标签：#Cloud

You’ve built your model, your training code is containerized, and you’re ready to scale up on Google Kubernetes Engine (GKE). You go to provision your nvidia-h100-80gb node pool and... QUOTA_EXCEEDED. It’s one of the most common (and frustrating) roadblocks in modern AI development. High-end accelerators like H100s, A100s, and TPUs are in massive demand, and securing permanent, on-demand quota for them can be difficult. But a lack of on-demand quota doesn't mean you're out of options. GKE provides two powerful, cost-effective strategies for acquiring these scarce resources when you can't get standard, on-demand instances: Spot VMs and the Dynamic Workload Scheduler (DWS) . Let's break down what they are, when to use each, and how to implement them. Strategy 1: Spot VMs Spot VMs are Google Cloud's excess compute capacity sold at a massive discount, up to 90% off the price of standard on-demand VMs. They are perfect for workloads that can be interrupted. The catch is that Spot VMs have no availability guarantee. Google Cloud can "preempt" (i.e., terminate) them at any time if that capacity is needed for on-demand customers. GKE gets a 30-second warning before the node is terminated. Kubernetes uses this window to gracefully shut down your application (giving non-system pods up to 15 seconds to wrap up) before the node vanishes. When to use Spot VMs for accelerators Spot VMs are ideal for workloads that are: Fault-tolerant and stateless: Your application can handle a node vanishing and having its pods rescheduled elsewhere. Batch processing: Jobs that can be easily restarted or have checkpointing built-in. CI/CD pipelines: Running tests or builds that don't need 100% uptime. How to use Spot VMs in GKE You can easily add a Spot VM node pool to your GKE Standard cluster. The key is to use Spot VMs for your workers, not your critical system pods. Create a dedicated Spot VM node pool: When creating a node pool, simply add the --spot flag and apply a taint so standard pods

A security researcher found that adding a trailing slash to AWS HTTP API paths bypassed Lambda authorizer authentication entirely, enabling unauthenticated wire transfers at a fintech. The root cause is a path normalization mismatch between HTTP API's greedy route matching and its authorization layer. The same vulnerability class appeared in gRPC-Go via CVE-2026-33186. By Steef-Jan Wiggers

Originally published on rikuq.com . Republished here for Dev.to's readers. The FinOps Foundation Framework is the reference architecture for cloud financial management. It's been maintained by the FinOps Foundation (a Linux Foundation project) since 2018 and has matured into the de facto standard most serious cloud cost work is built on. In 2026 it received a substantial refresh that extended its scope from pure cloud spend to include AI/ML, SaaS, licensing, and broader technology categories. For practitioners thinking about formalising FinOps practice — or evaluating providers who claim to do FinOps — knowing what the Framework actually covers is what separates a real implementation from a marketing label. This post walks through the Framework structure, the 2026 updates, and how it applies specifically to AI/ML spend. I'm Ravi. I run three production AI SaaS solo ( Prism , Citare , BatchWise ) and do advisory work on FinOps via rikuq services . The walkthrough below is what I use when teams ask "what does the FinOps Foundation Framework actually look like in practice?" TL;DR Element What it is Phases Three concurrent operational modes: Inform, Optimize, Operate Principles Six foundational principles guiding all FinOps practice Capabilities The functional areas of activity a FinOps practice covers Personas Engineering, Finance, Procurement, Leadership, Operations, ITAM, Sustainability 2026 additions Executive Strategy Alignment, Technology Categories taxonomy, Converging Disciplines recognition AI/ML extension New Technology Category with specifics on GPU/CPU differential, token pricing, make-vs-buy economics The six foundational principles Before the structural mechanics, the Framework's six principles establish the cultural and operational mindset. They're worth knowing because they're how the Framework's authors test whether something is "really" FinOps or just cloud cost cutting. Teams need to collaborate. Engineering, Finance, Procurement, and Business teams w

