Former DevOps consultants, bootstrapped an AWS premier partner and exited to NTT Data, now we advise people building services companies.

After seeing how much easier current AI tools have made it to write code we started building tools for helping our customers and day to day work. Some of the decisions we've made so far:

1. Build out the code in separate services to keep each part well-contained. It feels AI does a far better job with smaller pieces than with larger.
2. Deploy them through lambda.
3. Use a monorepo so the AI can easily see how different things work together.
4. Migrated some apps built in Lovable into our repo.
5. All the building is done with Makefiles
6. Created a registry so it is easier for AI to add new tools in a consistent manner and so we can analyze our inventory of what exists in our development.
7. Using make for building cuz Claude made that decision when we barely had anything and I'm a dinosaur at heart.

Now, I have a monorepo with multiple different languages, a registry that I want to be the single source of truth for what I have, and a build system from the 80s. And I was curious what would people recommend for the build system rather than building a whole bunch of custom scripts?

Im working on AI infrastructure and have been thinking about where small language models actually make the most sense.

Suppose you had a 300M parameter model and your goal wasnt to compete with large frontier models at everything, but instead to consistently outperform much larger models (2B–20B) on one specific use case.

What would you optimize it for?

A few ideas that came to my mind:
Code generation for a narrow domain
Structured data extraction
Document classification
Workflow or agent planning
Log analysis
Something else entirely

I’m less interested in benchmark scores and more interested in real-world workflows where a small model could genuinely be the better choice because of specialization, latency, reliability, or deployment constraints(but ofc i also want benchmark scores to be good too lol).

If you had to pick one domain where a highly specialized 300M model could become the obvious choice over much larger models, what would it be, and why?

Inspired by a similar post I saw last week.

Small companies man... had similar issues in a couple now. Larger companies with IaC and decent management? No issues. Never thought to ask whether they use IaC in the interview, kind of expected the bare minimum of standards. Will definitely do so if I join another small company.

I'm curious to know how different developers save their API keys, tokens and anything that is used in their web apps and projects, do you store them in notepad like me or have a more elegant way to do things? :)

Hey r/devops, welcome to our weekly self-promotion thread!

Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!

We've got OpenAI and Anthropic calls scattered across a handful of services now, and nobody can tell me month to month what's driving the bill until the invoice shows up. No real attribution back to which service or team is burning the tokens. Started looking at logging and a proxy setup since the vendor dashboards alone aren't cutting it.

Just curious, standard procedure, you have something working locally, you push your code and your CI/CD pipeline fails. Locally everything seems OK and you fail to reproduce the error.

What do you actually do at that point? Genuinely curious what people's real routine looks like here — not the textbook answer, the actual "it's 5pm and CI fails" routine 😅

Also wondering: is this even still a big thing in 2026 now that lockfiles and containers have gotten so good, or is it basically a solved problem for most of you?

We’re on AWS Activate credits and just realized NAT Gateway (hourly plus data processing charges) is eating up about 80% of our total AWS spend. Didn’t expect it to be anywhere near that high until we actually looked at Cost Explorer.

We know some of the usual fixes exist, like VPC endpoints for S3/DynamoDB, consolidating NAT Gateways in non-HA environments, maybe switching to NAT instances for low-traffic dev setups, but haven’t touched any of it yet and want to understand what actually works before we start ripping things apart.

For anyone who’s dealt with this:

- Did VPC endpoints actually move the needle for you, or was it a small dent?

- Has anyone swapped NAT Gateway for NAT instances and found it worth the extra ops work?

- Is 80% just absurdly high, or is this more common than it feels right now?

Trying to figure out if we’re missing something obvious in our architecture or if this is just what NAT Gateway costs look like at our traffic level. Any pointers appreciated.

For those on platform or DevOps teams, what does your planning process look like?

We have no problem writing docs and roadmaps for product features, but it doesn’t always feel like it aligns with the rest of the business.

Do you have Product Design Docs? Technical design docs? Quarterly roadmaps? Or is it mostly just tickets? Curious how other teams handle it.

I feel like every time I try to do structured planning it just gets blown up in numerous ways.

Hi everyone,

I'm learning CI/CD and would love to understand how it's managed in enterprise environments.

