Indra G. PrasetyaFix kubelet "not run on a host using cgroup v1" on v2
Run stat -fc %T /sys/fs/cgroup to see what the kubelet sees: hybrid mounts and unapplied GRUB edits both read as cgroup v1 on a v2 host.
Read more
Archive 2026
Field Notes.
Honest notes on infrastructure, security, and running technical teams, documenting the shift from human-scale systems to autonomous technical architectures.
Fix docker save "no suitable export target found"
Run two commands to split the four causes behind docker save --platform failing on Docker 29's containerd image store, then export a tar that actually loads.
Read moreFix "Xid 154, GPU recovery action changed" on GPU Nodes
Read the hex in the Xid 154 line to tell an nvidia-smi -r reset from a node reboot, and stop dcgm-exporter from hiding the Xid that actually failed.
Read moreFix pnpm deploy "Cannot find module" in Docker on 11.19
pnpm deploy 11.19 to 11.21 symlinks workspace packages out of your Docker image. Run one find to catch the dangling link, then upgrade to 11.22.0.
Read moreFix TypeScript 7 Out of Memory: error TS7056 Costs 6x RAM
Set GOMEMLIMIT and drop --max-old-space-size: TypeScript 7's Go tsc uses 2.48 GB where tsc 6 used 0.41 GB for the same error TS7056, then exits 137.
Read moreCilium 1.19 Upgrade: Fix 12 Traps Before BGP Drops
Run these 12 checks before helm upgrade to Cilium 1.19: ClusterMesh policy scoping flips, BGPv1 CRDs are gone, and five service flags vanish.
Read moreSubscribe to the Technical Journal
Deep dives into infrastructure, security, and technical leadership. No noise, just engineering rigor. Subscribe and grab the 2026 AI-agent & infrastructure security checklist.
Fix Ineffective mark-compacts in Node 24.19.0: 4 Causes
Check the exit code before the error text: 137 means the kernel killed it. Four causes of Node 24.19.0 heap OOM, each with its own separating test.
Read moreFix npm EALLOWREMOTE Without Setting allow-remote=all
Read the Refusing to fetch URL to pick the right npm 12 EALLOWREMOTE fix: replace-registry-host for private registries, in one config line.
Read moreFix "Cannot find module build/Release" After npm 12
Stop npm 12 from skipping native builds: 12 tips to tell Cannot find module build/Release from a missing optional dep.
Read moreFix ESLint Cannot read properties of undefined (Intrinsic)
Run pnpm why typescript to find which of three trees put TypeScript 7 under typescript-eslint, then fix it with pnpm 12 or an overrides pin.
Read moreFix conflicting SELinux labels of volume in K8s 1.37
Kubernetes 1.37 mounts PVCs with -o context=, so pods with different SELinux labels stall in ContainerCreating. Run one kubectl check to find them first.
Read morepnpm 12 Upgrade: Fix 12 Rust CLI Traps Before CI Breaks
Pin your pnpm version first, then run one grep: pnpm 12's Rust CLI turns a pnpm-workspace.yaml typo into ERR_PNPM_UNRECOGNIZED_WORKSPACE_SETTINGS.
Read moreStop Trusting C2PA Content Credentials on Android
Treat verified C2PA Content Credentials as weak evidence: forged manifests pass the official verifier on rooted Pixels. Pin anchors, log the signer.
Read moreStop Kubernetes DRA Giving One GPU to a VM and a Pod
GPU Operator 26.7 advertises each GPU twice under DRA. Run one kubectl query to spot it, then split the node pool before enabling VFIO.
Read moreFix "a mirror pod may not reference secrets" in K8s 1.37
Kubernetes 1.37 removes the PreventStaticPodAPIReferences gate. Grep your static pod manifests and kubelet config before a node refuses to start.
Read moreFix Terraform Deposed Object Panic in readDiff on 1.15
Terraform 1.15 apply panics in readDiff on a deposed object. Run one state pull and jq check to find the live orphan before you upgrade to 1.16.
Read moreFix Terraform "The deprecation originates from" Warnings
Terraform 1.15 warns about attributes you never wrote. Run terraform validate -json to tell real deprecations from mark propagation, plus what 1.16 fixes.
