Writing

Field notes

Platform engineering, cloud-native security, and production systems - architecture, tradeoffs, and failure modes.

  • Agents Do Better When Work Lives on a Board

    Observation from heavy agent use: harness todos are fine as a scratchpad, but durable work has been more stable on external boards - especially GitHub Issues and Projects next to the code.

    AgentsWorkflowGitHubProductivityAIPlatform Engineering
  • Namespaces Aren't Isolation

    Multi-tenant Kubernetes isolation beyond namespaces: Capsule, default-deny NetworkPolicy, quotas, an API proxy, and gVisor. What we shipped after the first shared-cluster design failed.

    KubernetesMulti-tenancySecurityPlatform EngineeringCapsulegVisorMulti-tenant Kubernetes
  • Igris: Finishing the Voice Agent I Started at OAU in 2014

    In 2014 at OAU I built a voice agent the stack could not carry. Sci-fi UI. A hey Jarvis wake word. Apps that opened when I spoke. Igris is me finishing that dream with a Go brain, Apple clients, and a 3D guardian plan.

    IgrisAgentsVoiceOpen SourcePersonalGo
  • How to Safely Give AI Agents a Terminal

    Sandbox AI coding agents: disposable Linux terminals with gVisor (runsc), network isolation, and hard resource limits - not system prompts. Practical isolation with Rexec.

    AgentsSecuritySandboxesRexecOpen SourcePlatform EngineeringgVisor
  • Rexec: The Terminal Control Room I Built to Test a CLI

    I only needed a throwaway terminal to prove a CLI worked on real machines. Scope creep built Rexec: a control room for disposable cloud terminals, outbound agents, and safer places for AI tools to run.

    TerminalsOpen SourceDevOpsSREAgentsSecurity
  • I Built an Open Source Alternative to Fing Because Privacy Matters

    Looking for a free open source Fing alternative? OpenFing is a local-only LAN scanner in Zig - no account, no subscription, no topology upload. GitHub install in one curl.

    NetworkingPrivacyOpen SourceZigCLISecurityFing Alternative
  • One Script Turns Any Server Into a PipeOps Host

    People kept asking to bring their own metal. One script later, a dusty box or Hetzner VM speaks PipeOps: K3s, agent, Istio, monitoring. About three minutes from bare server to managed host.

    PipeOpsKubernetesK3sInfrastructureDevOpsAutomation
  • How Nova Isolates Tenants on Shared Kubernetes

    Not everyone has AWS credits. Nova is how we put many customers on shared Kubernetes without handing them the real cluster: Capsule, network policy, gVisor, and a path that starts around $5/month.

    PipeOpsNovaKubernetesMulti-tenancyInfrastructure
  • Terraform Multi-Cloud Provisioning: How the Runner Builds Kubernetes on AWS, GCP, and Azure

    Terraform multi-cloud in production: one Go Runner provisions Kubernetes across AWS, GCP, and Azure - state locking, concurrency, provider quirks, and failures we hit shipping real clusters.

    TerraformMulti-cloudInfrastructurePipeOpsAWSGCPAzureKubernetes
  • How PipeOps Actually Deploys Your Code

    People think deploy is git push and done. Here is what actually happens on PipeOps, from webhook to BuildKit to Kubernetes, with the Go services and queues I wish other platforms documented.

    PipeOpsKubernetesBuildKitGoDevOpsCI/CD
  • I Ignored Burnout Until Work Stopped Working

    I ignored burnout until work and the gym both stopped working. Boundaries, routines, and a few boring habits that actually helped me recover.

    PersonalWork-Life BalanceMental HealthProductivity
  • PipeOps 2022: From Kitchen Conversation to First Customer

    2022 was a rollercoaster. From a kitchen conversation to PipeOps MVP, private beta with no buyers, and a first paying customer at day 33. Startup lessons we learned the hard way.

    PipeOpsStartupsProduct DevelopmentEntrepreneurship
  • Stop Rewriting Storage Code for Every Node Project

    I was tired of rewriting S3, GCS, and local disk glue for every Node project. One API for object storage and filesystem, published on npm.

    Node.jsOpen SourceNPMCloud Storage