DevOps & SRE notes

🚀2.3x faster than MinIO for 4KB object payloads. RustFS is an open-source, S3-compatible high-performance object storage system supporting migration and coexistence with other S3-compatible platforms such as MinIO and Ceph. https://github.com/rustfs/rustfs

⚰️ Minio was archived on Apr 25, 2026 https://github.com/minio/minio

It's time to update your kernel An unprivileged local user can write 4 controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root. https://copy.fail/

Uber engineered native gRPC endpoints directly into OpenSearch to eliminate inefficient REST/JSON translation layers within their architecture. Their automated pipeline for syncing JSON APIs with Protobuf schemas, their internal integration strategy, and the resulting performance gains in production environments for high-throughput ingestion and vector search workloads. - Uber implemented gRPC as an OpenSearch module - To prevent divergence between REST and gRPC, Uber built a three-stage automated pipeline - Removing the JSON-to-Protobuf translation layer reduced p99 index write latency by 60% for Uber’s M3 metrics system and decreased batch indexing job runtimes by 20-35%. - Large vector searches, which serialize poorly in JSON, saw a 53% reduction in p50 latency and a 43% reduction in p95 latency. - Combining gRPC with binary document formats like SMILE proved highly effective, executing 30% faster than REST JSON and 45% faster than gRPC JSON. https://www.uber.com/us/en/blog/high-performance-grpc/

The proliferation of AI coding models has drastically lowered the barrier to discovering software vulnerabilities, resulting in a massive influx of automated, low-quality, and false-positive vulnerability reports. This volume is overwhelming open-source maintainers and security teams. The article outlines how the industry must adapt, offering specific strategies for companies, maintainers, and external bug hunters to manage triage, improve report quality, and prevent ecosystem burnout. https://www.cncf.io/blog/2026/04/16/the-ai-driven-shift-in-vulnerability-discovery-what-maintainers-and-bug-finders-need-to-know/

Microsoft is so jealous of Claude Code's success that they decided to include a "co-author" credit for GitHub Copilot, even if Copilot has done nothing. https://github.com/orgs/community/discussions/194075

Red Hat critiques a recent VMware study that claimed VMware Cloud Foundation (VCF) with vSphere Kubernetes Service (VKS) offers a "5.6x pod density" advantage over Red Hat OpenShift. The benchmark as an architectural mismatch rather than an accurate performance evaluation, noting that VMware compared 300 overcommitted virtual worker nodes against 4 bare-metal OpenShift nodes. https://www.redhat.com/en/blog/precision-over-perception-why-architecture-matters-benchmarking

The article addresses the "broken" scale of AI model distribution, where transferring massive models (like a 130GB DeepSeek-V3) to hundreds of GPU nodes simultaneously bottlenecks network bandwidth and hits rate limits on hubs like Hugging Face. The solution is the CNCF project Dragonfly, which uses a Peer-to-Peer (P2P) architecture to ensure a model is fetched from the origin only once. It details new native protocol support for hf:// and modelscope://, allowing dfget (Dragonfly's download tool) to natively understand these hubs, reducing origin traffic by up to 99.5% and enabling wire-speed distribution across clusters. https://www.cncf.io/blog/2026/04/06/peer-to-peer-acceleration-for-ai-model-distribution-with-dragonfly/

Looking for a hosting platform to practice with Linux, Kubernetes, etc.? Register using my referral link on DigitalOcean and get $200 in credit for 60 days. By registering through my referral link, you also support this Telegram channel. 👉 Register

Following the announced retirement of the ingress-nginx project, the CNCF migrated its internal services cluster to Envoy Gateway (an implementation of the Gateway API). Rather than a generic tutorial, the post details their specific architectural decisions, such as utilizing a shared Gateway object across multiple HTTPRoutes to optimize cloud load balancer costs and operational simplicity. It also covers the migration strategies they used for maintaining the same IP address, handling legacy certificates, and conducting "Day 2" operations with cert-manager. https://www.cncf.io/blog/2026/04/13/ingress-nginx-to-envoy-gateway-migration-on-cncf-internal-services-cluster/

