The Kubernetes API server handles all of the requests to your Kubernetes cluster. But how does it actually work? When you type kubectl apply -f my.yaml, your YAML is sent to the API and stored in etcd.

Generate a variety of suspect actions that are detected by Falco rulesets.

NooBaa is an object data service for hybrid and multi cloud environments. NooBaa provides an S3 object store service (and Lambda with bucket triggers) to clients both inside and outside the cluster, and uses storage resources from within or outside the cluster, with flexible placement policies to automate data use cases.

PigeonEye is a fast, native Kubernetes GUI. Every resource type your cluster serves — including every CRD — shows up automatically, with the same columns kubectl get prints.

Run singleton workloads through node drains, upgrades, consolidation and spot reclaims, without paying for a second replica around the clock.

Open-source, Kubernetes-native Workspace-as-a-Service. helm install it on any cluster (the only prerequisite is cert-manager) and give people a full remote desktop — Linux (VNC) or Windows (RDP via KubeVirt, auto-detected) — accessible from any browser.

Write egress rules against hostnames instead of hand-curated CIDR lists. The controller resolves them to IPs, tracks DNS TTLs, and reconciles a standard networking.k8s.io/v1 NetworkPolicy — so enforcement stays with whatever CNI you already run.

Portager is a Kubernetes operator that declaratively syncs container images between OCI-compliant registries. Define an ImageSync custom resource specifying source images, a destination registry, a cron schedule, and authentication — the operator handles the rest.

Alex Palcuie helps keep Claude running at Anthropic; he is on-call and handles incidents. When he gave a talk called Can Claude fix itself? in March, his answer was “no.” At Signals Berlin earlier this month, that had become a "maybe": Claude can investigate production systems, come up with valid fixes and surprise Alex with Move 37* moments, yet it can also still send responders chasing a convincing, wrong explanation.

In this post, we’ll look at how small changes to a single algorithm reduced the memory footprint of one of our Pingora-based services significantly. That allowed us to reclaim more than 100TB of RAM globally, on top of the 100TB of memory the DNS team was able to shed last month.

Stratum is Netflix’s internal serverless media processing platform, shaped by over a decade of experience developing large-scale distributed systems. It powers a wide range of media workloads — including encoding, packaging, inspection, and quality scoring — behind playback, advertising, studio workflows, AI embeddings, and more.

At ACRL, we’ve identified five “key metrics” that you should be tracking for your autoscaling engines, and—spoiler—they might not be the normal ones you think of.

I was at dinner with a bunch of CTOs and Head of Infrastructure folks recently, and from the conversation it was clear that many companies are struggling to source CPUs in the current climate, and are coming to terms with the end of juicy discounts from cloud providers for machines in the new era of surging demand fueled by AI.

KiviDB is a fast, multi-threaded alternative to Redis® and Valkey, written in Rust. It speaks the Redis protocol (RESP2 and RESP3), so existing Redis clients, redis-cli and libraries work unchanged, and it has full-text and vector search built in. It runs every core on a sharded in-memory key-value design, and persists to snapshots and an optional append-only file.

SPACE (Sandboxed Platform for Agentic Code Execution) is a sandbox platform for running code in isolated Firecracker microVMs. Applications use its HTTP API to create Linux environments, execute commands, collect output, and manage sandbox lifecycles.

Use SPACE when your application needs a separate execution environment for an agent, a user workspace, or a code-running job. Your application decides what to run and what results to keep; SPACE manages the sandbox, its processes, and the connection carrying command output.

A small Go heap does not always mean low container memory usage. The heap shares the container's memory limit with goroutine stacks, runtime metadata, cgo allocations, and memory mapped directly from the operating system. Linux can kill a Go process even when its heap looks healthy.

A Wi-Fi toggle took an IAP tunnel almost three minutes to recover. Why the relay reconnect stalls, and what close codes 4033, 4003 and 4047 mean.

Google says to verify the RDP thumbprint from serial port 1. On a real VM it was gone. How the password reaches you, what CredSSP protects, and the errors in between.