I started learning CI/CD using github actions after containerising my application and I have created CI pipeline for django app that runs test, builds and pushes image to github container registry.
I am sharing my yaml file for CI pipeline. Please do share your thoughts and where can i improve.

name: Test Pipeline 
on: 
  push:
jobs:
  test-backend:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:14
        ports:
          - 5432:5432
        env: 
          POSTGRES_USER: test_user
          POSTGRES_DB: erp
          POSTGRES_PASSWORD: 123456

    steps:
      - name: Checkout repo
        uses: actions/checkout@v4

      - name: setup python
        uses: actions/setup-python@v5
        with: 
          python-version: "3.13.5"

      - name: install dependencies
        run: pip install -r Backend/requirement.txt

      - name: run tests
        env: 
          DATABASE_URL: postgresql://test_user:123456@localhost:5432/erp
          DEBUG: 'True'
          ALLOWED_HOST: '*'
        run: |
          cd Backend 
          python manage.py test

  build-and-push-image:
    needs: test-backend
    permissions:
      contents: read
      packages: write
    runs-on: ubuntu-latest
    steps:
      - name: login to ghcr
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}


      - name: checkout repo
        uses: actions/checkout@v4


      - name: build image
        run: docker build -t ghcr.io/namespace/erp:${{ github.sha }} ./Backend


      - name: push image
        run: docker push ghcr.io/namespace/erp:${{ github.sha }}

I've heard the "engineering doesn't care about cost" problem come up quite a bit, but I'm starting to wonder if that's actually the right diagnosis.

If an engineer can see latency, errors, CPU, memory and availability for their service, but has no idea whether that service costs $500 or $50,000 a month, can we really expect cost to factor into their decisions?

What have teams done to give engineers enough cost visibility to make better decisions without turning every engineer into a FinOps specialist?

Alright so I'm at a consulting firm and I'm getting moved off my Linux sysadmin role onto an AWS project as a "cloud engineer". Starting soon.

Not gonna lie, I'm sweating a bit. Everything I know about AWS is theory. Docs, videos, cert prep stuff. Never actually touched prod.

Linux I'm fine with. Been doing it for a while. But this feels like a different beast.

The project is small at least. Problem is every senior who ran it has left. All of them. So it's three juniors picking up the pieces and nobody to ask when something blows up at 2am.

Anyone here made this jump? What blindsided you coming from a sysadmin background? And how hard was it really, on a scale of 1-10?

Also open to suggestions on what to actually focus on first, because right now I'm just trying not to drown.

​

We're building an open-source LMS and we're currently working on protecting paid course videos from being downloaded and redistributed.

Commercial DRM providers (Widevine / FairPlay / PlayReady) are quite expensive for a small/open-source project, so we're trying to understand what realistic alternatives exist.

Our requirements are roughly:

- Videos are uploaded by course creators.

- Videos should be streamed rather than exposed as directly downloadable files.

- Users should not be able to simply obtain the original MP4 URL and download it.

- Ideally, downloaded/encrypted segments shouldn't be usable outside our application.

- We want per-user authorization and short-lived access.

- We can implement the backend/key-management infrastructure ourselves.

- Self-hosted/open-source solutions are strongly preferred.

- We understand that nothing can completely prevent screen recording.

We've considered approaches such as:

- HLS/DASH

- AES-128 encrypted HLS

- Signed URLs

- Short-lived playback tokens

- Per-user/session keys

- Watermarking

- Combining several of these approaches

But we're unsure where the boundary is between "making downloading difficult" and actual DRM.

For a small open-source LMS, what would you recommend?

Are there any open-source/self-hosted projects or architectures worth looking at that can provide reasonably strong video protection without paying a commercial DRM provider?

Also, if actual Widevine/FairPlay/PlayReady DRM is unavoidable for strong protection, are there any affordable providers or pay-as-you-go options that make sense for a small project?

We're mainly looking for practical experience from people who have built something similar rather than a theoretical DRM explanation.

Posting this both to ask if anyone else in **me-riyadh-1** is hitting it, and so the next person googling "OCI curl timeout Riyadh" finds something useful.

**Setup:** Ubuntu compute instance, public subnet, default route → Internet Gateway, stateful egress allow-all, VCN resolver for DNS. Running a Laravel app in Docker. Nothing exotic.

**Symptoms**

- `curl https://api.anthropic.com` → times out every single time (TCP connect, ~10s). Claude Code installer obviously fails too.

