Hand-picked tutorials, guides and examples on Cloud & DevOps — explained simply.
Showing 60 articles
Docker packages an application with everything it needs (runtime, libraries, config) into an image . Running an image creates a container : an isolated process that behaves the same on your laptop, a CI runner and a production server. Images vs containers An i...
Kubernetes runs containers across a cluster of machines and keeps them in the state you describe. You don't say "start three containers"; you declare "there should always be three", and Kubernetes makes it so, even when machines fail. Pod The smallest unit: on...
Git records snapshots of your project over time. Once you understand three places (working directory, staging area, repository), the everyday commands make sense. The three areas Working directory - your files as you edit them. Staging area - changes you've se...
GitHub Actions runs automated workflows when things happen in your repository: a push, a pull request, a schedule or a manual click. The most common first use is CI: run tests on every change. Anatomy of a workflow Workflow - a YAML file in .github/workflows/...
Clicking around a cloud console is fine once. For anything you need to repeat, review or recover, describe infrastructure in code. Terraform reads configuration files and creates, updates or deletes cloud resources to match. A first configuration # main.tf ter...
Monitoring tells you that something is wrong. Observability helps you understand why , including for problems you didn't predict. It's built from three kinds of telemetry. Metrics: numbers over time http_requests_total{route="/checkout", status="500"} 1243 htt...
A Dockerfile that "works" and one that's good for production differ in image size, build speed, security and how the app shuts down. Here's a solid template. # syntax=docker/dockerfile:1 # ---------- dependencies (all, for building) ---------- FROM node:22-alp...
This walkthrough takes a container image all the way to a running, scalable app on a local Kubernetes cluster. 1. Create a local cluster # kind = Kubernetes in Docker brew install kind kubectl # or see each project's install docs kind create cluster --name dev...
A branching strategy is an agreement about how work flows into the main branch and out to users. The trend in recent years has been towards fewer, shorter-lived branches. GitHub Flow main is always deployable. Create a branch for each change. Open a pull reque...
Installing dependencies is often the slowest part of a CI run. Caching downloads between runs can cut minutes from every workflow. The easy way: built into setup actions - uses: actions/setup-node@v4 with: node-version: 22 cache: npm # also: yarn, pnpm - uses:...
The state file is Terraform's memory: which real resources belong to which blocks in your code. For a team, it must be shared, locked during changes and protected, because it can contain secrets. An S3 backend with locking terraform { backend "s3" { bucket = "...
OpenTelemetry's auto-instrumentation patches popular libraries (http, Express, pg, Redis, fetch and many more) so you get traces with almost no code changes. Zero-code setup npm install @opentelemetry/api @opentelemetry/auto-instrumentations-node export OTEL_S...
Docker Compose describes a multi-container setup in one file. One command starts your API, database, cache and anything else the project needs, the same way on every developer's machine. compose.yaml services: api: build: . ports: - "3000:3000" environment: DA...
The same image should run in development, staging and production. What changes between them (URLs, feature flags, credentials) belongs in ConfigMaps and Secrets. ConfigMap for non-sensitive settings apiVersion: v1 kind: ConfigMap metadata: name: api-config dat...
Six months from now, git log and git blame are how someone (often you) will understand why a line of code exists. The commit message is where that answer lives. The classic format Fix double charge when payment webhook is retried The payment provider retries w...
A matrix runs the same job with different combinations of values: several Node.js versions, operating systems or database versions, in parallel. A basic matrix jobs: test: runs-on: ${{ matrix.os }} strategy: matrix: os: [ubuntu-latest, windows-latest, macos-la...
Hard-coded values make Terraform code impossible to reuse. Variables bring values in, locals compute values once, and outputs send values out. Input variables # variables.tf variable "environment" { type = string description = "Deployment environment" validati...
In a system of many services, one slow user request might pass through an API gateway, three services, a queue, two databases and a third-party API. Distributed tracing reconstructs that whole path. Traces and spans A trace is the full journey of one request,...
Smaller images pull faster, start faster, cost less to store and contain fewer packages with vulnerabilities. Going from 1.2 GB to under 200 MB is common. 1. Choose a smaller base image node:22 (Debian full) - large, has build tools. node:22-slim - Debian with...
Probes tell Kubernetes about the health of each container. Configured well, they give you zero-downtime deploys and self-healing. Configured badly, they can restart healthy Pods in a loop and turn a small issue into an outage. The three probes Readiness - "can...
