标签：#Cloud

Look closely at what AWS, Microsoft, and Google shipped for AI agents this year and you notice something odd. Different names, different branding, and underneath, the exact same product. That convergence is convenient right up until you try to leave. Here's what they're all building and why it should make you a little cautious. What all three are actually building Strip away the marketing and the three big clouds are assembling the same five-part stack for running enterprise AI agents: a managed runtime to execute the agent, memory so it remembers context, identity so it can authenticate and be governed, tools so it can call your systems, and observability so you can see what it did. The products are AWS Bedrock AgentCore, Microsoft's Azure AI Foundry with its Agent365 control plane, and Google's Vertex AI agent stack. They look different on the pricing page. Architecturally, they're the same idea built three times. This isn't a coincidence. When you're solving the same problem, running agents safely inside an enterprise, you land on the same pieces. The market basically agreed on the shape of an agent platform in early 2026, and each hyperscaler raced to own it on their own cloud. Why the convergence feels great at first If your data and identity already live in one cloud, that cloud's agent runtime is the fastest path to production. Your storage is there, your identity system is there, your logging is there. The platform snaps into all of it. You get governance, audit trails, and deployment almost for free. For a team that just wants agents running with proper controls, that's a real gift. I get the appeal. The catch nobody puts on the slide Here's the trap. When your agent's runtime, credentials, state, and telemetry all live inside one cloud, moving it somewhere else isn't a config change. It's a rebuild. Take AWS Bedrock AgentCore. An agent built on it is wired to AWS identity, networking, and storage. Picking it up and moving it to Azure or Google isn't a matt

OpenAI just bought a cloud company, and if you only read the headline you'd miss the point. This deal tells you exactly where AI coding is heading: out of your editor and into the cloud. Here's what happened and why it matters. What OpenAI actually bought On June 11, 2026, OpenAI announced it's acquiring Ona, a German startup you might know by its old name, Gitpod. Terms weren't disclosed, and the deal still needs regulatory approval before it closes. Ona builds secure cloud environments where code can run. That's the whole reason OpenAI wanted it. Its Codex coding agent has grown fast, now past 5 million weekly active users, up from 3 million in April, and the jobs those agents run have gotten much longer. Tasks that used to take a few minutes now stretch into hours, sometimes days. An agent that works for hours can't live on your laptop. Close the lid and it dies. It needs a persistent place in the cloud to keep running. That's what Ona gives Codex, and notably, Ona's platform can run inside a customer's own cloud, which matters for enterprises that won't send code elsewhere. Ona's enterprise usage reportedly grew 13-fold this year, with clients like major banks and pharma companies. Why this is a bigger deal than it looks For years, AI coding meant an assistant inside your editor. Autocomplete, a chat panel, quick edits. The editor was the product. That era is ending. When agents run for hours on their own, the important question isn't "how good is the autocomplete." It's "where does the agent run, and for how long." The battleground is shifting from the editor to persistent cloud execution, and OpenAI just bought its way into that fight. The wider war OpenAI isn't alone in this move, which is why it feels like a real war now. Cursor already added cloud agents that run tasks without tying up your machine. Devin, from Cognition, was built cloud-first as an autonomous engineer from day one. Anthropic's Claude Code runs long, multi-step jobs and connects into your t

