标签：#Cloud

👋 Hi DEV Community! I'm the creator of Cloud Compass , a newsletter dedicated to making cloud computing easier to understand. If you've ever felt overwhelmed by the constant stream of cloud updates, new services, documentation, and buzzwords, you're definitely not alone. I originally published this as the welcome issue of my newsletter, and I'm sharing it here because I hope it helps developers, students, and anyone starting their cloud journey. ☁️ Welcome to Cloud Compass Cloud news, concepts, and insights without the overwhelm. The cloud is moving fast. Let's make sure you're not left behind. Welcome to Cloud Compass — your guide to staying current with cloud computing while building real cloud knowledge, without feeling overwhelmed. Let's be honest. Keeping up with cloud technology is exhausting. Cloud providers release new services, features, and updates almost every week. Between official documentation, blog posts, YouTube videos, LinkedIn posts, and countless tutorials, it's difficult to know: What actually matters? What should you learn first? Where do you even begin? That's exactly why I started Cloud Compass . This isn't a newsletter written by AI or filled with copied announcements. It's written by someone who genuinely enjoys learning cloud computing and wants to make it easier for everyone else—whether you're: A developer trying to stay current A student entering the cloud world for the first time A professional who wants to understand cloud technology without spending hours reading documentation The goal is simple: Show up regularly with something that's actually useful. "I want Cloud Compass to feel less like reading tech news and more like having a conversation with someone who already read everything and saved you the time." Here's what you can expect 📰 Cloud News Roundup The most important updates from across the cloud industry—not just AWS, Azure, and Google Cloud, but the wider cloud ecosystem. No endless lists of links. No unnecessary hype. Just

Picture this: You just spent weeks building an awesome new feature. It's fully tested and ready to go. But when you hit "Deploy," your entire application goes down for 5 minutes, and your users are met with a blank loading screen. Not a good look. In the world of DevOps and Cloud Infrastructure, how you roll out updates matters just as much as the code itself. AWS Elastic Beanstalk gives us 5 distinct deployment policies to handle this smoothly. Let's break them down from simplest to most robust so you know exactly which one to pick for your next project. 1. All at Once (The Speed Demon) This is the simplest method. Elastic Beanstalk takes all your existing servers, shuts them down, deploys the new code, and boots them back up simultaneously. [ Old App ] ─> SHUTDOWN ALL ─> DEPLOY NEW ─> [ New App ] The Good : It’s incredibly fast. The Bad : Your app goes completely offline during the deploy. When to use it : Only in development environments where downtime doesn't matter. Never use this in production! 2. Rolling (The Line Worker) Instead of updating everything at once, Beanstalk splits your servers into batches (e.g., 2 at a time). It takes the first batch offline, updates them, brings them back online, and then moves to the next batch. Batch 1: [ Updating... ] Batch 2: [ Running Old App ] Batch 1: [ Running New App ] Batch 2: [ Updating... ] The Good : No total downtime! Your app stays online. The Bad : While a batch is updating, your overall server capacity drops. Plus, users might experience a "mixed state" where refreshing switches them between the old and new version. When to use it : Production environments that can handle a temporary dip in bandwidth. 3. Rolling with Additional Batch (The Safe Substitution) To fix the capacity problem of standard rolling, this policy launches a brand new batch of instances first. Once those new servers are healthy and running the updated code, Beanstalk starts rolling the update through the old servers. [Old Servers: 100% Capa

Cloudflare has recently shared how they uncovered an issue in their Rust implementation of CUBIC, a congestion controller algorithm, which prevented it from recovering from a scenario of heavy packet loss at the start of a connection. By Gianmarco Nalin

Netris provides software that runs on network switches, and offers a platform that helps neocloud operators reduce the time it takes to go live.

Adobe said that it will integrate Topaz Labs' tools across its apps.