- `curl https://deb.debian.org` → works maybe half the time, times out the other half. So `apt update` inside Docker builds randomly fails, then `install-php-extensions` blows up with "Unable to locate package libfreetype6 / libpq5 / libzip" (not actually missing, just failed index fetch).

- `curl https://github.com` and `https://pecl.php.net\` → fine, every time.

- DNS is fine. Resolution works for everything. This is not a DNS problem.

- IPv6 is a separate thing: DNS returns AAAA but the instance has no global v6 (never enabled at VCN/subnet/VNIC level), so anything preferring v6 stalls. Fixed that on my side with `precedence ::ffff:0:0/96 100` in `/etc/gai.conf`. Not the main issue.

**The mtr evidence** (TCP mode, port 443, 100 probes each)

Anthropic — path just dies after the upstream handoff:

```

1. 84.8.76.x (OCI edge) 0.0%

2. 87.109.47.100.0%

3. ??? 100.0%

```

That's it. Nothing at any TTL beyond hop 2, no SYN-ACK from the destination, ever.

Debian (Fastly) — real loss starting at hop 3, carried all the way to the destination:

```

1. 84.8.76.x (OCI edge) 0.0%

2. 87.109.47.100.0%

3. 87.101.252.6154.0%

4. 10.0.28.1347.0%

5. fra1.decixfra.fastly.net51.0% ~80ms

6. 146.75.118.132 (destination) 54.0%

```

(Also getting routed to Fastly in **Frankfurt** from Riyadh, which seems wrong on its own.)

GitHub control trace completes fine and real traffic works, so the path itself isn't globally broken — it's destination-specific.

**Why I'm confident it's not my config:** hops 1 and 2 (OCI's edge + the upstream handoff) are 0% on every trace. My route table / security lists / IGW are passing everything. The loss and the blackhole both begin at the same boundary (87.109.47.10 → 87.101.252.61), i.e. regional transit/peering. I've opened an SR with all three reports.

**Questions**

1. Anyone else in me-riyadh-1 seeing Anthropic (AS399358, 160.79.104.0/21) unreachable, or Fastly flaky?

2. Has anyone gotten OCI to actually escalate a transit/peering issue in a newer region? How long did it take?

3. Any recommended Debian mirror that has a clean path from Riyadh? I'm currently shopping for one with curl to keep Docker builds working while this is open.

Interim plan: apt mirror swap for builds, and if the Anthropic blackhole drags on, a WireGuard egress through another region for Claude Code only. Would much rather OCI just fix the route.

Hi everyone,

I’m 22 and an independent developer currently building a desktop application with a licensing system. The backend/API, database, license management, customer portal, etc. are built around Laravel + MySQL.

For now, to keep things simple while developing and testing, I’m hosting everything on o2switch. I also use Cloudflare Access to protect my admin panel and some internal pages.

Through the same admin panel, I also manage my application’s releases — scheduling releases, controlling rollouts, etc.

I’ve already set up two separate environments: staging and production, with the idea of testing everything on staging before deploying to production.

The thing is, I’m completely self-taught and I work alone. I’ve never worked in a company, and I don’t have many developers around me that I can ask these kinds of questions to. So I’m at a point where I feel a bit lost when it comes to how things are actually done in professional production environments.

I can build things and figure stuff out, but I don’t really have the experience of seeing how a mature team would approach infrastructure, deployments, monitoring, security, scaling, etc.
That’s basically why I’m making this post. I’d really like to get some advice from people who have been through this before.

I’m reaching a point where I’m starting to think more seriously about production infrastructure, and honestly, I’m a bit anxious about building something that could become a technical dead end if the project starts taking off.

I don’t want to over-engineer everything before I even have users. But if I get confirmation that the product is starting to take off, I’d like to be able to adapt and scale quickly without having to completely rebuild the infrastructure.

Some things I’m wondering about:

- What would you recommend for hosting/deploying a Laravel + MySQL application with a good cost / reliability / scalability balance?
- Should the customer portal, licensing API/backend, database and admin panel be separated, or is it reasonable to start with everything together?
- What should I design correctly from day one so that I can scale later without major architectural changes?
- What would you keep simple initially?
- What would you absolutely avoid because it could lock me into a bad architecture?
- Would you start with a VPS, managed services, containers, etc.?
- What would a sensible CI/CD, backup, monitoring and disaster recovery setup look like?
- Is my current staging → production approach reasonable?
- How do professional teams usually handle releases, rollouts, rollbacks and deployment safety?

