标签：#EV

Kubernetes networking is one of the most misunderstood parts of running containerized workloads. A pod can reach another pod by IP — but why does that stop working after a deployment? A service exists and resolves in DNS — but traffic isn't arriving at the application. An Ingress resource is configured — but requests return 502. These puzzles are common and they stem from the same root: Kubernetes networking has several distinct layers, each solving a different problem, and it's easy to conflate them. This article walks through how Kubernetes networking actually works at each layer — from pod networking to services to Ingress to network policy — so the next time something breaks, you have a mental model to reason from. The fundamental promise: flat pod networking Kubernetes makes one core promise about networking: every pod can communicate directly with every other pod in the cluster without NAT. Every pod gets a real IP address from the cluster's pod CIDR range, and those IPs are routable between pods regardless of which node they're running on. This is not something Kubernetes itself implements. It's a contract that every Kubernetes-conformant CNI (Container Network Interface) plugin must fulfill. When you install Calico, Cilium, Flannel, Weave, or any other CNI, you're installing the component that actually creates this flat network. The mechanism varies — Flannel uses VXLAN overlays, Calico can use BGP for direct routing, Cilium uses eBPF — but the result is the same: pod-to-pod communication without NAT. Here's what a pod's network namespace looks like: $ kubectl exec -it my-pod -- ip addr 1: lo: ... 3: eth0@if12: ... inet 10.244.1.15/24 brd 10.244.1.255 scope global eth0 $ kubectl exec -it my-pod -- ip route default via 10.244.1.1 dev eth0 10.244.0.0/16 via 10.244.1.1 dev eth0 The pod has an IP ( 10.244.1.15 ) on a /24 subnet. The node this pod runs on has an IP from the same range — or a different /24 within the same /16. Traffic from this pod to 10.244.2.8 (

The IaC landscape split into two philosophies about a decade ago and hasn't fully resolved the argument since. On one side: declarative configuration languages designed specifically for infrastructure (Terraform HCL, CloudFormation YAML, Bicep). On the other: general-purpose programming languages brought to infrastructure (AWS CDK, Pulumi). Both approaches have won in production at major organizations. Neither is clearly superior. This comparison covers Terraform, AWS CDK, and Pulumi in depth — how they work, where they excel, where they struggle, and which makes sense for different team situations. It isn't a beginner introduction to any of these tools; if you're choosing between them for a real project, this assumes you've at least skimmed each one. The core philosophical difference Terraform's HCL is a purpose-built configuration language. It's not Turing-complete (no arbitrary loops, no recursion, limited conditionals). This is by design: HashiCorp's position is that infrastructure definitions should be readable, predictable, and safe to generate tooling around. When you read a .tf file, you can understand what it creates without executing anything. CDK and Pulumi take the opposite position: the limitations of configuration languages are a tax on productive engineers. Why invent a domain-specific language when TypeScript already exists? Real programming languages have proper abstractions, test frameworks, package managers, IDE support, and a billion engineers who already know them. Infrastructure should be no different from application code. Both positions have merit. The choice between them often comes down to who's writing the infrastructure more than which approach is technically superior. Terraform Terraform is the default choice for infrastructure-as-code in 2026. It works with every major cloud provider and hundreds of minor ones. The Terraform Registry has thousands of modules — reusable packages for common patterns like VPCs, EKS clusters, and RDS databa