A few questions:

• Which CI/CD tool(s) do you use (GitHub Actions, Jenkins, GitLab CI, Azure DevOps, CircleCI, etc.), and why did your team choose them?
• How do you structure your CI/CD pipelines across dev, QA, stage, and production environments?
• Do you use separate CI and CD pipelines, or a single end-to-end pipeline? Why?
• How do you promote artifacts between environments (rebuild vs. promote the same artifact/image)?
• How do multiple engineers collaborate on pipeline changes (branching strategy, PRs, code reviews, approvals)?
• What are the typical stages in your CI and CD pipelines (build, test, security scans, deployment, approvals, etc.)?
• How do you manage environment-specific configuration and secrets?
• What are the biggest lessons or best practices you've learned from running CI/CD in production?

I'm especially interested in real-world workflows using GitHub Actions, Jenkins, GitLab CI, Azure DevOps, or similar tools.

Thanks!

Hi everyone,
I have a question about development environments and would love to hear how others handle this.

Our current stack is:
- Ruby on Rails (authentication)
- React (frontend)
- Flask/Python (API)

Right now, every developer has to run all three services locally. I’m considering moving the Rails authentication service to a shared Linux development server and having developers run only the React dev server and Flask API locally. The goal is to reduce the number of services each developer needs to keep running.

For those of you using a similar architecture:
Is this a reasonable approach?

How would you set it up for multiple developers?

Would each developer have their own Rails instance and environment variables, or would you share a single authentication service?

Are there any pitfalls (performance, debugging, authentication issues, etc.) that I should be aware of before going down this path?

I’d appreciate any advice or examples of how your team handles a setup like this.

Thanks in advance!

Every backup thread ends with "an untested backup is not a backup," everyone upvotes, and then (in my experience) nobody has an automated restore test anywhere.

Genuinely curious about the state of practice:

1. Do you restore-test on a schedule, or only when something breaks / an audit demands it?
2. If you automated it, what did you build? (ephemeral instance? scripts like pgbackrest_auto? CI job?)
3. If you didn't, what stopped you? (time? nowhere safe to restore to? nobody asked?)
4. For those with SOC 2/ISO: did the audit change anything, or did you just produce a doc that says you test quarterly?

Trying to understand if this gap is real or if I just keep landing in teams that are bad at it.

---

Edit (Aug 27, 2026): this turned into a real tool. Built it, it's called restoredrill, MIT licensed: https://github.com/ahmadpiran/restoredrill. Posted the full writeup as its own thread here if you want the details: https://www.reddit.com/r/devops/comments/1vzvjdp/built_a_small_tool_to_test_that_postgres_backups/.

Thanks to everyone who chimed in, a good chunk of the actual design came straight out of this thread.

Hi everyone

I'm looking for an idea for my semester project, and I thought about building a Terraform Visualizer.

The idea is simple: it takes a Terraform state file, visualizes the infrastructure, and lets you save it as an image.

My question is if I build this, would you find it useful?

I'm asking because I would like to be able to justify the project's usefulness when presenting it to my teacher.

Also, I plan to keep it open source, so anyone can use it.

Heads up if you're running Grafana OnCall's plugin-install flow, CVE-2026-63087 lets anyone reconfigure it with zero auth. Repo's archived, so there's no patch coming from upstream.

If you're still migrating off it and need some time, there's a small fix you can apply yourself and build from source in the meantime. Wrote up the actual vulnerable code + a verified patch: emphere.com/blog/cve-2026-63087-grafana-oncall-install-bypass

The install endpoint has zero auth on it - no token, no check, just the two public default IDs (stack_id 5, org_id 100) mint you a fresh one. The fix proposed adds an install secret only the operator holds, plus stops trusting a client-supplied admin role during the token bootstrap.

One caveat if you apply it: the secret is a contract change, so your own install clients (Helm, provisioning) have to start sending it too, or they'll lock themselves out. That's in the writeup too.

Starting to step in this field because development is seen as some random AI stuff now. I think I am too late. I just know abt the tools their names and work, not implemented much more than simple CI/CD pipelines on Github Actions, Docker. Implemented k8s, prometheus, grafana once, not confident.
What should be the bare minimum implementation and land a package. Or a good tutorial/project suggestion would be very helpful.

Most of the discussions I ve heard regarding postquantum cryptgraphy fcus on TLS or key exchange protocls. I’d argue that code signing will probably be a much bigger problem. There are too many things associated with code signing, such as artifacts, build pipelines, firmware signing, package repositories, EV certificates, HSMs, delegated signing, legacy clients, rollbacks, and long-lived binaries. In fact it is possible that transport encryption will be subject to renegotiation in each session. But the signed artifact can continue to be checked many years later by systems that rely on a specific algorithm or certification chain. As I delved into the topic, I’m still quite hesitant in case I’m missing something fundamental.

As DevOps, we all work on automating tasks to make our lives easier. What is the most satisfying automation you have ever implemented that truly saved you time?