Something happened in 2026 that should be on every engineer's radar, especially if you work in finance, healthcare, government, or anywhere regulated. The US government labeled an American AI company a national security supply-chain risk. That had never happened before. Whatever you think of the politics, the professional lesson underneath it is big, so let me walk through it plainly. What actually happened The Department of Defense terminated a contract with Anthropic worth an estimated $200 million. The breakdown wasn't about price or performance. It was about how the military could use the AI. Anthropic's CEO, Dario Amodei, objected to a clause that allowed the military "any lawful use" of the model. Anthropic wanted the contract to explicitly rule out things like domestic mass surveillance and autonomous weapons, and refused to sign without those limits. The government wanted fewer restrictions. When talks broke down, the Secretary of War, Pete Hegseth, formally designated Anthropic a "Supply-Chain Risk to National Security." That label is normally reserved for foreign adversaries and hostile telecom vendors, think of how the US treated Huawei. This was the first time it had ever been applied to an American company, and reportedly the first time it was used because a company wouldn't agree to certain contract terms. OpenAI then stepped in to take the Pentagon work Anthropic had walked away from. There's a legal coda worth noting for accuracy. In March 2026, a federal judge granted a preliminary injunction against the government, writing that the designation looked like retaliation for Anthropic drawing public scrutiny, which she framed as a First Amendment problem. So the label is being contested in court, not settled fact. Why this matters beyond the headlines Strip away the politics and this is a case study in something every regulated team deals with: what happens when your AI vendor's policies collide with your requirements. Anthropic drew a hard line on use

Measured 2026-07-21 on vllm/vllm-tpu:nightly (vLLM 0.23.1rc1.dev1076), a GCE flex-start ct6e-standard-1t (one TPU v6e chip, 32 GB HBM) in europe-west4-a. TL;DR The plain google/gemma-4-E2B-it serves well on one v6e chip; none of its QAT siblings load at all. The 2-billion-parameter "efficient" Gemma 4 sustains 213 tok/s for a single user with a 16 ms first token, scales to ~2,200 output tok/s across concurrent streams, handles OpenAI-style function calling — including parallel calls and refusal to hallucinate calls — without a miss, and answers simple vision questions accurately in ~200 ms. The QAT variants are a different story: the int4 compressed-tensors export hits an unimplemented quantization path, and the bf16 QAT export trips a loader bug — the Gemma 4 implementation demands per-layer norms that E2B's KV-sharing architecture legitimately doesn't have. Filed upstream as tpu-inference #3225 . One capability coupling to know about: with a reasoning parser configured, schema enforcement only engages when thinking is enabled — thinking-off requests sail through unconstrained with a 200 status. Config interaction, not TPU limitation; details below. 1. Getting to a serving endpoint The host is a GCE flex-start VM — capacity granted on request, billed until deleted, hard-stopped at a 4-hour max run, $1.35/chip-hour. A startup script installs Docker, pulls vllm/vllm-tpu:nightly , fetches the Hugging Face token from Secret Manager via the metadata server, and launches vLLM. Boot timeline: VM RUNNING at t+0 (200 GB boot disk — the 10 GB default cannot hold the vLLM image) → Docker installed ~t+1:00 → image pulled ~t+6:00 → weights downloaded, XLA compiled, health green ~t+8:30. Two environment quirks worth knowing: Direct SSH silently times out on some networks even when the VPC allows tcp:22 — the block is upstream of the VPC. IAP tunneling ( gcloud compute ssh --tunnel-through-iap ) rides over HTTPS and works; so does tunneling the API port with gcloud compute start-

Why Your WeChat Mini-Program Work Is Actually Relevant US data engineering interviews prioritize hands-on experience with data pipelines, SQL, and scalable storage. WeChat mini-programs, though often seen as front-end tools, generate and process substantial backend data. If you designed the logic behind user actions, session management, or real-time updates, you already have transferable skills. The key is to stop describing the mini-program as a "feature" and start describing it as a "data system." Recruiters don't care about WeChat's UI components; they care about how you moved, transformed, and stored data. The Core Translation: From Mini-Program to Data Engineering When rewriting your resume, map each mini-program task to a standard data engineering function: User interaction logic → Event-driven data pipeline (e.g., Kafka, AWS Kinesis, or custom queues) WeChat cloud functions → Serverless compute (e.g., AWS Lambda, Azure Functions) Database reads/writes via WeChat API → NoSQL or relational database operations (e.g., MongoDB, MySQL, DynamoDB) Session tracking or analytics → ETL pipeline extracting user behavior data into a warehouse Do not use WeChat-specific terms like "wx.request" or "Mini Program SDK" without explaining the data they handled. Replace them with equivalent English terms. A Quick Side-by-Side Translation Table WeChat Term US Data Engineering Equivalent WeChat Cloud Database Managed NoSQL database (like MongoDB Atlas) Mini Program Backend with Cloud Functions Serverless data processing (AWS Lambda) User login & session management Authentication pipeline with token storage Real-time message push Event-driven notification system Reshaping Your Bullet Points: Before and After Generic bullet points kill your chances. Here is a concrete rewrite that turns a typical WeChat mini-program description into a data engineering achievement. Before (Chinese-English hybrid, vague): "Developed a WeChat mini-program for e-commerce with 50k users. Used wx.request