We were running a cloud-hosted platform on AWS EKS , with EC2 worker nodes managed by us, MongoDB Atlas for NoSQL workloads, AWS RDS for relational databases, and Amazon ElastiCache for Redis for caching and temporary data. Over time, the infrastructure had grown the way most real systems grow: more services, more data, more backups, more images, more snapshots, and more “temporary” resources that were no longer temporary. The platform worked, but the cloud bill was higher than it needed to be. So we started cutting waste, improving the application, and resizing the infrastructure around how the system actually behaved. The result: around $120,000 in annual savings , without sacrificing reliability. The Problem Was Not One Big Thing When we started reviewing the infrastructure, it was clear that there was no single expensive resource causing the entire problem. The cost came from many places at once. Some services were using more CPU and memory than they needed. Some microservices did not really need to be separate anymore. Some databases were oversized for their actual usage. Some storage had accumulated over time. Some backups and snapshots were kept longer than necessary. Some resources were simply unused. That is usually how cloud costs grow. Not because of one bad decision, but because of hundreds of small decisions that were reasonable at the time and never revisited later. So instead of looking for one magic fix, we approached the problem from multiple angles: application code, architecture, databases, Kubernetes resources, storage, backups, caching, and non-production environments. The Optimizations 1. Making the Application Use Fewer Resources One of the most important parts of the optimization was improving the application itself. It is easy to look at cloud cost as an infrastructure problem only, but inefficient code directly affects infrastructure cost. If the application uses too much CPU or memory, the platform needs more pods, larger nodes, bigger ins

AI placement latency is not the problem most teams think they are managing. The default framing treats it as an optimization variable — pick the cheapest compute that meets the SLA, centralize inference, optimize for utilization, revisit locality later when the architecture matures. That framing is wrong in a way that compounds over time. AI placement decisions are not continuously reversible optimization choices. They are architectural commitments that harden incrementally — through inference path configuration, data gravity, routing dependencies, and runtime behavior that normalizes around whatever topology you chose first. By the time latency SLAs begin failing, the placement topology is already embedded across routing, observability, and application behavior. The remediation cost is not an optimization exercise. It is a re-architecture. The First Optimization Becomes the Permanent One Cost is the default optimization axis for AI placement decisions. Centralized GPU clusters are cheaper to operate per token than distributed inference endpoints. Utilization density justifies centralization on paper. Procurement processes reward it. FinOps tooling measures it. So teams centralize. They optimize the compute economics. They defer locality decisions to a later phase when requirements are better understood. That later phase rarely arrives before the architecture has already made the locality decision implicitly — through the inference paths built against a centralized endpoint, the data gravity that formed around it, and the application behavior that normalized against the latency profile it produced. The pattern this creates is latency debt: accumulated runtime latency overhead from placement decisions that optimized for cost before locality requirements were operationally visible. It accrues gradually, stays invisible until something triggers it, and is significantly more expensive to resolve after the fact than it would have been to avoid at design time. It does not

Google Cloud's automated systems suspended Railway's production account without notice, triggering an eight-hour platform-wide outage affecting 3 million users. The cascade took down workloads across all providers including AWS and bare metal because Railway's control plane was hosted on GCP. Railway is demoting GCP to backup-only status. By Steef-Jan Wiggers

Most people understand that a Compute Savings Plan saves money on cloud compute. Far fewer understand the precise mechanism which matters, because getting the commitment amount wrong in either direction costs real money. Too high: you pay for committed hours you do not use. Too low: you miss savings on usage that could have been covered. The difference between a well-sized Savings Plan and a poorly-sized one can easily be tens of thousands of dollars per year on a mid-size fleet. This guide walks through the exact mechanics, hour by hour, with worked examples on both AWS and Azure. Step 1: You Choose a Commitment Amount Before anything else, you decide how much per hour you want to commit. This is the single most important decision in the entire process. Everything else is automatic, the discount application, the coverage calculation, the billing. The commitment amount is a dollar figure: $X per hour. It represents a minimum spend level. You are telling the cloud provider: every hour for the next 1 year (or 3 years), I guarantee I will use at least this much compute. The right commitment amount is your stable baseline, not your average and not your peak. Pull your last 30 days of hourly compute spend. Sort the values. Find the P70 or P75: the spend level you are at or above for 70–75% of hours. That is roughly where your commitment should sit. Why P70–P75 and not the average? Because the average includes your peak hours and your quietest hours equally. If you commit to the average, you generate wasted commitment in the bottom 50% of hours. At P70, you are paying for unused commitment in only 30% of hours and those hours only waste the difference between actual usage and committed amount, not the full committed amount. If you want to understand how commitment-based discounts work across AWS, Azure, and GCP, we covered the full landscape here What Are Commitment-Based Discounts in Multi-Cloud Services? Step 2: The Cloud Provider Applies Discounted Rates Once you have

I use "what is my IP" sites maybe once a month. Every time I end up on something covered in ads, calling three different tracking APIs, and showing me results I don't fully understand. So I spent a weekend building whatsmy.fyi. The thing I didn't expect: you don't need an IP geolocation API at all if you're on Cloudflare Workers. Every request comes with a cf object that already has your city, country, ISP, TLS version, HTTP protocol, and RTT. Free. Zero latency. The part I enjoyed most was the WebRTC leak test. It checks whether your browser is exposing your real IP through RTCPeerConnection even when you're on a VPN. I ran it on my own setup. It was leaking. Zero logs. Zero storage. Just your data, shown to you. https://whatsmy.fyi