Read morenpm approve-scripts vs --allow-scripts: pick the right flag
Run npm approve-scripts inside a project and --allow-scripts only for global installs. Which flag, in what order, and what to commit to package.json.
Read morenpm allowScripts: the package.json Schema, Not .npmrc
Set allowScripts in package.json to approve npm install scripts: exact schema, pinned vs name-only keys, why ignore-scripts wins, and what .npmrc holds.
Read morearrayref Attack Shows cargo build.rs Runs Any Code
Commit Cargo.lock, build --locked, add a 3-day cooldown: the arrayref build.rs ran code during cargo build, and Cargo has no --ignore-scripts.
Read moreFix "unrecognized format int32" in Kubernetes 1.34
Kubernetes 1.34 warns 'unrecognized format int32' on valid CRDs. It's a kube-apiserver false positive, not your schema; patch the control plane to fix it.
Read moreBound ServiceAccount Tokens: 9 Tips to Kill Static Ones
Move Kubernetes off non-expiring ServiceAccount secrets to bound, projected tokens via the TokenRequest API, and fix the 401s the migration triggers.
Read moreFix npm "Cannot read properties of null (edgesOut)"
The npm install crash reading 'edgesOut' has three causes. Run one --package-lock-only test to tell a stale tree from a broken peer graph.
Read more
Fix npm --allow-scripts not allowed in project installs
npm 12 rejects --allow-scripts in a project with EALLOWSCRIPTS. Commit the allowlist to package.json, and dodge the git-dep bug that fires it unprompted.
Read moreFix npm audit 410 and 'invalid json response body' bugs
Tell the npm audit 410 and 'invalid json response body' gzip bug apart by the URL in the error, and stop a silent audit from passing your CI.
Read more
Generate an SBOM with Syft, Filter Grype with VEX
Generate a CycloneDX SBOM with Syft, scan it with Grype, and suppress non-exploitable CVEs with VEX not_affected statements in your CI gate.
Read more
Fix MCP OAuth 2.1 Before the July 28 Rewrite
Only 8.5% of MCP servers use OAuth. Audit audience validation and add the resource parameter before the July 28 OAuth 2.1 spec rewrite lands.
Read more
Trivy vs Grype 2026: Pick by the Job, Not Speed
Trivy vs Grype in 2026: Trivy scans everything, Grype matches CVEs from an SBOM. Pick by the job, and pin your scanner after Q1's supply-chain hit.
Read more
GitHub Actions OIDC to AWS: Drop Static Keys for Good
Wire GitHub Actions OIDC to AWS correctly: scope the sub claim, handle the July 15 immutable-claim change, and avoid the trust policy traps tutorials skip.
Read more
Kubernetes Default-Deny Egress Stops Pod Exfiltration
Run a default-deny egress NetworkPolicy to stop a compromised pod from phoning home. Two manifests, one DNS gotcha that breaks it, and the CNI fix.
Read more
Falco vs Tetragon vs Tracee: Pick the Right One
Falco detects, Tetragon enforces in the kernel, Tracee does forensics. Picking one as a drop-in for another is the costly mistake. How to choose.
Read more
Cosign v3: Sign, Verify, and Fix the Harbor Break
Cosign v3 flips three flags by default and breaks Harbor detection. Get the sign-and-verify loop and the two fallback flags that keep CI working.
Read more
DDR5 Memory Shortage 2026: Why RAM Prices Tripled
AI takes only 20% of DRAM wafer capacity but consumes 3x the wafers per GB of HBM, draining DDR5 supply. Here is the planning math.
Read more
OpenAI Codex Bug Is Writing 640 TB/Year to Your SSD
A TRACE logging default writes 640 TB/year to ~/.codex/logs_2.sqlite. Here is how to check your disk wear and stop it.
Read more
io_uring Security: The Linux Speedup That Hides Rootkits
io_uring skips system calls for speed, and that same trick lets a rootkit run while Falco, Tetragon, and Defender see nothing. Here is how to close the gap.
Read more
GPT-5.5 Hallucination Rate: 86% Means It Never Abstains
GPT-5.5 scored 57% on knowledge benchmarks and 86% hallucination rate in the same run. Here is what that number actually counts.
Read more
Humanoid Robots Hit Factory Lines in 2026
Figure's F.02 helped build 30,000 BMWs and Tesla runs 1,000+ Optimus units, but the retired robot in the footnote tells you what's actually shipping.
