Instrumenting each service produces disconnected traces. Passing the trace context between them is what makes it one trace, and it is the part that breaks. The queue hop…
A document describing what the API accepts and a validator enforcing it are two implementations of one rule, and they diverge in the direction of the code. Validating…
The command permissions get the attention and the key pattern is where the actual isolation lives, because a service with write access to every key is not isolated…
A threshold evaluated instantaneously fires on every transient spike, and transient spikes are constant — which is how a channel accumulates three hundred alerts a month. The for…
Type-hinting iterable is the right choice for anything that consumes a sequence, and it makes two promises the caller has to honour. Accepting iterable is a promise to…
Enumerating permitted commands produces a list that is wrong the moment Redis adds one, and the additions are exactly the commands nobody has considered. -@dangerous is the single…
Docker writes its own iptables rules ahead of the chain UFW manages, so a published port is reachable from the internet regardless of what the firewall says. The…