Both merge and rebase combine work from two branches. They differ in the history they produce. Merge: preserve history as it happened git switch feature/search git merge main # creates a merge commit joining both histories Safe and non-destructive, but frequen...
Workflows need configuration (URLs, flags) and credentials (API keys, deploy tokens). GitHub provides separate tools for each, plus environments to control who and what can deploy where. Secrets and variables Secrets are encrypted, masked in logs and not reada...
A module is a folder of Terraform files used as a building block. Good modules capture your organisation's standards (encryption on, tags set, sensible defaults) so every team gets them for free. Module layout modules/static-site/ main.tf # resources variables...
console.log("user " + id + " failed") is fine on a laptop. In production you need logs that machines can search and filter: JSON with consistent fields, levels and request IDs. Basic setup import pino from 'pino'; export const logger = pino({ level: process.en...
Most "it can't connect" problems with Docker come from a few networking rules. Once you know them, they're easy to reason about. User-defined bridge networks docker network create appnet docker run -d --name db --network appnet -e POSTGRES_PASSWORD=secret post...
Requests and limits tell Kubernetes how much CPU and memory a container needs and may use. They affect scheduling, performance and stability, and getting them wrong is a top cause of mysterious slowdowns and crashes. resources: requests: cpu: 250m # 0.25 of a...
Git rarely loses work for good. Pick the right command for what you want to undo and where the change currently lives. Discard uncommitted changes git restore src/cart.js # throw away edits to a file (careful: not recoverable) git restore --staged src/cart.js...
Storing cloud access keys as GitHub secrets works, but those keys live forever and can leak. With OpenID Connect (OIDC) , GitHub gives each workflow run a signed token, and your cloud exchanges it for temporary credentials. There are no keys to steal or rotate...
Almost every project needs the same infrastructure in several environments, with small differences: smaller instances in dev, more replicas in prod. There are three common approaches. 1. Separate directories (most common) infra/ modules/ app/ # the shared buil...
Prometheus is the most widely used open-source metrics system. Your app exposes current values on a /metrics endpoint, and Prometheus scrapes them every few seconds and stores them as time series. The metric types Counter - only goes up (resets on restart): re...
Slow Docker builds usually re-download dependencies that haven't changed. BuildKit, the default builder in modern Docker, has features designed to stop that. 1. Order layers from least to most frequently changed COPY package.json package-lock.json ./ # changes...
Traffic changes through the day. The Horizontal Pod Autoscaler (HPA) adds Pods when load rises and removes them when it falls, so you pay for what you use and stay fast at peak. Prerequisites metrics-server installed in the cluster (most managed clusters inclu...
A conflict means Git found two changes to the same lines and won't guess which one you want. It's a normal part of teamwork, not an error. 1. See what's conflicted git status # both modified: src/pricing.js 2. Read the markers function shippingFee(total) { <<<...
When ten repositories have nearly identical CI files, every improvement must be made ten times. GitHub Actions offers two ways to share. Composite actions: share a group of steps # .github/actions/setup-app/action.yml name: Set up app description: Install Node...
Most teams adopt Terraform after resources already exist. Recreating them isn't an option, so you import them: tell Terraform that an existing resource belongs to a block in your code. Import blocks # imports.tf import { to = aws_s3_bucket.uploads id = "acme-s...
You can measure thousands of things. These three well-known frameworks tell you which handful matter most. The four golden signals From Google's SRE book, for any user-facing system: Latency - how long requests take. Track successful and failed requests separa...
Containers isolate processes, but a careless image or run command can undo most of that protection. These practices close the common gaps. 1. Don't run as root RUN addgroup -S app && adduser -S app -G app USER app If an attacker exploits your app, they get the...
Services are reachable inside the cluster. To route outside HTTP traffic to them by hostname and path, Kubernetes offers two APIs: the long-standing Ingress and its successor, the Gateway API . Ingress apiVersion: networking.k8s.io/v1 kind: Ingress metadata: n...
Slow reviews are usually a symptom of hard-to-review pull requests. You can make yours easy to say yes to. 1. Keep it small Aim for changes a reviewer can understand in 15-20 minutes, often under a few hundred lines. Split big work into steps that each make se...
A common pipeline: every push to main builds an image, tags it with the commit and pushes it to a registry, ready to deploy. The workflow name: Docker image on: push: branches: [main] tags: ['v*'] permissions: contents: read packages: write # push to ghcr.io j...