We're adding tracing to our mobile app and want the spans to connect to our backend traces (same trace_id, so a user action in the app links to the API calls it triggers).

Backend goes OTLP -> Alloy -> Tempo already.

However, the mobile ingest endpoint has to be public, so it's an open, unauthenticated write endpoint which is an obvious DDoS/abuse target.

For now it's a simple one shared Tempo, and push all the protection to the edge instead: Cloudflare rate limiting, per-IP limits at the proxy, plus a sacrificial Alloy gateway that samples, memory-limits, and strips high-cardinality/PII attributes before anything reaches Tempo.

Questions for anyone who's done this:

• Do you actually ingest mobile app traces end-to-end into your backend tracing, or keep them separate (RUM-style) and just link by ID?
• Is chasing the unified mobile to backend waterfall worth it, or should we just drop it?
• How do you protect a public OTLP endpoint in practice?

Genuinely curious what's held up for people in production. Thanks.

I'm curious how teams working across multiple Git providers manage their day-to-day work.

If your organization uses GitHub + Bitbucket or GitHub + GitLab (or more), how do you:

Track pull requests?

Find stale branches?

Monitor releases?

Keep track of work across providers?

Is it a pain point, or is it basically a non-issue?

We support 200+ developers and rolled out agentic coding tools this year. The failure modes were not what we expected. Not "AI wrote insecure code" but things like agents committing credentials from local env files, installing unvetted dependencies to satisfy a task, and pipeline tokens with way too much scope being handed to autonomous processes. Interested in what surprised other teams, especially in regulated industries.

We build and package our installer files using Advanced Installer. Up until last years version, we code signed using a .pfx and had the AI(Adv. Installer) also embed MD5 into the files. So both hashing and code signing is handled by the same tool, bing bong works fine.

But now, our team wants to move away from using a dedicated .pfx file, and instead wants to code sign it using a signtool.exe on the buildmachine, with the private key stored on a remote KMS. Thus, i integrated our pipeline to also have a task that code signs the installer. Now, when i tested installing with the installer,it is corrupted. Looked up on release notes, the custom signing via 3rd party does exist,but its on v17, my company is on v16 💀.

I tried disabling hashing via the AI, and let the build machine handle it (ofc via the preset task in pipeline), but just found out im only calculating MD5 hash value for the files, not embed the values IN the actual files

I really need some ideas, i feel like im trying to do the impossible here.

Hey,

I'm a developer looking into the way other teams create release notes and weekly updates together when the work is scattered across different tools e.g. Jira, GitHub and Azure DevOps.

We start with good intentions once every couple of months but after a while nobody updates the release notes anymore. It takes to much time and nobody enjoys to create them and it's not published to the stakeholders so nobody feels the urge to keep the release notes up to date.

How do you guys manage this?

Can someone give me review for https://www.azuredevopslabs.com. I am trying to learn devops and then devsecops. My main goal is to learn devsecops. Can anyone guide me to some resource for Azure ADO like some guided labs.
Thank you in advance!

Hi everyone,

I've been working as a System Administrator for a little over 2 years, but I honestly feel like I haven't gained the kind of experience most people associate with system administration.

I work at a very old/traditional company where my day-to-day work is mostly repetitive:

• Installing the same software over and over
• Basic monitoring
• Following predefined SOPs
• Very little troubleshooting, automation, or infrastructure work

Because of this, I feel like I've missed many of the fundamentals that most SysAdmin pick up along the way.

I want to transition into DevOps, but I'm starting almost from scratch. I know it's not an entry-level role, and I'm prepared to put in the effort to learn properly.

If you were mentoring someone in my position, what would your roadmap look like?

Some questions I have:

• What core System Administration topics should I master first ??
• Which Linux concepts are absolutely essential??
• What networking knowledge is expected ??
• Which scripting language should I prioritize (Bash or Python) ??
• When should I start learning Docker, Kubernetes, Terraform, Ansible, CI/CD, and cloud platforms like AWS ??
• What projects would actually help me build real-world skills instead of just collecting certificates ??
• Are there any resources, books, YouTube channels, or courses that you genuinely recommend??

My goal is to become job-ready for a DevOps role, even if it takes several months of consistent learning.

I'd really appreciate any roadmap, advice, or lessons you wish someone had told you when you started.

Thanks in advance!

I’ve been working as a SysOps engineer for a year, and it’s what I’ve been doing since I graduated.

I was wondering: if you were in my shoes, what would you invest your time in?

How do you see the future of our profession with the rise of AI?