May 13, 2026
A practical guide to Keycloak recovery scenarios: split-brain in Infinispan, corrupted database sequences, stuck migration, dangling sessions, and broken trust stores.
Read article →April 30, 2026
Three principles I keep coming back to when teams ask me what their cloud should look like once it stops being a prototype.
April 25, 2026
A practical mental model for designing IAM that survives growth without turning into the team that rubber-stamps wildcards.
April 22, 2026
Three patterns I lean on to bring modern AI into enterprise platforms without turning the team into permanent firefighters.
April 18, 2026
A practical map of which local AI workflows are real and which only look real, on a Mac with 16 GB of unified memory.
April 12, 2026
A pragmatic decision guide for picking between systemd timers and cron, written from the trenches of running both for years.
April 5, 2026
How I keep a fast, repeatable Mac dev setup without ending up with 600 packages I cannot account for.
March 28, 2026
I have run Kubernetes in production for years. Here are the four signals that tell me a team should not be running it yet.