SPACE (Sandboxed Platform for Agentic Code Execution) is a sandbox platform for running code in isolated Firecracker microVMs. Applications use its HTTP API to create Linux environments, execute commands, collect output, and manage sandbox lifecycles.

Use SPACE when your application needs a separate execution environment for an agent, a user workspace, or a code-running job. Your application decides what to run and what results to keep; SPACE manages the sandbox, its processes, and the connection carrying command output.

A small Go heap does not always mean low container memory usage. The heap shares the container's memory limit with goroutine stacks, runtime metadata, cgo allocations, and memory mapped directly from the operating system. Linux can kill a Go process even when its heap looks healthy.

A Wi-Fi toggle took an IAP tunnel almost three minutes to recover. Why the relay reconnect stalls, and what close codes 4033, 4003 and 4047 mean.

Google says to verify the RDP thumbprint from serial port 1. On a real VM it was gone. How the password reaches you, what CredSSP protects, and the errors in between.

Collaborative multi-agent AI coding workspace: aggregate sessions from Claude Code, Codex, OpenCode, Pi, Grok Build, etc. Desktop app, self-hosted server, or Docker.

difit is a CLI tool that lets you view and review local git diffs with a GitHub-style viewer. In addition to clean visuals, comments can be copied as prompts for AI. The local code review tool for the AI era!

PaperPilot is a PDF and document toolkit written in Rust.

The project is called Modelplane. It lets a platform team turn a pile of accelerators (across clouds, neoclouds, and on-premise) into one fleet. It also lets the ML teams they support deploy a model and get a stable, OpenAI-compatible endpoint without thinking about where it runs.

This article is the architecture I'd build to get from 2 to 25 regions without that fear: a GitOps-first model where each region is an independent, self-healing control loop, deployments are declarative commits, and rollback is a git revert scoped to exactly one region — fully isolated from every other.

It became crystal clear that the only way to get real savings was to resize everything, all at once, cluster by cluster, automatically.

We're Dodo Payments, a payment and billing infrastructure company. We process real money for businesses across multiple countries. That means PCI DSS compliance isn't optional - it's existential. And PCI requires something we didn't have: a complete, auditable trail of every change to our production environment.

We built a working prototype of Apache Kafka distributed across three independent Kubernetes clusters using Strimzi, Submariner, and Cilium, achieving zero-downtime failover when an entire cluster goes down.

I spent a while building a backup-and-restore test environment with Velero, running MariaDB, PostgreSQL, and MongoDB under load, and learned that backing up databases on Kubernetes has two hard problems, not one. The first is getting a backup that isn't subtly corrupt. The second is getting that backup to restore somewhere else and actually run.

Following the Journey of a Secret from an External Secret Store to Your Pod.

How separating log collection from log aggregation eliminated data loss during crashes, rolling updates, and infrastructure failures.

If you have a multi-cluster EKS deployment for your development, QA and staging environments, those generally don't need to run at 3AM. No one is using any of that, except for maybe a few cronjobs to refresh data. Everything else is wasted idle compute.

A developer writes a Dockerfile, adds a secret to set something up, then deletes the file a few lines later and pushes the image. From the container's perspective, the file is gone. But the secret is still in the image — permanently — and anyone with access to the image can pull it out with nothing more than tar and a few shell commands.

Here's the thing: cert-manager can issue that cert too. It can issue certs for anything you own a DNS name for, whether it runs in Kubernetes or not. Most teams don't know this.