This is a submission for the GitHub Finish-Up-A-Thon Challenge What I Built I built the Visual Cue Tracker, a tiny, personal sanctuary for reflection. It’s a tool designed to help us map our daily actions against our core values, specifically Empathy, Growth, and Balance. I started this project because I found myself moving so fast in my software engineering studies and internships that I often forgot why I was doing what I was doing. This tracker lets me see my week at a glance, reflect on my progress, and hold space for the things that truly matter to me. Demo Deployed site: hopebestworld.github.io github repo: https://github.com/HopeBestWorld/VisualCueTracker/tree/main demo: https://youtu.be/EqVfj289e-Q The Comeback Story When I first started this project, it was just a repo with no pushed code. In 2025, I simply set up the repo and put in a description, but never put the time or effort into bringing the idea to life. To finish it up for the challenge, I added a few things that made it feel truly alive. I built a custom, zero-key AI engine that runs entirely inside your browser. It scans your weekly reflections and gives you immediate, gentle feedback on how well your written thoughts match the values you logged. It suggests! If I’m missing the mark, it gives me specific prompts to help me get back to my goals. I added quick-export features so I can turn my weekly reflections into a clean text log, making it easy to keep a personal journal outside of the app. I set up a fully automated deployment pipeline using GitHub Actions, so my site updates instantly whenever I push my code. My Experience with GitHub Copilot GitHub Copilot felt like a supportive coding partner throughout this journey. When I was stuck on complex pathing issues for my GitHub Pages deployment, it helped me iterate through solutions quickly. It was especially great at explaining why certain parts of my code (like my custom Regex AI engine) were behaving the way they were, allowing me to stay in

Every LLM wire format claims token savings. Nobody proves whether AI models can actually comprehend the format at scale, or produce valid output in it. We ran 23 comprehension evals across 10 models and 3 providers. We ran generation evals across 11 models. Deterministic ground truth. No LLM judge. Reproducible from one command. JSON breaks at 500 records. GPT-5.5 returns empty strings. It can't even attempt an answer. Opus miscounts 500 as 356 and then spends 143 lines manually enumerating symbols to verify its own wrong answer. The format designed for "human readability" is incomprehensible to the systems actually reading it. TOON can't produce valid output. Claude Opus, the most capable model on the planet, scores 0/5 on TOON generation. GPT-5.4: 0/5. GPT-5.4-mini: 0/5. Gemini 3.1 Flash Lite: 0/5. The error is always the same: toon: cannot assign string to int . The model writes "target" in the distance column. TOON expects 0 . Every model fails the same way because the format's design forces an unnatural encoding step that models cannot perform unprompted. GCF wins both dimensions on every model tested. 100% comprehension on Claude Sonnet, Gemini 2.5 Pro, Gemini 3.1 Pro, and Gemini 3.5 Flash. 5/5 valid generation on every frontier model. Zero prior training. The format didn't exist until we built it and every model speaks it natively. Comprehension: 500 Symbols, 13 Questions, Zero Instructions A 500-symbol, 200-edge code graph. Encoded in GCF, TOON, and JSON. 13 structured extraction questions. The model gets the payload and a question. No format instructions. No system prompt. No hints. 23 runs. 22 wins. 0 losses. Model Runs GCF avg TOON avg JSON avg GCF margin Claude Opus 4.6 2 96.2% 84.6% 73.1% +11.6 vs TOON Claude Sonnet 4.6 2 100% 73.1% 53.8% +26.9 vs TOON Claude Haiku 4.5 2 96.2% 69.2% 57.7% +27.0 vs TOON GPT-5.5 5 84.1% 67.7% 45.8% +16.4 vs TOON GPT-5.4 4 76.4% 56.0% 44.1% +20.4 vs TOON GPT-5.4-mini 2 71.8% 64.1% 54.2% +7.7 vs TOON Gemini 2.5 Flash 3 80.6

Show off ClauderDay has a more fitting title. I'm open to other ideas but clicking through AI slop projects all day feels like we aren't really showing off projects any more. submitted by /u/fauxtoe [link] [留言]

This field test was against Kubernetes. The issue was Kubernetes #138728: https://github.com/kubernetes/kubernetes/pull/139545 The issue involved the watch cache path around initial events. The useful diagnostic boundary was: watch cache consistency work → read lock hold time → initial event delivery That matters because cache paths in Kubernetes are not just storage details. They sit between stored state and the clients watching that state. If too much work happens while a cache lock is held, the system may still be logically correct, but the operational path can become more expensive, more blocking, or harder to scale than it needs to be. The local repair candidate is intentionally narrow. It does not redesign the watch cache. It does not change the broader storage model. It does not rewrite WatchList behavior. The patch focuses on reducing how much work happens while the watch-cache read lock is held. For ordered stores, the repair keeps the cheap snapshot boundary during interval construction, but defers full ordered list materialization until the interval is consumed by the watcher path. In plain terms: Take the necessary cache boundary under lock. Do not do heavier list materialization there if it can be safely deferred. The local patch touched only the watch-cache interval implementation and its focused tests. Local validation passed for the relevant cacher tests, store tests, full cacher package tests, and diff hygiene. Status: draft PR opened for maintainer review Field Test #013 Project: Kubernetes Issue type: watch-cache / initial-events behavior Boundary: cache consistency work under lock vs bounded watcher consumption Result: narrow local repair candidate and focused test coverage Status: local proof prepared; no public PR or comment opened yet This field test matters because it shows Scarab operating inside a major distributed systems platform. The bug shape was not a simple crash. It was not a UI issue. It was not a configuration mismatch. It was a me