DoorDash has developed Entity Cache, a transparent proxy caching platform built on Envoy and Valkey to reduce redundant service-to-service requests across its microservices architecture. Operating within DoorDash’s service mesh, the platform serves over 1.5M requests per second with 99.99999% availability through caching, event-driven invalidation, failure handling, and performance optimizations. By Leela Kumili

AWS released Loom, an open-source reference platform on AWS Labs for governing AI agents at scale. Built on Strands Agents and Bedrock AgentCore Runtime, it implements RFC 8693 token exchange for identity propagation through delegated actor chains, config-driven deployments without runtime code generation, and mandatory tagging. AWS positions it as an example, not a managed service. By Steef-Jan Wiggers

Introduction At recent technology conferences, one topic has caught my attention: every year, more health-focused devices, sensors, and applications appear. Smartwatches track heart rate, smart scales measure body data, glucose monitors record blood sugar levels, and apps help users track sleep or nutrition. Today, the amount of information we can collect about our own bodies is enormous. This article was inspired by an everyday experience with my father, Herminio ❤️ . Whenever he has a medical appointment, he opens the Apple Health app and shows the doctor the evolution of his heart rate, physical activity, sleep hours, and other recorded metrics. While watching this, I kept asking myself the same question: are we really making the most of all this information? Showing a chart during a medical appointment can be useful, but the data could provide much more value if it were automatically processed, summarized, and transformed into a structured health report. For this reason in this project, I use Gemini to transform previously calculated metrics into a clear and organized summary. The LLM does not analyze all the raw records or perform the main calculations. The pipeline processes the data, calculates the indicators, and generates the visualizations, while the model acts as a support layer for building the report narrative. The goal is not to create a medical application or replace professional judgment. Instead, the purpose is to build a prototype that shows how Apple Health exports, deterministic data processing, visualizations, and an LLM can be combined to generate automated reports. This project was developed using simulated data from three patients, so the complete pipeline can be reproduced without using real clinical information. ✨ Why Gemini? This project uses an LLM to transform previously processed metrics into a structured narrative that can be reviewed more easily by a healthcare professional. I chose Gemini for practical reasons: 〰️ I was already famil

Some commands you can walk back. Terminating an EC2 instance is not one of them. Day 14 paired a recoverable problem, a web server knocked over by a rogue process, with an unrecoverable one, deleting a server on purpose, and the contrast is the whole lesson. One Linux task, one AWS task. Track down the process blocking Apache and restore the service, then terminate an EC2 instance and confirm it is gone. The tasks come from the KodeKloud Engineer platform. httpd: diagnose in order, then restore When httpd will not start, resist the urge to guess. Work in order. Start with what the service itself reports: # What does httpd think is wrong systemctl status httpd systemctl start httpd The status output usually names the problem, and a failed bind on the port is the classic one. Before assuming a rogue process, check that httpd's own config is sane, because a wrong port or hostname produces the same "won't start" symptom: # Check the configured listen port and server name grep -i listen /etc/httpd/conf/httpd.conf vi /etc/httpd/conf/httpd.conf # Fix the ServerName directive if it is wrong: ServerName hostname:<port> If the config is fine and the port is genuinely taken, then you go hunting for the process holding it: # Find the PID on the conflicting port sudo su - yum install -y net-tools netstat -tulpn # Clear it, then bring httpd back kill -9 <PID> systemctl enable httpd systemctl start httpd systemctl status httpd kill -9 is SIGKILL, the instant, no-cleanup kill. It is the right tool when a process is wedged and ignoring a polite request, but as a default habit, it is worth trying a plain kill first. The order that matters here is diagnostic: config before process, gentle signal before forceful one. Rushing to kill -9 at the first sign of trouble is how you mask the real cause instead of fixing it. Terminating EC2: the command with no undo Day 9 was about protecting an instance from termination. Day 14 is the other side of that lever, actually terminating one, on purp