Modern cloud deployments involve many tools with different lifecycles, creating a heavy burden on engineers. The Kubernetes ecosystem offers a unified Control Plane approach. Sharing best practices through tech talks and inner-source collaboration can create an engaged community and drive adoption. By Ben Linders

Cloudflare released the Cloudflare One stack, an open-source library of agent skills for planning, deploying, and managing Zero Trust environments. The skills include automated migration logic for Zscaler and Palo Alto Networks, the same logic used in Cloudflare's Descaler program that has moved enterprise customers in hours rather than months. By Steef-Jan Wiggers

If a regulator asks how you would move off your current cloud provider tomorrow, "we would figure it out" is no longer an acceptable answer. Most modern cloud deployments are deeply tied to provider-specific services, creating invisible dependencies that make true portability feel out of reach. Multi-cloud runtime approaches are expensive and complex, requiring duplicated infrastructure and operational teams. What you actually need is standardized portability. Here is how you can tackle it: Define your entire application environment using a single configuration file. Keep your infrastructure definition provider-agnostic, versioned, and auditable right inside your Git repository. Recreate the environment on another infrastructure provider without redesigning the deployment model or rewriting code. By decoupling your application from specific cloud consoles, you eliminate infrastructure re-architecture and give compliance teams a concrete blueprint. Check out our full technical write-up to see how to build an actionable exit strategy: Portable cloud architecture for DORA compliance | Upsun Discover how financial institutions can meet DORA exit strategy requirements by avoiding vendor lock-in with a portable cloud architecture. upsun.com

Slack has outlined how its AI serving infrastructure evolved through four distinct phases, moving from a self-managed Amazon SageMaker deployment to a multi-cloud architecture spanning AWS Bedrock and Google Cloud Vertex AI. By Matt Foster

Jump Tables, TLV Footers, and the Real Cost of Reading What You Don't Need You're paying for bytes you never read. A data engineer on a busy pipeline touches dozens of Parquet files a day: schema discovery, predicate pushdown, column pruning, metadata scrapes for a data catalog sync. In each case, the application needs maybe 200 KB of context from a file that is 4 GB on disk. Without a seekable archive format and a jump table to find the right frame, your HTTP client fetches the whole thing, and your cloud egress invoice reflects every unnecessary gigabyte. This post quantifies the problem, then walks through how HuskHoard uses seekable Zstd frames, a per-volume jump table, and TLV-encoded footer metadata to make partial egress a first-class citizen across multi-volume archives — disk, cloud, and LTO tape alike. The Problem, In Dollars S3 standard egress runs $0.09/GB. GCS is $0.08/GB. Even Cloudflare R2, which is free for egress from R2 to the internet , still costs you in latency and API call count when you cannot bound the range of bytes you need. Here is a representative read pattern for a cold analytics archive: Operation Bytes Needed Bytes Fetched (naïve) Ratio Schema discovery ~50 KB (Parquet footer) 1–8 GB (full file) ~1:16,000 Single column scan ~200 MB (one column chunk) 4 GB (full row group) 1:20 Data catalog sync (1M files) ~50 GB (footers only) ~4 PB (full files) 1:80,000 Selective restore (1 row group) ~128 MB 4 GB 1:32 On 100 TB of cold Parquet data with $0.09/GB egress: Full read for schema sync : 100 TB × $0.09 = $9,216 Partial read (footers only, avg 100 KB/file, 1M files) : ~100 GB × $0.09 = $9.00 Savings per catalog sync: $9,207 — 99.9% reduction Even a conservative column-scan scenario (pulling 15% of each file's bytes) cuts a $9,216 monthly read bill to $1,382 . The ceiling on savings is determined entirely by how precisely you can address the bytes you actually need. That precision is what frames and jump tables buy you. Zstd Frames: What They

Introduction This is the second part of sharing my journey to create a microservices-based backend system, in the previous part, I introduced the system and its services. In this part I am going to mention the main things that happened with me from then until now. Transitioning to online DBaaS platforms The first main thing was to transition my databases from my local device to accessible over the internet. I used Neon and MongoDB Atlas . Although performance-wise it is better to deploy the database on the same server that the whole system so all services can access the databases without network overhead , This solution is better from a point, that is avoiding consuming the free VM instance that I got to host my main services, as with DBaaS platforms I will not require storage for databases or additional overhead to handle the DBMS on a free small resources-constrained VM. Observability Observability is one of the main concerns in any system, it gives the ability for the system to expose what happens inside it without any need to guess and manually trace the code to determine where the error may happened. I utilized OpenTelemetry , as I found it is most used and accepted tool to log, trace and collect metrics about the system and the traffic. Also, I loved that it is not related to specific framework, that is .NET by the way, I loved the idea that it is standalone tool. But logging and tracing and metrics collection will not be beneficial if we do not see it actually and can achieve monitoring from those telemetry data, so I used Grafana Cloud to export the telemetry data to some place that is accessible online and a tool that can generate dashboards and visualizing for the metrics ( Prometheus ), and UI that can show all the telemetry data easily. Deployment Until this point, we have a system that is fully functional and have consistent docker configuration for its services via Docker Compose, and it database is already there and available. Now this is the point at

