151 posts tagged with "DevOps"

Running Terraform from laptops and self-hosted CI works until your team hits 10 engineers and 20 state files. At that point, you spend more time managing the Terraform workflow than the infrastructure itself — who has access to which state, where are credentials stored, how do you enforce policies, and who approved that apply? Terraform Cloud (TFC) is HashiCorp's answer: a managed platform that handles state, execution, policies, and collaboration. But it comes with trade-offs in cost, flexibility, and vendor lock-in.

ARM templates are powerful but painful. A simple storage account takes 30 lines of JSON with cryptic syntax, deeply nested properties, and string concatenation that makes your eyes bleed. Bicep is Microsoft's answer — a domain-specific language that compiles to ARM JSON but reads like actual code. Same deployment engine, same capabilities, a fraction of the complexity.

Your code passed all tests, the PR is approved, and you're ready to deploy. But how you deploy matters as much as what you deploy. A bad deployment strategy turns a minor bug into a site-wide outage, while a good one lets you roll back in seconds with zero customer impact.

Bridge networks work on a single host. Your containers can talk to each other when they are on the same machine. But when you have three application servers across three hosts, a bridge network does nothing for you. Overlay networks solve this — they create a virtual network that spans multiple Docker hosts, letting containers communicate as if they were on the same LAN, regardless of which physical machine they are running on.

You have a CI pipeline that builds your container image and runs tests. The last step runs kubectl apply -f manifests/ against the production cluster. It works, until someone SSH-es into the server and runs kubectl edit deployment to "hotfix" something. Now your Git repository says one thing and the cluster says another. Nobody knows what is actually running in production. This is the exact problem GitOps solves.

The app works on staging but fails on production — here's the systematic way to find out why. Every seasoned SRE has a mental decision tree for production incidents. The tools are always the same: strace to see what a process is doing, lsof to see what files it has open, tcpdump to see what's on the wire, and ss to see socket state. Master these four and you can debug almost anything.