Read more
Solid-State Battery Companies 2026: Who Is Actually Shipping
Which manufacturers ship semi-solid packs today versus who is still at pilot stage. The chemistry gap, commercialization status, and key players ranked.
Read more
AI Compute Costs in 2026: Power and the Serving Stack
AI compute cost in 2026 is decided by tokens per watt, the serving stack, and the grid, not the chip. Here is the math that survives finance.
Read more
Multi-Provider LLM Fallback Done Right in 2026
Anthropic retired Claude Opus 4 on June 15 and a directive killed Fable 5 in hours. Your model ID runs on two clocks, and a naive fallback fails both.
Read more
Agentic SOC in 2026: 10 Tips for Safe Triage
Battle-tested agentic SOC tips: gate autonomy on 90% shadow-mode concordance, split verdict from action, and treat every log line as attacker-authored.
Read more
A2A Agent Card Poisoning: JWS Proves Origin, Not Intent
A signed A2A agent card still lets attackers inject instructions into the description field your orchestrator feeds directly to the LLM router.
Read more
Fission CVE-2026-50566: Stop the Container Escape
Find, patch, and block the CVSS 9.9 Fission container escape (CVE-2026-50566) on Kubernetes with version 1.24.0, Pod Security Standards, and a Kyverno rule.
Read more
AI Browser Prompt Injection Hands Over Your Sessions
One crafted URL drained Comet's Gmail and ChatGPT Atlas blocked just 5.8% of phishing. Agentic browsers run with all your logged-in sessions, and that is the bug.
Read more
Post-Quantum TLS Is Already On, and It Broke Your Router
Hybrid post-quantum TLS (X25519MLKEM768) is negotiating by default right now, and the operator problem is a 1,400-byte ClientHello that fragments and breaks SNI routing.
Read more
Run AI Fuzzing on Your Own Repo Before Attackers Do
OSS-Fuzz-Gen, Buttercup, and Atheris run on a laptop with one LLM key. Ten practical commands to fuzz your own repo before attackers do.
Read more
Fable 5's Shutdown Means Your Model Is Revocable
A US directive disabled Anthropic's Fable 5 and Mythos 5 in hours on June 12, 2026. The operator lesson is supply-chain continuity, not the jailbreak.
Read more
GreatXML BitLocker Bypass Means TPM-Only Is the Bug
An unpatched WinRE exploit, GreatXML, bypasses BitLocker on any Windows 11 machine that ran a Defender offline scan. The fix is TPM+PIN, not a patch.
Read more
MCP RCE Lives in the SDK, and No Patch Is Coming
A remote code execution flaw sits in Anthropic's official MCP SDKs across 150M downloads. It's stdio command execution by design, and Anthropic calls it expected.
Read more
GR00T N1.7's ZMQ Port Is an Open Robot Remote Control
The default Isaac GR00T N1.7 inference server binds to 0.0.0.0:5555 with no auth. Here is how to lock it to loopback behind mutual TLS.
Read more
Patch Tuesday Hit 206 CVEs and Broke Your Cadence
Microsoft's June 2026 Patch Tuesday fixed a record 206 CVEs and 3 zero-days. The real shift is AI-found bugs outrunning the human patch cycle.
Read more
PgDog: Connection Pooling, Read Splits, and Sharding
PgDog sits in front of unmodified Postgres as a pooler, read/write balancer, and sharder. Here are the sharp edges to map before it hits production traffic.
Read more
AI Agent Identity Needs SPIFFE and OAuth, Not One Key
The fix for AI agent identity is two layers: SPIFFE proves what the agent is, OAuth token exchange proves what it may do right now and for whom.
Read more
npm allowScripts warning: fix "install scripts not covered" before npm 12
npm allowScripts warning explained. Run npm approve-scripts --allow-scripts-pending, approve what you trust, and set strict-allow-scripts so npm 12 fails loudly.
Read more
Hunting Shadow AI Before It Becomes Your Breach Path
Shadow AI now factors into 1 in 5 breaches and adds $670K in cost. Why banning tools backfires, and how to actually find ungoverned GenAI in 2026.