Terraform identifies resources by their address, like aws_s3_bucket.assets . Rename it in code and Terraform plans to destroy the old one and create a new one, which for a database is a disaster. moved and removed blocks tell Terraform what you really meant. R...
"Make it reliable" isn't a goal you can measure. Service level objectives turn reliability into a number that product and engineering can agree on. The terms SLI (indicator) - a measurement of user experience, usually a ratio of good events to total events. Ex...
A running process isn't necessarily a working one. It might be deadlocked, out of database connections or stuck in a crash loop. Health checks and restart policies help Docker notice and react. HEALTHCHECK in a Dockerfile HEALTHCHECK --interval=30s --timeout=3...
Helm is a package manager for Kubernetes. A chart is a bundle of templated manifests; a release is an installed copy of a chart with your settings ( values ). Installing software helm repo add bitnami https://charts.bitnami.com/bitnami helm search repo redis h...
"It worked last week." Somewhere among 200 commits, something broke. git bisect finds the culprit with a binary search: about 8 checks for 200 commits. Manual bisect git bisect start git bisect bad # the current commit is broken git bisect good v2.3.0 # this r...
CI pipelines hold deploy credentials and write access to your code, which makes them attractive targets. These practices close the most common holes. 1. Least-privilege GITHUB_TOKEN permissions: contents: read # default for the whole workflow jobs: release: pe...
Running terraform apply from laptops leads to "who changed this?" moments and state conflicts. A CI workflow makes every change visible, reviewed and repeatable. The flow A pull request changes Terraform code. CI runs fmt , validate and plan , and shows the pl...
Apps can send telemetry straight to a vendor, but most production setups put an OpenTelemetry Collector in between. It receives data from many sources, processes it and exports it to one or more backends. Why use a Collector Apps only need to know one endpoint...
When a container doesn't behave, work from the outside in: what does it log, how did it exit, what does its configuration look like, and what is happening inside? 1. Logs docker logs api # everything written to stdout/stderr docker logs -f --tail 100 api # fol...
When something breaks in Kubernetes, the answer is usually in a handful of commands. Start with the Pod's status, then events, then logs. First look kubectl get pods -n shop -o wide # status, restarts, node kubectl describe pod api-7d9f-x2k -n shop # events at...
Switching branches means stashing work, waiting for rebuilds and losing your place. A worktree is an extra working directory attached to the same repository, so different branches can be checked out at the same time. Basic commands # Check out an existing bran...
A CI pipeline that takes 25 minutes slows down every pull request. Most pipelines can be made several times faster with a few changes. 1. Cancel outdated runs concurrency: group: ci-${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true When you pus...
In 2023 HashiCorp changed Terraform's licence from the open-source MPL 2.0 to the Business Source License (BSL). In response, a group of companies forked the last open-source version as OpenTofu , now a Linux Foundation project. What's the same The HCL languag...
When alerts fire constantly, people stop reading them, and the one that matters gets missed. Good alerting is mostly about deciding what not to page on. 1. Every page must be urgent and actionable Ask: "If this fires at 3 a.m., does someone need to do somethin...
Containers are disposable, but data often isn't. Docker offers three ways to give a container storage beyond its own temporary layer. Named volumes docker volume create pgdata docker run -d -v pgdata:/var/lib/postgresql/data postgres:17 docker volume ls docker...
Kubernetes Deployments roll out new versions gradually by default. But "gradual" isn't automatically "zero downtime": dropped connections during shutdown are the usual culprit. These settings close the gaps. 1. Rolling update strategy spec: replicas: 4 strateg...
Anyone can set user.email to your address and make commits that look like yours. Signing commits proves they were made by someone holding your private key. Git supports signing with SSH keys, which is much simpler than setting up GPG. 1. Tell Git to sign with...
Releasing by hand (build, write notes, upload files) is slow and easy to get wrong. A tag-triggered workflow does it the same way every time. Trigger on version tags # .github/workflows/release.yml name: Release on: push: tags: ['v*.*.*'] permissions: contents...
Modules are code that many teams depend on, so they deserve tests. Terraform includes a test framework: .tftest.hcl files with runs and assertions. A plan-only test # tests/naming.tftest.hcl variables { environment = "staging" domain = "shop.example.com" } run...
LLM features fail in new ways: answers get worse without any error, costs spike because a prompt grew, an agent loops through tools. Normal API monitoring doesn't catch these, so add LLM-specific telemetry. 1. Usage and cost const response = await client.messa...