Google's AlphaEvolve reached general availability on the Gemini Enterprise Agent Platform, turning the DeepMind research project into an evolutionary code optimization service. Evaluators run client-side so code never leaves the customer's infrastructure. Klarna doubled ML training throughput; practitioners note it only works where a measurable evaluation function exists. By Steef-Jan Wiggers

AWS has recently introduced CloudFormation express mode, a deployment option that can reduce infrastructure deployment times by marking stack operations complete once resource configuration is applied, rather than waiting for full resource stabilization. By Renato Losio

Running out of API quota in the middle of a production deployment is a frustrating rite of passage. If you are using the Google Custom Search API, you have likely hit that 100 free daily queries wall. Once you do, your application throws a 403 Quota Exceeded error, stalling your features unless you link a billing card and risk uncapped charges of $5 per 1,000 queries. In my experience, relying on Google's default limits without safeguards is a major liability. Here is how I protect my cloud budget, stretch the free tier using Redis, and transition to scalable alternatives when 100 queries are no longer enough. Step 1: Enforce a Hard Billing Cap in GCP Never rely on email alerts alone; they do not stop API requests. If a recursive loop in your code or a malicious bot targets your search endpoint, your credit card will bear the brunt. To set up a hard stop: Log into your Google Cloud Console . Navigate to APIs & Services > Enabled APIs & Services . Select Custom Search API , then click the Quotas tab. Locate Queries per day and click the edit pencil icon. Set your maximum limit to 95 (not 100). Pro Tip: This 5-query cushion gives you a safe buffer for emergency local debugging without triggering paid overages. Step 2: Implement Redis Caching Middleware Over 40% of search queries in typical web applications are repetitive. Implementing a Redis database to cache these searches can cut your API consumption by up to 80%. Here is a simple Python middleware pattern to normalize queries and cache them with a 24-hour Time-To-Live (TTL): import redis import requests # Connect to local Redis instance cache = redis . Redis ( host = ' localhost ' , port = 6379 , db = 0 , decode_responses = True ) def fetch_search_results ( query , api_key , search_engine_id ): # Normalize input to avoid duplicate cache keys normalized_query = query . strip (). lower () cache_key = f " search:cache: { normalized_query } " # 1. Check local cache first cached_data = cache . get ( cache_key ) if cach

This started as a comment @wrencalloway left on my last post. It was sharp enough that it deserved more than a reply — so here's the full version. You did the work. The page is server-rendered. The JSON-LD is in the raw response. curl returns the whole article, headline and all. A crawler that fetches your URL gets everything it needs. Except the crawler never fetches your URL. It asks the CDN, and the CDN says 403. Your content is perfect and unreachable. This is the layer underneath the one everyone talks about — and it's invisible in every tool you'd normally reach for. Two different kinds of "no" robots.txt is a note taped to the door. It says "please don't come in." A polite crawler reads it and turns around. A rude one ignores it and walks straight past. Either way, the note never touches your bytes — it's a request, enforced entirely by the visitor's own manners. A WAF or CDN rule is the door. It answers the request itself, at the edge, before anything reaches your origin: 403 Forbidden , 429 Too Many Requests , or a JavaScript challenge the bot can't solve. The HTML behind that door could be a masterpiece or a blank page. The bot sees neither. It sees the status code. People spend weeks perfecting the note and never check whether the door is locked. This isn't hypothetical — here's the data Cloudflare Radar publishes what actually happens to AI-crawler traffic across its network. From the AI Insights dashboard (7-day view, as of 18 July 2026): Of all HTTP responses served to AI bots and crawlers: 200 OK — 73.6% 403 Forbidden — 5.2% 429 Too Many Requests — 1.3% 503 — 1.1% AI-crawler response codes. Source: Cloudflare Radar, AI Insights, 7-day view, 18 Jul 2026. Read that again. More than one in fifteen requests from AI crawlers is being actively refused at the edge — 403 or 429 — before it ever touches the content. Not deprioritised. Refused. And most of that isn't a decision. It's a default — a managed WAF ruleset, a "block AI bots" toggle flipped in 2024, a