I have written some version of "never hardcode secrets, store them in Key Vault instead" in at least five of my last nine posts on this blog. I never actually stopped to explain what that means in practice. This post fixes that, using the real secrets this very blog depends on: a database connection string, an admin panel password, and a set of GitHub deployment credentials. What Azure Key Vault Actually Is Azure Key Vault is a managed service for storing secrets, encryption keys, and certificates securely in the cloud. Instead of a password sitting in a configuration file or a public GitHub repository where anyone with read access can see it, the password lives in Key Vault - encrypted, access-controlled, and logged every single time it is read. Picture your code as a house with see-through walls - anyone looking at the repository can see everything inside, including any password left lying on the kitchen table. Key Vault is a bank vault a few streets away. Your code does not hold the password directly; it holds a key card that lets it walk over and request the password at the exact moment it is needed. Lose the key card, and you still cannot get into the vault without proper identity verification on top of it. Three Things Key Vault Stores Secrets are plain string values - passwords, connection strings, API keys, tokens. Keys are cryptographic keys used for encrypting and decrypting data, or for signing and verifying it. Certificates are X.509 certificates used for TLS or client authentication between services. Most applications, including this one, primarily use the Secrets feature. An Honest Admission About TechStackBlog's Own Setup This blog does not actually use Key Vault directly today. The database password lives in Azure App Service Configuration. The admin panel password and deployment credentials live in GitHub Secrets. For a single-application personal project, this is a perfectly reasonable and secure setup. Key Vault earns its place once you have multi

Building a Spring Boot application is only half the journey. At some point, every backend project reaches the next question: Where should this application actually run? If you are deploying on AWS, two common options are: Amazon EC2 Amazon ECS Both can run the same Dockerized Spring Boot application. But they are not the same kind of deployment model. EC2 gives you a server. ECS gives you container orchestration. Choosing between them is less about which one is “better” and more about which one fits the stage of your application. Starting with EC2 EC2 is the most direct way to run a Spring Boot application on AWS. You create a virtual machine, install what you need, and run your application. For a Dockerized Spring Boot app, the flow often looks like this: GitHub Actions ↓ SSH into EC2 ↓ Pull latest code or image ↓ Build / run Docker container ↓ Spring Boot app runs on EC2 The mental model is simple: One server One Docker container One Spring Boot application That simplicity is useful. Especially when you are launching an MVP, a freelancer project, an internal tool, or your first production version. Why EC2 Works Well for Many Spring Boot Apps EC2 is not outdated just because newer deployment platforms exist. For many applications, EC2 is enough. It works well when: traffic is predictable the application is small or medium-sized you want full control over the server you want simple debugging through SSH you do not need multiple replicas yet you want to keep infrastructure easy to understand A common setup might be: Spring Boot Dockerfile Docker Compose GitHub Actions EC2 That setup can be production-ready for many early-stage apps. It gives you: a real deployment target repeatable Docker builds automated deployment through GitHub Actions simple logs direct server access For a solo developer or small team, that matters. You can understand the entire deployment flow without needing a full container orchestration platform. The Tradeoff With EC2 The tradeoff is that you

AWS made Graviton5-powered EC2 M9g and M9gd instances generally available with 192 ARM cores, formally verified VM isolation via the Nitro Isolation Engine, and DDR5-8800 memory. ClickHouse reported 36% better performance with zero code changes. Meta committed tens of millions of cores. On-demand pricing is 9% above Graviton4, translating to roughly 15% better price-performance. By Steef-Jan Wiggers