I started to look for a job after a long and cozy period and I noticed the skills you have to use at the job are not the ones required to pass technical tests and theoretical interviews. I went to a few of them with the arrogant impression that my experience will compensate, and it did not. So, I started to build a database of questions and tests, then put them in a mock interview questions , a site that anyone can use. As of now I'm focusing on database and system design questions, but many more sections to be added soon. Please let me know what do you think it's important for you and the interviews you are attending. An also please note, the site is still WIP and some of the features are only partially working, but be as harsh as you want. Any feedback is more than welcomed. submitted by /u/websilvercraft [link] [留言]

Every headless WordPress conversation starts the same way — someone draws an architecture diagram with arrows pointing from a REST API to a shiny Next.js frontend, and it looks clean. Too clean. This is a post about what happens when you close the whiteboard and open the actual codebase. The Stack Decision: GraphQL vs. REST vs. Direct MySQL This is usually the first fork in the road. For this build, the client already had a well-indexed WooCommerce site. The product catalog, slugs, and taxonomy structure were already doing heavy SEO work. So the constraint was simple: nothing about the data layer changes, only how we consume it. WPGraphQL was a real option — but it meant adding a plugin dependency to a WordPress install we were actively trying to slim down. The WP REST API was already there, no installation required, and exposed exactly what we needed: products, categories, pages, and media — all queryable by slug. The decision: WP REST API, consumed server-side via Next.js fetch in Server Components. // Fetching a product by slug — preserving the existing URL structure const res = await fetch ( ` ${ process . env . WP_API_BASE } /wp/v2/product?slug= ${ params . slug } &_embed` , { next : { revalidate : 3600 } } ); const [ product ] = await res . json (); No new dependencies on the WordPress side. The legacy install runs as a lean shell — no active theme, minimal plugins, just the REST API and the data. The Site Kit Problem: Bridging Familiar Workflows This is where most migrations quietly fail the client. The previous team lived inside WordPress admin. Google Site Kit gave them traffic stats, Search Console data, and Analytics — all surfaced in a UI they knew. Ripping that away and telling them "just use Google Analytics directly" is a workflow regression, not an upgrade. The pivot here was building a lightweight admin dashboard as part of the Next.js project — not a full replacement for Site Kit, but a mirror of the metrics they actually checked daily: Page views

Since my other site I posted today did so well I figured I'd share this one too. This site actually gave me the idea for Overwatch.earth. Yes, this one will likely become a SaaS in time due to the operating costs but as it stands now it's completely free. WorldIP.io - The complete IPv4 address space, mapped submitted by /u/tuxxin [link] [留言]

Runs on a daily GitHub Action so it stays current, thought it was neat and wanted to share in case anyone else wanted to fork it or use it https://github.com/colincode0/github-readme submitted by /u/anotherinternetlad [link] [留言]

I’ve been working on TrailVerse for a while now, and it’s slowly becoming the kind of national parks planning tool I always wished existed. The idea is simple: find parks, compare options, check useful details, and turn a trip idea into a day-by-day plan with Trailie. Still improving things, still adding more, but I’m happy with where it’s heading. If you like national parks, road trips, or just exploring new places, check it out: https://www.nationalparksexplorerusa.com/explore submitted by /u/peakpirate007 [link] [留言]

Built bag-radar.com after getting tired of wondering whether my cabin bag would actually get checked. It lets travellers view real experiences of how strict airlines and airports are with baggage size and weight checks. Still early, but I'd love to hear what people think. submitted by /u/mub2010 [link] [留言]