Most AI assistants forget everything after each session. Memoria remembers, forgets, and evolves—extracting personal facts, resolving contradictions, and reflecting on what it knows. This post shares the journey of building a production‑ready MemoryAgent for the Qwen Cloud Hackathon, Track 1 . Inspiration Every conversation with a typical chatbot starts from zero. You tell it you're allergic to peanuts on Monday, and by Wednesday it recommends pad thai with crushed peanuts. The model doesn't forget; it never had long‑term memory in the first place. Without durable knowledge about who you are, real personalisation is impossible. We built Memoria to solve that problem: a personal AI with human‑like memory that remembers what matters, forgets what fades, resolves contradictions, and evolves its understanding of you over time. Real memory isn't a bigger context window—it's extraction, prioritisation, decay, consolidation, and reflection. The hackathon challenged us to deliver a memory‑efficient, production‑grade MemoryAgent, and we built one from the ground up on Alibaba Cloud. What Memoria does Memoria organises knowledge in three deliberate tiers: Session Memory (Redis) – the last 10 messages of the active chat. Personal Memory (PostgreSQL 16 + pgvector) – user‑centric facts embedded with text-embedding-v3 , ranked by hybrid scoring, and subject to decay, consolidation, and conflict resolution. Context Archive – full transcripts stored for on‑demand search, never polluting routine retrieval. Other key features: Autonomous memory lifecycle : daily decay, weekly consolidation, and background reflection. Personal Intelligence toggle : global memory access vs. session‑only. Memory‑Less incognito mode : no memory reads or writes. MCP skills server : exposes get_core_memories , get_user_preferences , forget_memory , and strengthen_memory to any Qwen agent. Conflict detection & versioning : contradictory facts are automatically flagged and superseded. Persona customisation :

If someone asked me ten years ago what it takes to break into cloud, I would have said "get certified and hope someone gives you a chance." I was wrong. And I watched dozens of freshers follow that exact advice, collect a certification, then sit in interviews unable to explain why they chose one architecture over another. The problem was never knowledge. It was proof. Proof that you can gather requirements from a confused client, design something that works, and actually build it with your own hands. AWS just launched something that helps close that gap. And two of these credentials cost nothing. Table of Contents What AWS SimuLearn Badges Actually Are Why This Matters More Than Another Certification The 12 Badges Available Right Now The Free Starting Path I Would Follow Today The LinkedIn Advantage Nobody Is Talking About For Career Switchers: Your Existing Skills Are the Cheat Code My Honest Take After 10 Years in Cloud What AWS SimuLearn Badges Actually Are SimuLearn is not another video course. Not another multiple-choice exam. You sit in a simulated client meeting powered by generative AI. A virtual customer explains their business problem. You ask questions, uncover requirements, handle objections, and propose an architecture. The AI evaluates your communication, your technical accuracy, and your decision-making in real time. Then you build the solution. In a live AWS environment. Not a sandbox with three buttons. The real console. After that, an automated validation confirms your solution actually works. Complete every assignment in a learning plan, and AWS issues you a badge through Credly. Automatically. No exam booking. No proctored test. Just demonstrated capability across the full workflow. Each badge represents the entire journey: customer conversations, architecture design, hands-on building, and validated outcomes. Not a single quiz. Not one lab. The whole thing. Why This Matters More Than Another Certification I hold 7 AWS certifications. Let me tell

Patreon is strengthening its defenses against AI scraping by working with Cloudflare to block bots that train AI models on creators’ content without permission. The move marks a shift away from relying on websites using robots.txt alone to actively block unauthorized AI training.