Every AI developer has been here: your app is throwing 503s, users are pinging you, and you have 12 browser tabs open — OpenAI status page, Anthropic status page, the GitHub Copilot health page, three different Discord servers — trying to figure out is this me or is it them? That's the problem we set out to solve. Prismix aggregates status from 77 AI services in one place. Six weeks of running it in production taught us some things that might save you time. The problem is worse than you think AI APIs don't fail like traditional infrastructure. They fail in weird, partial ways: Degraded performance that passes your health checks but makes your product feel broken Regional outages — OpenAI US-East is down while EU is fine, so half your users are affected Silent rate-limit cascades — the API returns 429s but their status page says "operational" for another 20 minutes Incident lag — providers often post status updates 10–30 minutes after engineers are already aware The official status pages are optimistic by design. They're customer-facing communications tools, not real-time engineering dashboards. There's nothing wrong with this — but it means you need a different mental model for "is this service down?" What 77 status pages look like in aggregate When you watch 77 AI services simultaneously, patterns emerge fast. OpenAI is the most-watched service (and has the most incidents to watch). The pattern is almost always the same: investigating → identified → monitoring → resolved , typically in 45–90 minutes. The investigating phase is where most developers panic — it looks bad but usually resolves without action on your end. Anthropic runs noticeably clean compared to its API usage growth. Incidents are rarer and shorter. When they do happen, updates arrive faster than most providers. The long tail is interesting. Services like Replicate, Runway, ElevenLabs, and Suno have incident patterns that don't correlate with OpenAI at all. If you're routing across multiple providers

Most organizations know exactly how many employees they have. Far fewer know how many non-human identities currently have access to their cloud environment. That blind spot is becoming one of the fastest-growing attack surfaces in modern security. For years, enterprise security focused primarily on protecting human identities. We deployed Single Sign-On (SSO), enforced Multi-Factor Authentication (MFA), and implemented Conditional Access policies. And it worked — human identities have become significantly harder to compromise. Meanwhile, another class of identities has quietly exploded across cloud environments: service principals, workload identities, OAuth applications, CI/CD runners, and AI service roles. Today, these Non-Human Identities (NHIs) often outnumber human users by a factor of 10 to 50. As organizations accelerate cloud adoption and integrate AI into daily operations, this imbalance continues to grow. Defining the Non-Human Identity Landscape Unlike human users, machine identities rarely appear in HR systems or organizational charts. Yet they frequently hold some of the most privileged access in the environment. Common high-risk categories include: OAuth Applications and Third-Party Integrations — Apps granted broad access to Microsoft 365, Salesforce, Google Workspace, or Slack via delegated permissions. Service Principals and Managed Identities — AWS IAM roles, Azure Managed Identities, and GCP service accounts used by Lambda functions, EC2 instances, or Bedrock agents. Workload Identities — Kubernetes Service Accounts (e.g., Amazon EKS) and GitHub Actions OIDC roles. CI/CD Pipeline Identities — Tokens used by automation platforms to deploy infrastructure. AI Service Roles — Dedicated identities for Amazon Bedrock agents, model invocation, vector stores, and retrieval pipelines. Every new AI workflow creates additional machine identities. Why Attackers Are Targeting NHIs Attackers follow the path of least resistance. While human accounts are now heav

When we open sourced Neural Inverse Cloud, the easiest choice would have been MIT. Most developers like MIT. It's short, permissive, and widely adopted. If you've released an open-source project before, MIT is probably the first license you considered. We didn't choose it. We chose AGPL. Not because we dislike permissive open source. Not because we want to restrict users. We chose it because infrastructure software plays by different rules. The Infrastructure Problem MIT works incredibly well for libraries. You publish code, developers use it, and occasionally improvements flow back into the project. Nobody is forced to contribute, but community norms often make it happen anyway. Infrastructure software is different. Cloud IDEs, databases, developer platforms, deployment systems, and backend services can be monetized without ever distributing the source code. A company can: Fork your project Add proprietary features Launch a hosted version Build a competitive advantage on top of community work Never contribute anything back The original project does all the R&D. The fork captures the value. We've seen this pattern repeatedly across open-source infrastructure over the last decade. Why AGPL Exists AGPL closes a loophole that traditional open-source licenses leave open. With GPL, if you distribute modified software, you must publish your changes. But what if you never distribute the software? What if you simply run it as a hosted service? That's where AGPL comes in. If you modify AGPL software and provide it to users over a network, you must also provide the source code for those modifications. That applies to everyone. Including us. If we improve Neural Inverse Cloud, those improvements stay open. If someone else builds a SaaS business on top of it, their modifications stay open too. Why This Matters for Users We wanted users to have guarantees. With AGPL: You can self-host the latest version Community improvements remain accessible No company can create a permanently

