Cloud, Kubernetes & DevSecOps Blog

Engineering JournalNew every weekday

Deep-Dives in Cloud, Kubernetes, Security & Architecture

Field notes from running Google Cloud in production at enterprise scale — Kubernetes, cloud security, DevSecOps, system architecture and AI infrastructure. Written for engineers who ship, not for slide decks. A new article every weekday, in English and German.

Articles: 104
Topics: 8
Languages: EN · DE

Aleksei AleinikovSenior Cloud Platform & Security Engineer

Google Cloud Ambassador
5× GCP Professional
Published author

Start here

Pick your track

Eight focused engineering hubs. Each one gathers the deep-dive articles, real-world context and FAQs for a single domain — start where you want to go deepest.

Browse all topic hubs

Free toolsCloud & Kubernetes ToolsIAM checks, cost estimates and more — free, no sign-up, runs in your browser.Explore the tools

All articles104 Articles

Sort

NIS2 for Cloud Teams, Part 1: Requirements Checklist for AWS, Azure and Google Cloud

Featured

Security

Oct 15, 202614 minNewIntermediate

NIS2 for Cloud Teams, Part 1: Requirements Checklist for AWS, Azure and Google Cloud

Part 1 of the NIS2 for Cloud Teams series. Article 21 lists ten minimum security measures and none of them mentions a cloud. This checklist maps each one to concrete controls in AWS, Azure and Google Cloud, separates what your provider covers from what you own, and gives a 30-day plan.

Key takeawayNo cloud provider can be NIS2 compliant on your behalf: the obligations land on your entity, and their certificates only become evidence for your supply-chain measure.

OpenTelemetry Explained: Traces, Metrics, Logs and the Collector

What OpenTelemetry is and is not, how traces, metrics and logs fit together, how the API, SDK, OTLP and the Collector move data, agent vs gateway deployments, zero-code instrumentation on Kubernetes, sampling, and the production mistakes that make observability expensive.

Webhooks Explained: How They Work, How to Secure Them, How to Scale Them

Architecture

Oct 13, 202622 minNewIntermediate

Webhooks Explained: How They Work, How to Secure Them, How to Scale Them

What a webhook is, how it compares with API polling and WebSockets, how Stripe, GitHub, Shopify and Slack sign and retry their deliveries, how to verify HMAC signatures without the classic raw-body bug, and how to receive and send webhooks reliably at scale.

Oct 12, 202620 minNewIntermediate

Mistral Large 4 vs Kolibri vs Beam: Three Open-Weight LLMs in Four Days — Which One to Self-Host

Mistral Large 4, Aleph Alpha Kolibri and Reflection Beam compared for self-hosting: release status, licenses, architecture, every benchmark at least two of them share (gaps filled with independent scores), the GPU memory each model needs, and what sovereignty and the EU AI Act mean for each.

Google reCAPTCHA Explained: v2 vs v3 vs Enterprise, Pricing, Scores and Every Key Type

Security

Oct 9, 202621 minNewIntermediate

Google reCAPTCHA Explained: v2 vs v3 vs Enterprise, Pricing, Scores and Every Key Type

A complete, practical guide to Google reCAPTCHA as it works today: what v2, v3 and Enterprise mean now, every key type (score, checkbox, policy-based, Universal, Android, iOS, WAF, express), real pricing with worked examples, how the score works, production code for a v3-style integration, mobile apps with Firebase App Check, AI agents and the new QR code challenge, and a fix list for when reCAPTCHA is not working.

