Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
Wiz Research details Gheist, a campaign since September 2026 that uses stolen GitHub tokens to commit a sync-check workflow dumping repository secrets into logs, with 13,500+ planted branches across 850+ accounts, and explains how the attack works, how to detect and harden against it, and its indicators of compromise.
5 min · 1,248 words
Preliminary Report: Oct 21st Security Incident
Railway's preliminary incident report on the October 20-21 targeted attack that reached a subset of internal systems, apparently seeking AI provider API keys for distillation, with a timeline, impact, remediation steps and customer FAQ.
9 min · 2,013 words
NixOS is making me less afraid
kqr of Entropic Thoughts describes how running NixOS servers changed their willingness to try self-hosted software: a working FreshRSS setup with backups took nine lines of Nix and has run hands-off for months. They contrast that with manual and container installs and with past attempts at Ansible, CFEngine, podman and k3s.
3 min · 763 words
Ben Congdon argues that AI agents are structurally well suited to monitoring production systems, building on Anthropic's description of Claude "superfans" that watch single components, with a change-point monitoring case study and thoughts on why agentic monitoring can catch subtle issues traditional alerts miss.
8 min · 1,948 words
Native Prometheus integration with NGINX
Categorica open-sources nginx-stats-prometheus, an MIT-licensed NGINX module that exposes Prometheus metrics directly from NGINX instead of running the separate NGINX Prometheus Exporter sidecar with its own web server, and explains the design and trade-offs.
5 min · 1,150 words
GitHub Actions workflow lockfiles in public preview
GitHub Actions workflow dependency lockfiles are in public preview: the gh actions-lock CLI extension pins actions, transitive and reusable-workflow dependencies to reviewed commits in .github/workflows/actions.lock, with an optional Require lockfile policy and Dependabot keeping lockfile entries in sync.
2 min · 434 words
E2exe: How we solved Windows desktop automation for enterprise scale
QA Wolf explains how it parallelizes Windows desktop app tests at scale: single-use VMs from warm pools on Google Compute Engine, driven from Linux over CDP and Appium, with one API across web, mobile and desktop.
10 min · 2,225 words
10 Years of the SRE book: Announcing the second edition of "Site Reliability Engineering"
Google announces a completely rewritten second edition of its Site Reliability Engineering book, ten years after the first: how SLOs, observability, automation, reliability testing, capacity management and SRE org models have matured, how SRE supports and uses AI, and why culture still matters.
3 min · 718 words
Announcing AWS Lambda Web Functions for fast, consistent web app performance anywhere
AWS introduces Lambda Web Functions: run standard HTTP servers (Express, Hono, Fastify, Next.js and other Node frameworks) on Lambda without event-handler adapters, with multi-concurrent requests, active CPU billing, one-command multi-region deploy and latency-based routing alongside Event Functions and MicroVMs.
5 min · 1,051 words
Maybe a better way to track the release history of a Git repo
Mark Dominus recalls how per-deployment release tags left ZipRecruiter's Git monorepo with far too many refs, and proposes an alternative: a single ref per tier and app pointing to a chain of two-parent metainfo commits, so the full release history stays auditable, revertible and browsable with ordinary git log.
8 min · 1,805 words
Methods for Migrating Virtual Machines From VMware ESXi to Linux-Based Hypervisors
LINBIT's Matt Kereczman surveys ways to move VMs off VMware ESXi to Proxmox VE, KVM/libvirt, oVirt/OLVM, OpenShift Virtualization, OpenNebula or XCP-ng: copying VMDKs and converting with qemu-img, virt-v2v, OVF/OVA export, platform-specific import tools and other approaches, plus what to plan for and how to choose.
8 min · 1,760 words
Using docker-compose with Podman rootless
Elouan Martinet explains how to run docker-compose against rootless Podman by enabling its Docker-compatible user socket and setting DOCKER_HOST, with tips on disabling rootful Docker, podman unshare and podman mount, rootless Docker, and user lingering so containers survive logout.
3 min · 657 words
GPU sharing via Timeslicing in Kubernetes
A write-up on NVIDIA GPU time-slicing in Kubernetes: how the GPU Operator advertises virtual replicas of one GPU so several pods can share it, the context-switching overhead and per-pod observability gaps this brings, how it compares with MPS and MIG, and a glossary of the key terms.
5 min · 1,232 words
Self-hosted HTTP tunnels with SSH and nginx
Vincent Bernat shows how to expose a localhost preview to a friend with only a plain SSH client and an nginx server you control: ssh -R with a dynamic port, an nginx server_name regex mapping per-port subdomains, wildcard TLS via ACME DNS-01, and a helper script plus NixOS module.
4 min · 998 words
Quick thoughts on GitHub’s Sept 23 incident
Lorin Hochstein reads GitHub's terse write-up of its Sept 23 Azure Central US database incident and pulls out the multiple contributing factors hiding in it: planned maintenance, replica failover, and an under-capacity primary.
3 min · 696 words
The hidden design compromises of Docker layers
How Docker and OCI image layers encode filesystem changes with tar archives and whiteouts, and which special filenames you cannot safely use in images.
31 min · 7,144 words
Big improvements to Seer AgentWrite actions in Sentry plus Datadog and GCP connectors — from rubber duck to debugging assistant
Sentry's Seer Agent can now perform write actions (dashboards, monitors, issue triage) with per-chat permission prompts, and pull infrastructure context via new Datadog and Google Cloud Platform connectors.
2 min · 411 words
Coding Agents Are Becoming CI Workers. Start Sandboxing Them Like It.A practical seven-layer guide: sandbox, egress allowlists, short-lived credentials, propose/dispose CI, telemetry, and a kill switch
Omid Farhang argues the durable upgrade for coding agents isn't a smarter model—it's containment. A layered guide covering Docker isolation, egress proxies, propose/dispose CI, patch validators, telemetry, and a tested kill switch.
2 min · 436 words
WSL containers is now generally available
Microsoft announces general availability of WSL containers: a wslc.exe CLI (aliased as container.exe) to build, run, and deploy Linux containers directly on Windows, plus an API for running Linux containers from native Windows apps, available via wsl --update.
4 min · 1,025 words
devenv 2.4 adds Machines: declare NixOS (and other) host configs beside your nix-based dev environment, then build, install, and deploy with devenv machines.
4 min · 850 words