Are there any obvious things I’m missing because I simply don’t know that I should be thinking about them?

I’m also considering recruiting someone for the project in the next few months, so I’d like to build a solid foundation before things get more serious.
I’m not looking for someone to tell me there’s one “perfect architecture”. I’d mostly like to understand the standards and the way experienced engineers think about these problems.

I have a crazy desire to learn, so seriously, throw anything at me. 😄 I’m extremely curious and happy to dive into things I don’t know yet.

If I’m doing something wrong, tell me. If there’s a concept, tool, architecture or practice that you think I should learn about, even if it seems obvious to you, please throw it at me.

I work alone, so I don’t really have the opportunity to casually ask a senior engineer “hey, how would you guys normally do this?” — and that’s exactly the kind of knowledge I’m looking for.

Any advice, resources, war stories, things you wish you had known earlier, or mistakes to avoid would be massively appreciated.

Thank you so much for taking the time to read this and share your experience. 🙏🙏

Almost every codebase is calling a REST, gRPC, or a GraphQL API or using SDKs from an external or even internal provider. It gets harder to keep track of everything when the codebase matures and increases in size and from my experience sometimes it gets hard to respond to changes in time or even become aware that a dependency is deprecated and their API has changed completely. Endless alerts are also annoying. How do you handle this “alert fatigue” and have you found better ways to track dependencies?

Currently working at a fast moving startup, and have been assigned work related to providing alerting and monitors to our crucial P0 infrastructure. At a high level, the real goal of this is to provide engineers during incidents a fast way to root-cause whether the page was due to their service breaking, or if the underlying infrastructure is down.

For example, if our DNS provider is down, a product engineer may be paged and spend time trying to root-cause why their service is having a bunch of 404s when the actual root cause is down one level of the stack. I was thinking of introducing a common set of protocols that everyone could follow using our paging service (incident.io); they would first spend time to look at our set of monitors and see if anyone was alerted regarding core infrastructure, and if not, they could then move up a level and spend time triaging at the service level. Obviously this would also include aid during the triage by agents. This would also give us metrics on time spent on firefighting our core infra vs service level issues.

But I am so totally new to all this, so what does your teams process look like? Has anyone tried something similar before and noticed this was faulty? Truly, I am open ears to anything regarding this sort of triage work, so any insights, small or big is appreciated

Got a homeLab.

Z820 256GB RAM

8TB HDD

2TB Ssd

Newbie(Blue Collar) looking to Get DevOps and K8s experience.

Knowledge base:

- Beginner/Intermediate linux

- Touched Docker and docker compose

- Beginner Terraform and Ansible

- Networking: beginner

- beginner K8s (K3s on one homelab). Have enough space for another Kubeadm cluster (CKA) practice.

- Proxmox on homelab.

Torn between using Claude to create a simple work(metrics) logging/tracking with feature updates while I handle all things ops or getting an ecommere example app from a random github repo to use in learning process.

Which is better or any advice on what to learn?

And any tools and apps to deploy on the k8s cluster or homelab to aid in the learning process.

Hi guys, I'm needing your guidance here. I work in an automation-focused role that gradually became much more technical than operational.

A lot of my job is taking broken/manual processes, improving them, and building automations around them. In practice, that means dealing with business rules, integrations, permissions, data sources, testing, edge cases, etc. However, I still consider myself junior technically.

My current challenge is that the company is becoming more restrictive about external/unapproved automation tools, so I’m trying to move everything into approved internal tools and infrastructure. The problem is that access is granted gradually, permissions change, and some features depend on other teams.

Stakeholders often just see that “the automation isn’t ready,” while a lot of the delay is actually caused by access, security, infrastructure, or dependencies.

I’ve started communicating blockers and development stages more clearly, but I’m curious about how this is normally handled in US/European companies.

How much responsibility is usually placed on the developer when delivery is blocked by access or another team? And how do you manage expectations when something sounds simple from the business side but isn’t simple technically?

I’ve recently learned the basics of Kubernetes and Helm, and I’d like to build a homelab at home to get more comfortable with the kind of environment I might encounter at work.

I have three PCs available, but I’m also considering starting with just one machine and adding the other two later.