Platform team sprint planning in 2026 begins with budget allocation, not architecture review. The first question is no longer "what do we need to build?" — it's "what can we afford to run?" This is not FinOps adoption. This is authority displacement. The platform team became a finance team because the control plane for infrastructure decisions migrated from architecture governance to budget governance. Cost constraints don't inform architectural decisions anymore — they dictate them. And when financial systems gain veto authority over technical systems, resilience becomes the variable that adjusts. Platform team cost governance is now the primary control surface. Architecture is secondary. How We Got Here The timeline is sharper than most organizations admit. 2018–2022 was the cloud adoption phase. Platform teams built for scale. Multi-region resilience was standard. Observability was deep. Auto-scaling was elastic. Architectural requirements shaped cost models. The budget followed the design. 2023–2024 brought FinOps as a cost visibility layer. Teams could finally see where money was going. Dashboards got built. Anomaly detection got configured. Attribution models got refined. But visibility was still separate from authority. The FinOps team reported. The platform team decided. 2025–2026 is when cost governance moved from reporting to gating. The turning point: platform teams stopped asking "can we build this?" and started asking "can we afford this?" Engineering roadmaps became cost roadmaps. Feature requests now come with budget allocation approvals. Architecture reviews now include CFO sign-off gates. This shift introduced Budget-Normalized Architecture — systems designed around predictable monthly spend targets instead of operational resilience targets. The architecture no longer optimizes for failure domains, latency requirements, or recovery objectives. It optimizes for staying under the cost ceiling. Cost governance expanded because engineering governance fa

Microsoft announced Azure Linux 4.0 and Azure Container Linux at Open Source Summit. Azure Linux 4.0 is a Fedora-based general-purpose server distribution for Azure VMs, the first time Microsoft has offered a supported Linux beyond container hosting. Azure Container Linux is an immutable container-optimized host built on Flatcar. By Steef-Jan Wiggers

n fan-out microservice architectures, slow-but-completing requests accumulate across services and drive p99 latency far higher than per-service metrics suggest. This article presents an adaptive hedging mechanism that uses DDSketch for real-time quantile estimation, windowed rotation to handle distribution drift, and a token-bucket budget to prevent load amplification. By Prathamesh Bhope

Cloudflare recently added support for Claude Managed Agents, allowing developers to run and manage Claude agents within Cloudflare. Developers can connect agents to private systems, choose their runtime environment, and monitor agent activity using Cloudflare services. By Renato Losio

If you've trained a transformer in the last three years, your GPU spent most of its wall-clock time inside a matrix multiplication. The kernels doing that work were probably written by cuBLAS, generated by a compiler stack like Triton, or hand-assembled on top of NVIDIA's CUTLASS templates. CUTLASS is the one most people don't see directly, but it sits underneath a surprising amount of modern AI infrastructure — from FlashAttention to vLLM to several internal kernels inside PyTorch. What CUTLASS actually is CUTLASS — CUDA Templates for Linear Algebra Subroutines — is a header-only C++ template library NVIDIA publishes on GitHub under Apache 2.0. It is not a drop-in replacement for cuBLAS. cuBLAS gives you a closed-source binary with a stable API: you call cublasGemmEx and you get a tuned kernel. CUTLASS gives you the building blocks to write your own kernel, with control over tile sizes, data layouts, epilogues, and how the kernel decomposes work across the GPU's memory hierarchy. That control is the point. If you're building a custom inference engine and your projection layer needs to fuse a GEMM with a SiLU activation and a residual add, cuBLAS can't fuse the epilogue for you — you'd launch the GEMM, then a separate elementwise kernel, paying twice for global memory traffic. With CUTLASS, the epilogue is a template parameter. You write the fusion once, instantiate the template, and the compiler emits a single kernel. This is why CUTLASS shows up wherever standard cuBLAS shapes don't fit — unusual data types like FP8, custom epilogues, sparse or grouped GEMMs, attention-shaped matrix products. Anywhere the stock library doesn't have what someone needs and the performance ceiling matters, you tend to find a CUTLASS kernel. CUTLASS is not a productivity library. It is a kernel-author's library. If you're writing PyTorch model code, you'll never import cutlass directly — you'll consume kernels that were built on top of it. The audience here is people who write the ker