Code: https://github.com/anishshobithps/themandalastudio It's a fun project for timepass, feedback appreciated. submitted by /u/anish_shobith_19 [link] [留言]

I would love to hear peoples opinions on it. Thank you! submitted by /u/stupid_moron23 [link] [留言]

As a web developer, I've noticed that many beginners spend months watching tutorials but struggle when it's time to build something from scratch. That's one reason I started building WebCoDeveloper — a place where I can share practical web development knowledge, real coding examples, and solutions to problems I've faced while working on projects. My goal isn't to create another tutorial website. It's to build a resource that helps developers move from "I watched a video about it" to "I actually built it." I'm curious: What's the biggest challenge you faced while learning web development? Understanding JavaScript? React/Next.js concepts? Building projects? Finding quality learning resources? Getting your first developer job? I'd love to hear your experiences and learn what resources have helped you the most.

Every AI coding tool can write Python — Cursor, Claude Code, Windsurf. None of them can run it safely in production. That gap between "AI wrote the code" and "the code ran safely" is exactly what I'm building jhansi.io to close. This series documents the journey. One layer of the problem at a time. The execution gap When AI generates code, four things still stand between you and prod: Dependencies — Install the right packages, with versions and licenses you trust Isolation — Run it hard-sandboxed. No host access, no outbound network, no surprises Secrets — Let AI use your API keys without ever letting it see or leak them Audit — Log every execution. Prompt, code, result, timestamp. Compliance-grade. Most teams stop at step 1. Banks and fintechs can't. FCA, SOC2, and the EU AI Act require audit trails for AI actions. You can't eval() your way through an audit. jhansi.io is the missing run() for AI-generated code. Open core, cloud sandbox, built to close each part of the gap — layer by layer. The series Part 1 — Persistent sandboxes Why "ephemeral" breaks debugging, state, and compliance. The case for giving every AI a home directory. → Read Part 1 Part 2 — Dependency management (coming soon) Detecting, installing, and locking deps across Python, Node, Go, and Java. With SBOMs and policy built in. Part 3 — Isolation (coming soon) What "hard isolation" actually means. Containers, Firecracker, zero trust networking, and the metadata service attacks you haven't thought of yet. Part 4 — Secrets (coming soon) Kernel-level proxies. AI can call Stripe without the key ever entering the sandbox. Part 5 — Audit (coming soon) Who ran what, when, with which prompt. Hash-chained logs that satisfy auditors, not just engineers. Building this in public. Follow the series on Dev.to , Linkedin , and X . Code is Apache 2.0 at github.com/jhansi-io .

Hi everyone, I’m building Penform, a browser-based tool that turns handwriting into a real installable OTF font. The idea came from seeing people use AI tools to recreate handwriting for personal cards and notes. The results can be touching, but the workflow felt backwards to me. Personal handwriting should not require a black-box model, a server upload, a GPU, or a hidden training pipeline. Penform takes a more deterministic approach: Print an A4 Template or use a tablet Write characters into predefined Glyph Slots Upload a JPEG or PNG scan/photo Align four printed Alignment Markers Optionally add more filled templates for contextual alternates Review and optionally refine the extracted glyphs Preview the generated font in the browser Download an installable .otf Everything runs locally in the browser. There is no account, no upload, no OCR, and no AI. A TemplateManifest defines the page geometry, so the app knows where every Writing Box, Glyph Slot, Alignment Marker, and font metric reference is. The manifest is the source of truth instead of OCR or server-side inference. The part I’m considering open-sourcing is the browser engine behind it. It currently handles: image decoding and EXIF-normalized capture manual marker alignment homography-based perspective correction A4 warping at 150/300 DPI writing-box cropping from a Template Manifest thresholding and empty glyph detection glyph vectorization contour winding correction pixel-to-font-unit mapping OpenType font generation OTF validation before export per-glyph threshold, scale, offset, and rotation overrides I’m trying to figure out two things: Whether this engine is useful enough to open-source as a standalone package Whether the product itself is useful beyond my own use case It is not meant to replace professional font design software. The goal is narrower: preserve someone’s actual handwriting well enough that it becomes usable as editable text for cards, notes, labels, classroom materials, personal project