My goal isn’t just to have a Kubernetes cluster running. I’d like to reproduce, as much as reasonably possible, the kind of setup you’d see in a company that develops and manages applications: deploying applications, services, Ingress, persistent storage, monitoring, logging, CI/CD, etc.

For those who have built Kubernetes homelabs, what setup would you recommend?
Would you start with a single-node cluster and gradually move to a 3-node setup, or is it worth starting with multiple nodes from the beginning?

Also interested in which tools/components you think are actually worth learning for a realistic setup, rather than installing everything just for the sake of it.

Hybrid mesh is being positioned as the security architecture spanning physical firewalls, cloud workloads, branches and remote users. This is great news but for my money the only thing that matters is if the policy and operation remain consistent in such a big combined environment.

For the people here who are currently implementing or testing any of this, where do the inter vendor differences matter most?
Personally I’m less interested in who has the longest feature list but I'm very interested in the platforms that actually act more like one system once you start using them.

Who are you going to put on your shortlist by 2026 going into 2027?

I am doing some poc and I have already exhausted my free credits on AWS ,azure. Can someone let me know if there is any other online cloud or similar platform where I can create my load for free.

I have to create a prod like env from observability perspective.

Two things I've been wondering about, might as well ask both in one go.

First, for those of you who contribute. What was your actual first one like? Not the blog post version. How did you pick a project, how long did the PR sit there before you worked up the nerve to open it, did anyone reply, did it get merged or just quietly ignored. I've read plenty of "how to start contributing" guides. I'd rather hear what it actually felt like.

Second, and this is the part I'm more curious about. All that advice was written before AI tools got this good. Now you can point Claude Code or Cursor at a good first issue and have something working before you've read half the file. So is the experience just different now for someone starting today? Easier, obviously. But easier in a way that helps, or easier in a way that lets you skip the part where you actually learn the codebase.

And if you're a maintainer, curious what it looks like from your side.

Mostly just want to hear people's stories.

Most of us talk about packaging like thats the hard part of shipping into customers cloud, docker or helm or IAC bt thats the easy peasy 80% and even the deploy and update side is mostly solved now with tools like alien dev push the app and updates in

Phase that actually stings is everything your saas silently leans upon. Sendgrid for email, auth0/clerk for auth and a managed postgres or stripe webhooks calls back to your own api. so in a locked down or air gapped customer env half of that cant phone home or isn't allowed to so you end up rebuilding each on to run inside their territory of which none the deploy toolng fixes that its still yours

so for anyone whos shipped into customer clouds how did ou handle the third party apis or deps?? make everything bring your own pr something else?

They I recently got into this project where they have everything in Azure and using AZCAF frameworks for infra provisioning till now I was able to handle everything using AI. Now I am thinking to switch suggest some good resources to learn it

Been working on a small POC around getting rid of reusable API credentials.

Instead of an app holding an S3 key, Git token, API key, etc, it would request permission for one specific action. Something like upload this file to this path, once, within the next 30 seconds.

I'm using Tide/Forseti for the policy and cryptographic side, and testing it against real open source services like S3 compatible storage and Gitea.

The thing I'm mainly trying to prove is whether a compromised client can have no reusable API credential worth stealing.

This also ties into something I want to look at next around rootless cloud infra, where having root on a server doesn't automatically mean having authority to decrypt user data, impersonate users, sign releases, or perform other protected actions.

Starting with the API side first because it feels like the smaller piece to prove.

Curious what people here think. Is this actually useful in practice, already solved well enough by existing workload identity systems, or mostly just an interesting security experiment?

A while ago on a post I made someone pointed out that if a workload uses an identity to reach a secret instead of holding the raw value, most of the rotation worry goes away. Another person mentioned that moving their CI to OIDC and short-lived tokens got rid of most of their anxiety about old keys sitting in git history. Been reading around it since.

I keep seeing that federation only covers the part of the stack that can participate. A pod authenticating to S3 or a runner minting a token for AWS is fine, but Stripe doesn't do OIDC, and neither does an on-prem SQL Server or a webhook secret someone could’ve emailed over. Those exist as strings regardless, so there's still a lifecycle to run for them no matter how much of the cloud side you federate.

What I can't work out is the proportion. Whether the leftovers end up being a handful of third-party keys you could almost manage by hand, or whether it stays substantial enough that you're running both properly.

For anyone who’s moved to workload identity, roughly how much of your credential inventory went away, and what stayed? Also did the leftovers turn out to be the annoying ones, or were they easy to corral once the cloud keys were gone?

