Buy me a Koffee
From the Blogs
Latest Posts
Deep dives for engineers who work with Linux, AWS, Kubernetes, and CI/CD.
Base64 Encoding Explained: What It Actually Does in Kubernetes Secrets, JWTs, and Basic Auth
Base64 shows up everywhere in DevOps, including Kubernetes Secrets, JWT tokens, Basic Auth headers, and SSH keys, but it's encoding, not encryption. Here's what it actually does.
Read post →
Why Your Logs Show Epoch Timestamps Instead of Dates
Logging libraries record raw Unix epoch numbers instead of formatted dates on purpose. Here's why, and how to convert them back to a human-readable date.
How to Compare Two Terraform State Files Using JSON Diff
Terraform state files are JSON. Here's how to semantically diff them to understand exactly what changed between two states.
Kubernetes Secrets Are Base64, Not Encrypted: Here's What That Means
Kubernetes Secret values are base64 encoded, not encrypted. Here's how that encoding works, why it isn't security, and how to decode and create Secrets safely.
Why You Should Never Paste Raw Logs Into ChatGPT or Claude
Pasting raw application logs into an AI chatbot can leak passwords, API keys, and PII. Here's how to sanitise logs before sharing them for debugging help.
AWS EventBridge Cron Isn't Unix Cron: Here's Where It Breaks
EventBridge cron expressions look like Unix cron but use 6 fields, different day of week numbering, and ? wildcards. Here's every place that breaks and how to fix it.
Why Your /24 Subnet Only Has 251 Usable IPs (Not 254)
AWS reserves 5 IPs per subnet, not 2. Here's the math everyone learned wrong, why it matters for EKS, and a full prefix to usable IP reference table.
Decoding a JWT Is Not Verifying It, and That Distinction Has Caused Real Breaches
jwt.decode() and jwt.verify() are not the same function. The alg none attack has caused real authentication bypasses for a decade, including in 2026. Here's how it works and how to audit for it.
The .gitignore Patterns That Don't Do What You Think (Negation, Wildcards, and Directory Slashes)
Why an exception for one file inside an ignored folder doesn't work, what the leading and trailing slash actually mean, and how a double asterisk differs from a single one.
Why chmod 777 in Your Dockerfile Is a Code Smell (And What to Do Instead)
chmod 777 fixes Docker permission errors because it disables permissions entirely. Here's the actual cause, UID and GID mismatches, and the fix that doesn't open every file to every process.
The YAML Norway Problem and Other Implicit Type Coercions That Break Kubernetes Manifests
YAML 1.1 turns NO into false, 1.10 into a float, and 0123 into octal, all without a syntax error. Here's every implicit type coercion that silently breaks Helm values and ConfigMaps.
Why Your docker run Command Works But the Equivalent Compose File Doesn't
Translating docker run flags to docker-compose.yml line by line misses the network topology itself. Here's why service discovery breaks and how to translate it correctly.