As software engineers, we often architect solutions in a virtual ideal: fast networks, elastic resources, and servers that never physically degrade. But what happens when your carefully crafted systems need to interact with the messy, unpredictable physical world? Think factory floor monitors, real estate camera networks, or remote tracking devices. Suddenly, those cloud assumptions about infinite uptime and perfect connectivity crumble. My journey, particularly architecting and maintaining a continuous 24/7 camera livestream for a real estate group over six years, has been a masterclass in this reality. It's revealed that true reliability in the physical realm demands a hybrid approach – one that intelligently merges the power of edge computing with the scalability and data insights of the cloud. This isn't just about connecting devices; it's about building resilience into the very fabric of your architecture. In this article, I'll share the battle-tested strategies and design principles that enable systems to not just survive, but thrive, despite the harsh realities of physical deployment. 1. The Core Strategy: Smart Edge, Simple Cloud One of the most common pitfalls in hybrid architecture design is treating the edge device as a mere 'dumb' terminal, solely responsible for streaming raw data to a powerful cloud backend. This approach creates a critical single point of failure: if the network drops, the entire system grinds to a halt. Instead, I advocate for a Smart Edge, Simple Cloud architecture. This principle establishes a clear division of responsibility: The Edge : This is where the magic happens locally. The edge system should be robust enough to handle local processing , data filtering , buffering , and immediate hardware control . Critically, it must be capable of operating autonomously for extended periods without an active cloud connection. Think of it as a mini data center, designed for self-sufficiency. Benefits of a Smart Edge : Reduced bandwidth cost

AWS recently introduced Amazon Cognito multi-region replication, which automatically replicates user identities and user pool configurations from a primary region to a secondary one. This enables applications to continue authenticating users from a replica region during outages, without requiring custom replication and failover mechanisms. By Renato Losio

🐍 Python for DevOps — Class 5 Notes Topic: String Methods, Conditional Statements ( if/elif/else ), Loops ( for , range() ) 📌 Key Concepts Overview Concept One-Line Definition String Methods Built-in functions to inspect and transform strings if / elif / else Execute code blocks based on conditions for loop Iterate over any iterable — string, list, range, dict range() Generate a sequence of numbers to loop over Nested if An if block inside another if block Nested for A for loop inside another for loop 🔤 Part 1 — String Methods (Continuation from Class 4) Checking String Case # islower() — True if ALL characters are lowercase ' devops ' . islower () # True ' Devops ' . islower () # False # isupper() — True if ALL characters are uppercase ' DEVOPS ' . isupper () # True ' Devops ' . isupper () # False # Practical: normalize before comparing env = input ( ' Enter environment: ' ) if env . lower () == ' production ' : print ( ' ⚠️ Deploying to PROD! ' ) Checking Digit / Numeric Strings Method Accepts Rejects DevOps Use isdecimal() 0-9 only decimals, superscripts Port validation isdigit() 0-9 + superscripts decimal points Version numbers isnumeric() 0-9 + superscripts + fractions decimal points Broadest check # Key difference — decimal point breaks all three ' 8080 ' . isdecimal () # True ' 8080 ' . isdigit () # True ' 8080 ' . isnumeric () # True ' 80.80 ' . isdecimal () # False — dot is not a digit ' 80.80 ' . isdigit () # False ' 80.80 ' . isnumeric () # False # DevOps use: validate user input before casting port_input = input ( ' Enter port: ' ) if port_input . isdecimal (): port = int ( port_input ) else : print ( ' ❌ Invalid port — must be a whole number ' ) replace() — Find and Replace in Strings # str.replace('old', 'new') ' Python ' . replace ( ' P ' , ' J ' ) # 'Jython' ' prod-server-01 ' . replace ( ' - ' , ' _ ' ) # 'prod_server_01' ' This is python class ' . replace ( ' i ' , ' a ' ) # 'Thas as python class' — ALL occurrences # DevOps: sanitize strings for us