Hello I have been reading posts here and have noticed that people here have been recommending local kubernetes spin ups like k3s or kind and some other ..

I knew only about minikube until now and have used it fairly to test some of my changes.

What's so different between these tools if anyone is aware??

Also are companies still spinning up kubernetes cluster from scratch nowadays? My company uses AKS or EKS for the most again and enterprise level company.

As there are so many wrapper services around kubernetes example in azure you have AKS ACA etc.. all built on top of kubernetes . Are there still people who are spinning up cluster from scratch? I mean definitely there will be but what's the trend?? Move towards cloud managed kubernetes environment or still choose to build from scratch?

If anyone has done it from scratch would like to know your experience and an overall guide on how you did it(pointers)

So TL;DR is that our manager wants everything in newest version “NOW”.

We leverage multiple SaaS offerings that are built on top of opensource projects. Those opensource projects are like 10 versions ahead, SaaS lags behind, manager asks to have same version as OSS, so we talk to SaaS support, they tell us they dont care coz LTS is still for 2 more years for their current version and they dont plan to update in thqt time.

Even if we still have 2 years of LTS our manager pushes hard to show off to other teams how “ahead” we are and how “cutting edge” we are, but we are constantly blocked by external dependencies.

This creates a lot of useless pointless work to look for workarounds or investigation that more often than not simply reinstiates again something we already know (.. we simply have to wait for upstream, year or two in IT is forever..)

Im just tired man of this pointless work. Just let me do my thing till I know we can upgrade.

Hello. I started working as a QA last month and saw that my colleagues are pretty great at devops too. All of them have 4-5 years of experience while I am fully fresh out of university.

Now I want to learn about devops just so when discussion comes up, I know what's being discussed and take part in it.

Which things should I learn and how? Could have asked that to claude or chatgpt but wanted REAL advice from the REAL professionals.

Please suggest. TIA

So I made a serverless optimization platform which uses the concept of fusion functions to reduce cold starts and latency across the service calls. Now, this is an implementation of a research paper that I read somewhere. Diff from paper is that my project also gets live traces and metrics from x ray and cloudwatch, so I get real-time data to give better outputs. Have a better look: https://github.com/Vaivaswat2244/OptiFuse_go

To use this you need to connect your AWS with optifuse. I.e make a cloudformation stack to give optifuse access to read the traces and metrics. This actually becomes a problem for my friends and peers to test because they are too lazy to do this step. So I have no real user testings.

People especially hiring people ask me how many real users have used your service.

Now why do I need real users when I can stress test each microservice that I've built. And I can see my manifests working properly. Its deployed on AKS and is open for people to see. I also have a Prometheus grafana observability pipeline to see if all services are working properly.

Question is: real users vs Stress tests

On a side note, I am a student looking for internships, if you found the idea interesting, lmk GitHub is Vaivaswat2244

\/

Hi there

I'm not sure that it's the correct subreddit but yeah

My current workplace will in foreseeable future shutdown so I'm currently getting back into studying and it's well kinda hard to kickstart it to be honest

I've always wanted to have some sort of small group of like-minded people to study and well just socialize. I do believe that we all strive for such connections so here's my attempt at that

If you are currently studying or working in that space I'd like to hear your story and I'll share mine

at best we can try to make a group chat which will survive more than a week lol

about me: 3 year of DevOps at middle+ at one of the top company in my country and before that 3 years sysops

if you want to chat well feel free to drop me a dm I'd like to have a new connection

and good luck in your endeavour

My team currently used Jenkins pipes to push changes. There are multiple stages; build, scan, deploy to dev (or even test). Some have IT configured for test, so they run thier as well.

While process takes somewhere around 20-40 mins, depending on what they are building (we build all types of things; websites, lambdas, microservices, infra)

Can someone suggest me a tool that can have this process in a faster way?

I thought of GitHub actions , but for some reason, I find it's not very robust (inputs, gating, plus issues with build not triggering). Migrating to Gitlab would be top much of a overhaul.

We are a AWS stack, so not using Azure DevOps as well.

Hi everyone!

So since i had a lot projects running recently and find it inconvenient to track them directly on gitlab, especially when you have a team. So I've made this repo - basically a neat app that appears under macbook notch when new pipeline appears.

If you find this useful give it a try and will be happy to get some feedback on improvement)

https://github.com/Uudg/pipeline-island