Co-founder & CTO · Lagos

I systems.

Hi. If you care how Kubernetes actually works - operators, shims, CSI, agents, multi-tenant isolation, sandboxes, self-hosted gateways - pull up a chair. Field notes from production.

  • PipeOps
  • K8s Agent
  • Rexec
  • firecracker-shim
  • Igris
  • Aeon

Read writing Work About GitHub

Alex Idowu @nitrocode

01 - Work

What I’m building

A short cut of the catalogue. Full list on Work.

  • Company

    PipeOps

    Code-to-cloud deployment platform. Multi-cloud provisioning, BuildKit builds, Kubernetes runtime, and BYOS agents, with Go services in production.

    Visit ↗
  • Company

    PipeOps Kubernetes Agent

    BYOS agent that turns a VM into a managed Kubernetes deploy target. K3s setup, outbound WebSocket tunnel, yamux TCP/UDP, and gateway proxy without opening inbound admin ports.

    Docs ↗
  • Open source

    Rexec

    Terminal control room for disposable cloud terminals, outbound BYOS agents, session recording, and agent sandboxes for CLIs and AI tools.

    Repo ↗
  • Open source

    firecracker-shim

    containerd shim v2 that runs Kubernetes pod sandboxes inside Firecracker microVMs. RuntimeClass path, VM pooling, standard OCI images and CNI.

    Repo ↗

See full catalogue →

02 - Patterns

Systems I’ve shipped

Isolation, deploy pipelines, and secure access under product pressure.

Multi-tenant Kubernetes Capsule, NetworkPolicy, API proxy, and gVisor for tenant workloads. Deep dive →
Deploy architecture BuildKit, RabbitMQ queues, Go runners end-to-end. Deep dive →
Terraform multi-cloud One Runner: Terraform multi-cloud Kubernetes on AWS, GCP, Azure. The Runner →
BYOS + gVisor sandboxes Outbound agents; disposable terminals isolated with runsc. Safe agent terminals →

03 - Writing

Recent essays

Engineer-to-engineer notes: architecture, failure modes, production lessons.

  • Namespaces Aren't Isolation

    Multi-tenant Kubernetes isolation beyond namespaces: Capsule, default-deny NetworkPolicy, quotas, an API proxy, and gVisor. What we shipped after the first shared-cluster design failed.

  • Igris: Finishing the Voice Agent I Started at OAU in 2014

    In 2014 at OAU I built a voice agent the stack could not carry. Sci-fi UI. A hey Jarvis wake word. Apps that opened when I spoke. Igris is me finishing that dream with a Go brain, Apple clients, and a 3D guardian plan.

  • How to Safely Give AI Agents a Terminal

    Sandbox AI coding agents: disposable Linux terminals with gVisor (runsc), network isolation, and hard resource limits - not system prompts. Practical isolation with Rexec.

  • Rexec: The Terminal Control Room I Built to Test a CLI

    I only needed a throwaway terminal to prove a CLI worked on real machines. Scope creep built Rexec: a control room for disposable cloud terminals, outbound agents, and safer places for AI tools to run.

  • I Built an Open Source Alternative to Fing Because Privacy Matters

    Looking for a free open source Fing alternative? OpenFing is a local-only LAN scanner in Zig - no account, no subscription, no topology upload. GitHub install in one curl.

Full index of writing →

Elsewhere

Building in public. Open to hard infrastructure problems and thoughtful collaboration.