The article introduces GKE Active Buffer, a native feature designed to solve the persistent problem of scale-out latency in Kubernetes. Traditionally, cluster autoscaling suffers from delays while provisioning new VMs and pulling container images. To solve this, admins often used "balloon pods" (dummy pods that hold space), which are "hacky," complex to manage, and lack native integration. GKE Active Buffer replaces these with a declarative CapacityBuffer API, providing a standardized, portable way to maintain "warm" capacity. This allows business-critical workloads—such as AI inference, retail flash sales, and gaming—to land on pre-provisioned capacity nearly instantaneously. https://cloud.google.com/blog/products/containers-kubernetes/new-gke-active-buffer-minimizes-scale-out-latency

K8s 1.36 will be released soon, and it’s a good time to check which new alpha features will be available in the new release. https://palark.com/blog/kubernetes-1-36-release-features/

Have you switched over to IPv6 yet? It’s time to start getting ready for IPv8.

https://www.ietf.org/archive/id/draft-thain-ipv8-00.html

In the modern world of services, the teams developing and working with them need to understand the concept of rate limiting. Being able to design these systems is crucial to avoid service denial and provide higher uptime. It is an important part not only for externally available services, but also for internal ones. https://bytebytego.com/courses/system-design-interview/design-a-rate-limiter

🚀 Join our AWS Cloud Developer course and gain practical experience working with various AWS services and technologies during an intensive 2-month program! 🎯 Become familiar with over 15 AWS services and confidently apply your skills in real-world projects by the end of the course. ▪️Start date: April 13, 2026 ▪️Free / Online ▪️In English COURSE HIGHLIGHTS ☁️ Build a single-page application (SPA) using AWS S3 and CloudFront ☁️ Develop serverless APIs with AWS API Gateway and Lambda ☁️ Integrate with databases and S3 ☁️ Master asynchronous microservices communication using SQS and SNS ☁️ Explore authorization with Lambda Authorizers and Cognito ☁️ Learn containerization with Docker and Elastic Beanstalk ☁️ Implement backend-for-frontend using API Gateway Find out more details and enroll: https://wearecommunity.io/events/aws-cloud-dev-2026q2

A realistic exam simulator for CKAD, CKA, and CKS featuring timed sessions and hands-on labs with pre-configured clusters. https://github.com/sailor-sh/CK-X

Tech giants under attack by a Trivy-compromised GitHub action. Cisco – More than 300 GitHub repositories were cloned during the incident, including source code for its AI-powered products, such as AI Assistants, AI Defense, and unreleased products. A portion of the stolen repositories allegedly belongs to corporate customers, including banks, BPOs, and US government agencies. https://www.bleepingcomputer.com/news/security/cisco-source-code-stolen-in-trivy-linked-dev-environment-breach/

Terragrunt is now v1! This means that Terragrunt will no longer have any breaking changes in minor releases, with all future breaking changes taking place in (infrequent) future major releases. https://github.com/gruntwork-io/terragrunt/releases/tag/v1.0.0

It might become an alternative to LocalStack Floci - Light, fluffy, and always free - AWS Local Emulator https://github.com/hectorvent/floci

⚡️ LocalStack archived its GitHub repo — what happened and what it means On March 23, 2026, LocalStack archived localstack/localstack on GitHub (read-only) and consolidated everything into a single Docker image that requires an auth token — including in CI. What changed: - docker pull localstack/localstack:latest without LOCALSTACK_AUTH_TOKEN → your pipeline breaks - Free "Hobby" plan exists but requires account creation and is non-commercial only - Paid plans start at $39/mo - CI needs a dedicated CI Auth Token stored in secrets Your options: - Pin to an older tag (e.g. 4.12) — works short-term, but you accumulate parity drift and unpatched CVEs - Create a free account — enough for individual non-commercial dev - Pay — if LocalStack is embedded in team CI For open-source projects: LocalStack launched a separate program offering free Ultimate tier licenses (100+ AWS services, Cloud Pods, IAM enforcement) to eligible OSS projects with OSI-approved licenses. https://blog.localstack.cloud/introducing-localstack-for-open-source/