Read more
OWASP API Top 10: Shadow APIs and BOLA Tips for 2026
Battle-tested OWASP API Security Top 10 tips for 2026: hunt shadow and zombie APIs at runtime, test BOLA in CI, and close the gaps that breached Optus.
Read more
EU AI Act High-Risk Rules Hit August 2, 2026
The EU AI Act's high-risk obligations become enforceable on August 2, 2026, a deferral isn't law yet, and ISO 42001 won't cover you. Here's the engineering work.
Read more
Tetragon 1.7 Runtime Enforcement: Block Processes in the Kernel
Build a Tetragon TracingPolicy that kills a process at the kernel before it reads a secret, plus the CONFIG_BPF_KPROBE_OVERRIDE gotcha that breaks it.
Read more
Backstage vs Port vs Cortex: When to Stop Self-Hosting
Backstage owns 89% of the IDP market but averages 10% internal adoption. Here's when self-hosting your developer portal stops paying off.
Read more
Prompt Injection Defense: 10 Tips That Hold Up
Why LLM agent guardrails fail under adaptive attack, and the architectural patterns that actually contain prompt injection in 2026.
Read more
Migrate Ingress-NGINX to Gateway API Before Retirement
A hands-on 2026 guide to migrating off the retiring Ingress-NGINX to the Gateway API with ingress2gateway 1.0 and Envoy Gateway, including the annotations that silently drop.
Read more
Kubernetes User Namespaces GA: hostUsers false Node Prep
Kernel 6.3 (not 5.12), containerd 2.0+, and /etc/subuid setup for Kubernetes 1.36 user namespaces. Covers the silent failures that cost you an afternoon.
Read more
Sandboxing AI Agent Code: A 2026 Runtime Guide
AI agent sandboxes isolate untrusted AI-generated code with Firecracker microVMs and gVisor. Here's how to pick an execution runtime in 2026.
Read more
Kubernetes Hardening 2026: RBAC, PSS & Unfixed CVEs
Battle-tested Kubernetes hardening for 2026: enforce Pod Security Standards, fix over-permissive RBAC, default-deny networking, and mitigate the CVEs nobody will patch.
Read more
The 2026 AI-Agent and Infrastructure Security Checklist
A practitioner's running checklist for 2026: agent identity, sandboxing untrusted code, dependency cooldowns, and the post-quantum deadlines, each tied to one concrete action.
Read more
Harden MCP Servers Against Tool Poisoning
A practical 2026 guide to securing MCP servers: inspect tool descriptions, scan for poisoning, pin versions against rug pulls, and add a runtime guardrail.
Read more
Non-Human Identity Governance: Field Tips for 2026
How to discover, scope, and govern service accounts, API keys, tokens, and AI agents before machine credentials become your breach path.
Read more
The AI Agent You Deployed Last Quarter Is Probably Your Weakest Login
88% of enterprises hit an AI agent security incident in the past year. The cause isn't exotic attacks, it's identities nobody logged out or audited.
Read more
Dependency Cooldowns Beat Fast Supply Chain Attacks
Dependency cooldowns delay installing brand-new package versions a few days, blocking most npm and RubyGems supply chain attacks before malware lands.
Read more
RSA Is on a Clock Now: The 2026 Deadlines Forcing the Post-Quantum Switch
NIST's finalized post-quantum standards plus FIPS and CNSA 2.0 deadlines put RSA and ECC on a countdown. Here's why 2026 is the year to start migrating.
Read more
Durable Execution Is Moving Into Postgres
Microsoft's pg_durable, DBOS, and Temporal are pushing crash-proof, exactly-once workflows into Postgres in 2026. Here's how to choose.
Read more
WebMCP Hands Your Site's Tools to AI Agents, and Chrome 149 Just Made It Real
Chrome 149's origin trial ships WebMCP, the Google, Microsoft API that lets sites declare callable tools to AI agents instead of being screenshotted and guessed at.
Read more
Leading Technical Teams: Innovation and People, In Balance
A decade of lessons moving from engineer to leader on building teams that can run the systems they ship, under pressure, without you in the room.
Read more
Principles for Building Secure and Scalable Infrastructure
A decade of lessons on balancing security, reliability, and the room to grow, with the specific habits that actually hold up at 3 a.m.
Read moreNo articles match your search. Try a different term or topic.