How Reinvoice Uses HMAC Signatures to Detect Invoice Tampering Every invoice sent through Reinvoice includes a cryptographic integrity signature. It is not a PDF stamp, a visual badge, or a checkbox. It is an HMAC-SHA256 hash generated from the invoice payload and a server-side signing secret. If signed invoice data changes after creation, Reinvoice can recompute the hash, compare it to the stored signature, and flag the invoice as potentially tampered with. Here is why we built it, how it works, and what we learned. Why Integrity Checks Matter for Invoicing Invoices are high-value documents. A single altered field could change a payment amount, tax calculation, client record, or audit trail. Most invoicing systems treat invoices as ordinary database records. That works for normal CRUD workflows, but it does not automatically prove that the invoice data being viewed today is the same data that was created and sent. Reinvoice adds an integrity layer. When an invoice is created, we sign the fields that define the invoice. Later, when someone verifies the invoice, we recompute the signature from the current data and compare it against the original stored signature. If the values do not match, the invoice is flagged. The Implementation The signature is stored in two places: on the invoice record in the database, and behind a public verification endpoint. import { createHmac , timingSafeEqual } from ' node:crypto ' ; const SIGNATURE_FIELDS = [ ' invoiceNumber ' , ' issuerName ' , ' clientName ' , ' totalAmount ' , ' currency ' , ' taxAmount ' , ' issuedAt ' , ' dueDate ' , ' lineItems ' , ' notes ' , ' subtotal ' , ' discountAmount ' , ' shippingAmount ' , ] as const ; export function generateInvoiceHash ( invoice : InvoiceData ): string { const payload = SIGNATURE_FIELDS . map (( field ) => { const value = invoice [ field as keyof InvoiceData ]; return ` ${ field } = ${ JSON . stringify ( value )} ` ; }). join ( ' | ' ); return createHmac ( ' sha256 ' , SIGNING_SECRET )

Hey DEV community! 👋 I built IMGVO — a free image tool that works entirely in your browser. What it does Convert JPG, PNG, WebP, AVIF, HEIC and more Compress images up to 90% without quality loss Crop, resize, rotate, watermark Works offline (PWA) Why I built it Most image tools upload your files to servers. I wanted something private and instant. Tech 100% vanilla JavaScript No backend, no server Works offline as PWA Privacy first No files uploaded to any server. Everything runs locally in your browser. 🆓 Free, no signup required. 👉 Try it: https://imgvo.com Would love your feedback! 🙏

Hello, I'm Shrijith Venkatramana. I'm building git-lrc, an AI code reviewer that runs on every commit. Star Us to help devs discover the project. Do give it a try and share your feedback for improving the product. Large Language Models have made it surprisingly easy to generate text. Building a reliable AI application, however, is a completely different problem. Once you move beyond a simple "send prompt, get response" demo, you quickly encounter real-world concerns: Prompt management Structured outputs Multi-step workflows Tool calling Observability Evaluation Model switching Production debugging Many teams end up creating custom frameworks around OpenAI, Anthropic, Gemini, or local models just to manage these concerns. This is where Genkit comes in. Originally developed by Google, Genkit provides a framework for building AI-powered applications with a focus on workflows, tooling, observability, evaluation, and production readiness. While most examples online focus on Node.js, Genkit now has growing support for Go, making it an interesting option for backend engineers who want AI capabilities without introducing an entirely separate application stack. In this article we'll build practical examples and explore how Genkit helps structure real-world AI systems. Why Genkit Exists Most AI applications evolve like this: Phase 1: response := callLLM ( prompt ) Everything seems simple. Phase 2: You need: Retry logic Prompt versioning JSON outputs Tool integrations Tracing Metrics Human review workflows Now your codebase starts accumulating AI-specific infrastructure. Genkit attempts to provide these building blocks from day one. Think of it as: "Spring Boot for AI workflows" rather than "an LLM SDK." Installing Genkit for Go Create a new project: mkdir genkit-demo cd genkit-demo go mod init github.com/example/genkit-demo Install Genkit: go get github.com/firebase/genkit/go/ai Depending on your provider, you'll also install provider plugins. For Gemini: go get github.com/fi