✍️ This post was written with two hands. The story — the first part — is Murilo's, lived and told by the person who was there. The technical manual , at the end, was written with AI. The split is intentional and marked in the text. Nothing hidden about the seam: part is human, part is machine, and the reader sees both. If you've ever managed or logged into a web server and never set up SSH keys, it's because you don't yet know the real risks of a break-in — and that's okay. Until you find out what can happen. Logging into a server over SSH with a username and password is like locking the front door of a house that faces the street, with nobody keeping watch. Anyone can try as many combinations as they want, freely. And setting this up takes almost as much time as typing a username and password — and it makes getting into the server much faster and easier afterwards. Ignorant of best practices, I managed my servers for a long time by typing: ssh user@server-ip password That nearly cost me dearly, the day I found out my server had been broken into. After that incident, I realized just how vulnerable a username and password are on SSH. Today I can't say I sleep soundly — no system is completely break-in proof — but I sleep a lot better (and honestly, I always slept well, until I started managing servers). Waking up on a fine Sunday morning to do some maintenance on the server, and finding out it was broken into through the front door because you left a combination padlock facing the street — that is not the kind of surprise I'd wish on anyone. I have a degree in Law. I worked for 15 years in the legal field at a public institution, until I decided to venture into the world of programming. And where did I end up? Managing systems at the institution I work for, after spending some time building automations in Python. Managing systems wasn't exactly what I had in mind when I wanted to learn to code and understand the world of programming. But that opportunity ended up tea

A new technical analysis published by the Cloud Native Computing Foundation (CNCF) argues that the future of agentic AI will be built not on entirely new infrastructure, but on the mature cloud-native ecosystem that already powers modern distributed applications By Craig Risi

Today I'm excited to launch RegionCheck , a tool for testing, monitoring, and debugging endpoints from cloud regions around the world. The idea is simple - test an endpoint's DNS and HTTP connectivity and response from a defined set of cloud regions. Whether you're troubleshooting an API, validating a deployment, checking DNS propagation, or investigating latency, seeing the results from multiple cloud regions can quickly reveal issues that aren't obvious from your own machine. What is RegionCheck? RegionCheck lets you run endpoint checks from AWS, Azure, and Google Cloud regions without provisioning infrastructure or maintaining test instances. Current capabilities include: HTTP endpoint testing DNS lookups TLS certificate validation Continuous monitoring with alerts Side-by-side comparison across cloud providers and regions Shareable result pages for collaboration API/MCP access for automation and agents Why I built it When debugging production issues, I often wanted to answer questions like: Is DNS returning the same result everywhere? Or is geo-DNS returning the results intended? Is TLS certificate propagation for my CDN working as intended? Is one region significantly slower than another? Is my CDN caching working as expected? Are my geo-HTTP redirects working as intended? (For some interesting examples try www.yahoo.com and www.cnn.com in non-US regions) There are many tools that exist that provide these answers, but nothing that answers all of these questions in one place. That's what RegionCheck aims to provide. Who it's for RegionCheck is designed for engineers who work with cloud infrastructure, including: DevOps engineers Site Reliability Engineers (SREs) Platform engineers Backend developers Anyone who likes to take a peek at backend infrastructure Try it out RegionCheck is available at https://regioncheck.io You can run free checks directly from the website; or create an account to access monitoring, alerting, the API, and additional features. I'd love

Amazon Web Services has recently introduced AWS Continuum, a new integrated security platform to automate the discovery, enforcement, and remediation of security issues across codebases, dependencies, and applications. AWS Continuum launches with four agentic capabilities, aiming at the entire vulnerability lifecycle: penetration testing, code review, threat modelling, and code vulnerabilities. By Gianmarco Nalin