DevOps&SRE Library

Ship one musl-linked executable. At runtime, load the user's existing glibc-linked GPU driver. No container, no AppImage, and no second libc in the process.

In high-performance networking, 35 seconds is a lifetime. This was the latency required to iterate through our connection tracking table of 7 million entries at a maximum speed of 200,000 entries per second. At our 16-million-entry peak, this sequential lookup could take up to 80 seconds, leading to Cilium CNI timeouts preventing new pods from starting on affected nodes.

Tailcat is a remix of Tailscale open source pieces to act like netcat, but over Tailscale's data plane, without Tailscale's control plane. Tailscale's data plane (magicsock, internally) gives you point-to-point WireGuard®-encrypted tunnels between two machines with DERP as the NAT-hole-punching communication side channel and the ultimate relay-of-last-resort if NAT traversal fails. Instead of using the Tailscale control plane, all tailcat connection metadata is exchanged out of band, however you want.

You see someone declare a Sev-2 and you wonder: wait, why is that even an incident? Nothing is down. Customers aren't affected. But a manager needed to get their team's problem to the top of another team's priority queue, and the incident process was a reliable way to make it happen.

Data Plane API is a sidecar process that runs next to HAProxy and provides API endpoints for managing HAProxy. It requires HAProxy version 1.9.0 or higher.

Agent Substrate delivers a performant, high density runtime environment for large scale agent deployments. At its core, Agent Substrate maps a larger set of "actors" (applications such as agents) onto a smaller set of ready "workers", relying on the fact that agent-like applications tend to be idle most of the time to achieve heavy multiplexing.

Kubernetes cluster cost optimizer. Connects to a live cluster (or a saved snapshot), collects every scheduling constraint, and uses CP-SAT constraint programming to find the cheapest node fleet that still satisfies all placement rules.

Synthetic monitoring for gRPC server-side streams — open each stream, verify frames actually arrive, and export Prometheus metrics.

k8s-mechanic is a Kubernetes controller that watches your cluster for failures, investigates them automatically, and opens pull requests on your GitOps repository with proposed fixes — all without leaving your cluster. When a Pod is crash-looping, a Deployment is degraded, or a Node goes NotReady, mechanic spawns an in-cluster OpenCode agent that inspects the live cluster, locates the relevant manifests in your GitOps repo, determines the root cause, and opens a PR.

Ephemeral environments are short-lived, isolated, fully provisioned, on-demand test environments created automatically from a pull request and destroyed the moment their job is done. This guide walks through why traditional environments fail, what ephemeral environments actually are, the modern stack that powers them, and a concrete, code-level blueprint for building your first ephemeral testing pipeline.

We drained a Network Load Balancer during a planned migration, and one internal service kept hammering the dead IPs for 8 minutes. The cause wasn't the failover. It was a JVM caching the DNS record forever. The fix was a 30-second TTL and a health-check tweak, not a smarter system.

You've scaled up your Kubernetes cluster. EC2 instances are running. CPU and memory metrics look reasonable. And yet — the number of completed Dagster runs stubbornly refuses to climb. This article walks through the full diagnostic journey — from the obvious knobs to the hidden PostgreSQL bottleneck that probably nobody warns you about.

OpenViking is an open-source context database for AI agents. It stores memories, resources, and skills as one virtual filesystem under the viking:// protocol, so an agent browses its own context with ls, tree, and find instead of querying a black-box vector store. Content is processed into three tiers — L0 abstract, L1 overview, L2 details — and loaded on demand. Every retrieval leaves a trajectory you can watch and debug.

A fast, rootless sandbox and virtual resource runtime for any workload, including untrusted and AI-generated code. Daemonless: a real, kernel-enforced container in ~3.5 ms from an OCI image, no daemon, one 1.52 MB static binary.

PicoMQ is durable, real-time streams over HTTP, built on S3-compatible object storage.