GET IN TOUCH:
LATEST FROM MY BLOG
Engineering deep-dives from running Google Cloud in production at enterprise scale — Kubernetes, cloud security, DevSecOps, system architecture and AI infrastructure. By Aleksei Aleinikov · Google Cloud Ambassador · 5× certified · published author (Orange Education). English and German, for the DACH region.
Eight focused engineering hubs. Each one gathers the deep-dive articles, real-world context and FAQs for a single domain — start where you want to go deepest.
FeaturedThe Fable and Mythos line has the cheapest cache reads and the most expensive cache writes in the active lineup. That single asymmetry inverts which model is cheaper for long-context agents, and makes your cache hit rate worth four times more than it is anywhere else.
Count only the proctored exams you pay to sit, and the AI certification market sorts into four bands that share nothing but a name. One costs fifty dollars and tests no products. One costs five hundred and tests cabling. One you cannot buy at all.
BigQuery Graph reached GA on 1 September 2026. Before you model anything as a graph, here is the honest test for whether you need one — plus the line in the pricing page that decides whether you can even run GQL.
Picking an embedding model is not an API call, it is a schema decision. A practical 2026 guide to dimensions as a storage bill, whether you need a GPU, what the API actually costs, and the migration nobody prices in.
Prompt injection cannot be filtered away. A practical 2026 guide to the lethal trifecta — private data, untrusted content, external communication — how to run it as an audit on your own agents, and which leg is realistic to cut.
Most teams adding semantic search do not need a separate vector database. A practical 2026 guide to what pgvector actually does, the four mechanisms that make it run out, and what you are really buying when you pay for a dedicated engine.
All three clouds call their Kubernetes managed, and all three draw the line somewhere different. What the provider actually operates, what quietly stays yours, and the two costs nobody puts on the comparison page.
HPA, VPA and the node autoscaler all read resource requests, none of them coordinate, and every one of them fails silently when requests are wrong. The mechanics that decide whether your cluster scales or just thrashes.
A landing zone is not a list of services — it is the set of decisions you cannot reverse later. Azure, AWS and Google describe theirs in different words and converge on the same core, and everything else vendors bundle into the term can be added after your first workload is already running.
Three SIEMs, three completely different meters: Sentinel bills the gigabytes you ingest, Google SecOps bills packages with detection-rule limits and will not publish a price, Wazuh bills agents or nothing at all. The model you choose quietly decides what your team is willing to log — and therefore what you can investigate.
Egress is the line item that decides whether you can leave a cloud. R2 charges nothing for it and S3 charges per gigabyte — but that is only half the story. A costed comparison of both bills, the fine print that moves the total on each side, and what the EU Data Act changed.
A practical comparison of the four lightweight Kubernetes distributions that matter in 2026. Not a feature list: what each one actually removes, why k3s and k0s share the same database shim, which one isolates the control plane by default, and the Ingress NGINX end-of-life that just changed RKE2's defaults.
DORA's four key metrics quietly became five in 2024, and one of them moved out of the category everyone still puts it in. A practical guide to what changed, why recovery time is now a throughput measure, how to compute each metric from your own Git and deployment data, and the ways these numbers break the moment they become someone's performance target.
Four algorithms, one race condition, and the header everyone gets wrong. What RFC 6585 actually says about 429, and why X-RateLimit-* is not the standard you think it is.
Idempotency is not a header you add. It is a property your storage layer either has or doesn't. What RFC 9110 actually says, how Stripe's model works, and the race condition that breaks most implementations.