Introduction In my previous IAM article we learnt basics of IAM and how to create Users, Groups and attach Policies. You can refer here: https://dev.to/kadhamvj23/aws-identity-and-access-management-explained-for-beginners-cn7 After setting up secure access to our AWS account using IAM, the next question we mostly have is where do we actually run our application? The answer is Amazon EC2 - Elastic Cloud Compute. EC2 is one of the most widely used AWS services and understanding it well is essential for anyone starting their cloud journey. In this article we will cover what EC2 is, why it exists, the different types of instances, pricing models, Regions and availability Zones and finally hands-on walk through of creating your first EC2 instance. Breaking Down the Name -EC2 Let us understand what each word in the name actually means: Elastic --> In AWS you will notice many services have this prefix "Elastic". The reason is simple. Whenever AWS provides a service that can be scaled up or scaled down based on our needs, that service is called Elastic . With EC2 you can increase resources when traffic is high and decrease them when the traffic is low. So in simple terms EC2 = A virtual server on the cloud that you can resize anytime. Cloud: EC2 runs on AWS's public cloud infrastructure, meaning the servers are owned and managed by Amazon across the world. Compute: The word compute means you are asking AWS to provide you CPU, RAM and Disk - basically a virtual machine or server that can run your applications. How does EC2 actually work? When you request a Virtual server from AWS, here is what happens behind the scenes: You request a virtual machine on AWS ⬇️ request goes to a Hypervisor(a software layer sitting on top of physical servers that creates and manages VMs) ⬇️ Hypervisor creates your VM ⬇️ You get the access to your EC2 instance You never touch any physical hardware. AWS manages all of that for you. Why use EC2? Imagine your company wants to host an application. T

When regulation becomes theater and encryption becomes window dressing By Vektor Memory — 20 min read It is raining here in the Southern Hemisphere again. It has been raining for three weeks now, nonstop. I’m sitting with my chai coffee, watching out of the window, and thinking about data sovereignty. It is, genuinely, the kind of thing I think about often. The northern hemisphere is winding up for summer. Europe is getting ready for long evenings and beach holidays. I’m quietly jealous. I’ve always wanted to split the year: six months south, six months north. Endless summer. The perpetual warmth of a life lived chasing the sun. But here I am. Chai. Rain. Data. I’ve been turning over one question in particular: why is it that the moment you mention data sovereignty, people immediately reach for GDPR? It’s reflexive, especially among Europeans. Understandable. GDPR is loud, it’s enforced, it has teeth. French, German, and Dutch visitors make up a large disproportionate share of our site traffic at VEKTOR, and the interest in privacy and sovereignty from that audience is intense and genuine. Northern Europeans, by and large, take this seriously in a way that other markets don’t; they are working on ways to disassociate from the cloud around the world. And yet. How many times have we clicked “Accept All” on a cookie banner in the last week? How many times have you scrolled past a privacy policy that runs to forty-two pages? How many times have you handed over your email address, your location, your device fingerprint, your behavioral patterns not because you wanted to, but because there was no meaningful alternative? GDPR created the most sophisticated legal architecture for data rights the world has ever seen. It also created the most sophisticated ritual of consent theater the world has ever performed. That gap, between the law and the lived reality, is what this article is about. Ubiquitous data centre growth image The Reflex Problem When people think of data sovere

Microsoft added sandboxed code interpreters to Azure Logic Apps, enabling agents within integration workflows to generate and execute Python, JavaScript, C#, and PowerShell in Hyper-V isolated sessions. Architects get full control over model selection per workflow. The capability positions Logic Apps as an agent platform for integration alongside Foundry and Copilot Studio. By Steef-Jan Wiggers

Joseph Stein discusses engineering an enterprise AI-as-a-Service platform within a private cloud data center. He explains how to maximize underutilized GPU pools via multi-namespace scheduling, leverage Valkey and Lua for atomic priority queuing and backpressure management, mitigate OWASP Top 10 LLM risks via central proxy gateways, and scale batch pipelines using a custom S3-to-Kafka proxy. By Joseph Stein

Google's SynthID, designed to embed imperceptible signals into AI-generated content, is adding a new Content Detection API on Google Cloud's Gemini Enterprise Agent Platform, after gaining adoption by several industry players including Nvidia and OpenAI. By Sergio De Simone

This article explores Kafka's transition toward a cloud-native architecture, examining how tiered storage, FinOps telemetry, elastic consumer scaling, virtual clusters, and Share Groups reshape the operational and economic model of event streaming platforms. It also analyzes emerging diskless-storage proposals and their architectural trade-offs. By Viquar Khan

Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.