Oct 8, 202616 minIntermediate

Claude Haiku 5.5 vs Sonnet 5.5 vs Opus 5.5: 20× Cheaper Than Sonnet — and a 100K-Token Price Cliff

Claude Haiku 5.5 vs Sonnet 5.5 vs Opus 5.5 compared on Anthropic's benchmarks, list price and monthly cost for three real workloads, the 100K-token price cliff that only Haiku has, what breaks when you migrate from Haiku 4.5, and how to let Opus plan while Haiku does the work.

shadcn/ui vs MUI vs Mantine: I Built the Same Screen Five Ways and Measured It

Programming

Oct 7, 202613 minIntermediate

shadcn/ui vs MUI vs Mantine: I Built the Same Screen Five Ways and Measured It

shadcn/ui vs MUI vs Mantine on a real benchmark: the same React screen built five ways, gzip bundle sizes, npm packages shipped, the code you end up owning, what changed when shadcn made Base UI its default instead of Radix, what MUI 9 and Mantine 9 changed, the traps I hit, and which library to pick.

Oct 6, 202613 minIntermediate

GPT-6.1 Sol vs Claude Opus 5.5: Half the Price, a Different Tier — and Where the Gap Disappears

GPT-6.1 Sol vs Claude Opus 5.5 compared on specs, list price and real cost per agent turn: why Sol is OpenAI's middle model and not a flagship, which benchmarks exist, why the 2× price gap shrinks to about 6% past 272K input tokens, and what EU data residency looks like on each.

Cilium vs Calico: Which Kubernetes CNI Should Run Your Production Cluster?

DevOps

Oct 5, 202620 minIntermediate

Cilium vs Calico: Which Kubernetes CNI Should Run Your Production Cluster?

Cilium 1.20 and Calico 3.33 shipped within weeks of each other, and the old "eBPF vs iptables" framing no longer describes either. A production comparison: dataplanes, network policy models, observability, encryption, Gateway API, what GKE, EKS and AKS actually run, and the migration traps nobody mentions.

Cloud

Oct 2, 202610 minIntermediate

Gemini 4 Argon on Google Cloud: What Actually Changes for Platform Teams (2026)

Gemini 4 Argon launched on 30 September 2026 — but only for vetted cyber defenders. What platform teams on Google Cloud should change now: the 1M-token output budget, Argon vs Gemini 3.8 Flash routing, agent guardrails, and the deadlines that land before Argon does.

Oct 1, 202617 minIntermediate

Agent Skills Explained: SKILL.md, Claude Skills and When to Use Them Instead of MCP

Agent Skills are folders with a SKILL.md file that AI agents load on demand. How the open standard works, what each frontmatter field does, where Claude Code, Copilot and Codex look for skills, how skills differ from MCP, AGENTS.md and subagents, and why every skill you install is part of your software supply chain.

Sep 30, 202615 minIntermediate

WebMCP Explained: How Chrome Turns Your Website Into an MCP Server for AI Agents

WebMCP explained: how the new browser API lets AI agents call a website's JavaScript as MCP-style tools, how Chrome 149 implements registration, discovery and execution, how WebMCP differs from MCP servers, and what I learned shipping five WebMCP tools to production.

Sep 29, 202615 minIntermediate

Claude Sonnet 5.5 vs Opus 5.5: Half the Price, Nearly the Same Scores — and a Routing Trap

Claude Sonnet 5.5 vs Opus 5.5 compared on benchmarks, list price and real cost per agent turn, why the savings disappear at max effort, the five breaking changes from Sonnet 5, and why a Sonnet-Opus router silently drops the model's reasoning on the way back down.

Sep 28, 202614 minIntermediate

Claude Code Modes Compared: Why Plan Mode Died and What Replaced It

All six Claude Code permission modes compared — Manual, acceptEdits, plan, auto, dontAsk and bypassPermissions — what each one lets the agent do, why auto mode replaced plan mode as the default, what the auto-mode classifier blocks and allows, and a settings.json that holds up.

Rogue AI Agents Hacked a Government Site — Nobody Told Them To

Security

Sep 25, 202610 minIntermediate

Rogue AI Agents Hacked a Government Site — Nobody Told Them To

On 23 September 2026, an independent AI-safety lab published forensic evidence that autonomous AI agents hacked into three public data services, including an Australian government site, while doing nothing more than trying to answer an ordinary question. Hours later, OpenAI and Australia's Prime Minister both confirmed it. Here is what the data actually shows, and what it means for anyone running a public API.