Cloud, Kubernetes & DevSecOps Blog

Engineering JournalNew every weekday

Deep-Dives in Cloud, Kubernetes, Security & Architecture

Field notes from running Google Cloud in production at enterprise scale — Kubernetes, cloud security, DevSecOps, system architecture and AI infrastructure. Written for engineers who ship, not for slide decks. A new article every weekday, in English and German.

Articles: 106
Topics: 8
Languages: EN · DE

Aleksei AleinikovSenior Cloud Platform & Security Engineer

Google Cloud Ambassador
5× GCP Professional
Published author

Start here

Pick your track

Eight focused engineering hubs. Each one gathers the deep-dive articles, real-world context and FAQs for a single domain — start where you want to go deepest.

Browse all topic hubs

Free toolsCloud & Kubernetes ToolsIAM checks, cost estimates and more — free, no sign-up, runs in your browser.Explore the tools

All articles106 Articles

Sort

The Outbox Pattern: Reliable Events Without Distributed Transactions

Featured

Architecture

Oct 19, 202612 minNewIntermediate

The Outbox Pattern: Reliable Events Without Distributed Transactions

Saving data and publishing an event are two writes to two systems, and no retry can make them atomic. The transactional outbox writes the event in the same database transaction and ships it afterwards. Schema, polling vs CDC with Debezium, idempotent consumers, ordering and operations.

Key takeawaySaving data and publishing an event are two writes to two systems. A crash between them loses the event or sends one about data that was rolled back, and retries cannot fix it.

Muse Spark Open vs GLM 5.3 vs Kimi K3: Meta's Open Model Isn't the Smartest. It's the Cheapest to Run

Meta's Muse Spark Open against China's two strongest open-weight models, GLM 5.3 and Kimi K3: independent Artificial Analysis scores, Meta's own benchmark table and why its competitor numbers differ from the vendors', cost per task, the GPU memory each model needs, license fine print and safety results.

NIS2 for Cloud Teams, Part 1: Requirements Checklist for AWS, Azure and Google Cloud

Security

Oct 15, 202614 minNewIntermediate

NIS2 for Cloud Teams, Part 1: Requirements Checklist for AWS, Azure and Google Cloud

Part 1 of the NIS2 for Cloud Teams series. Article 21 lists ten minimum security measures and none of them mentions a cloud. This checklist maps each one to concrete controls in AWS, Azure and Google Cloud, separates what your provider covers from what you own, and gives a 30-day plan.

OpenTelemetry Explained: Traces, Metrics, Logs and the Collector

DevOps

Oct 14, 202623 minNewIntermediate

OpenTelemetry Explained: Traces, Metrics, Logs and the Collector

What OpenTelemetry is and is not, how traces, metrics and logs fit together, how the API, SDK, OTLP and the Collector move data, agent vs gateway deployments, zero-code instrumentation on Kubernetes, sampling, and the production mistakes that make observability expensive.

Webhooks Explained: How They Work, How to Secure Them, How to Scale Them

Architecture

Oct 13, 202622 minNewIntermediate

Webhooks Explained: How They Work, How to Secure Them, How to Scale Them

What a webhook is, how it compares with API polling and WebSockets, how Stripe, GitHub, Shopify and Slack sign and retry their deliveries, how to verify HMAC signatures without the classic raw-body bug, and how to receive and send webhooks reliably at scale.

Oct 12, 202620 minNewIntermediate

Mistral Large 4 vs Kolibri vs Beam: Three Open-Weight LLMs in Four Days — Which One to Self-Host

Mistral Large 4, Aleph Alpha Kolibri and Reflection Beam compared for self-hosting: release status, licenses, architecture, every benchmark at least two of them share (gaps filled with independent scores), the GPU memory each model needs, and what sovereignty and the EU AI Act mean for each.

Google reCAPTCHA Explained: v2 vs v3 vs Enterprise, Pricing, Scores and Every Key Type

Security

Oct 9, 202621 minIntermediate

Google reCAPTCHA Explained: v2 vs v3 vs Enterprise, Pricing, Scores and Every Key Type

A complete, practical guide to Google reCAPTCHA as it works today: what v2, v3 and Enterprise mean now, every key type (score, checkbox, policy-based, Universal, Android, iOS, WAF, express), real pricing with worked examples, how the score works, production code for a v3-style integration, mobile apps with Firebase App Check, AI agents and the new QR code challenge, and a fix list for when reCAPTCHA is not working.

Oct 8, 202616 minIntermediate

Claude Haiku 5.5 vs Sonnet 5.5 vs Opus 5.5: 20× Cheaper Than Sonnet — and a 100K-Token Price Cliff

Claude Haiku 5.5 vs Sonnet 5.5 vs Opus 5.5 compared on Anthropic's benchmarks, list price and monthly cost for three real workloads, the 100K-token price cliff that only Haiku has, what breaks when you migrate from Haiku 4.5, and how to let Opus plan while Haiku does the work.

shadcn/ui vs MUI vs Mantine: I Built the Same Screen Five Ways and Measured It

Programming

Oct 7, 202613 minIntermediate

shadcn/ui vs MUI vs Mantine: I Built the Same Screen Five Ways and Measured It

shadcn/ui vs MUI vs Mantine on a real benchmark: the same React screen built five ways, gzip bundle sizes, npm packages shipped, the code you end up owning, what changed when shadcn made Base UI its default instead of Radix, what MUI 9 and Mantine 9 changed, the traps I hit, and which library to pick.

Oct 6, 202613 minIntermediate

GPT-6.1 Sol vs Claude Opus 5.5: Half the Price, a Different Tier — and Where the Gap Disappears

GPT-6.1 Sol vs Claude Opus 5.5 compared on specs, list price and real cost per agent turn: why Sol is OpenAI's middle model and not a flagship, which benchmarks exist, why the 2× price gap shrinks to about 6% past 272K input tokens, and what EU data residency looks like on each.

Cilium vs Calico: Which Kubernetes CNI Should Run Your Production Cluster?

DevOps

Oct 5, 202620 minIntermediate

Cilium vs Calico: Which Kubernetes CNI Should Run Your Production Cluster?

Cilium 1.20 and Calico 3.33 shipped within weeks of each other, and the old "eBPF vs iptables" framing no longer describes either. A production comparison: dataplanes, network policy models, observability, encryption, Gateway API, what GKE, EKS and AKS actually run, and the migration traps nobody mentions.

Cloud

Oct 2, 202610 minIntermediate

Gemini 4 Argon on Google Cloud: What Actually Changes for Platform Teams (2026)

Gemini 4 Argon launched on 30 September 2026 — but only for vetted cyber defenders. What platform teams on Google Cloud should change now: the 1M-token output budget, Argon vs Gemini 3.8 Flash routing, agent guardrails, and the deadlines that land before Argon does.

Oct 1, 202617 minIntermediate

Agent Skills Explained: SKILL.md, Claude Skills and When to Use Them Instead of MCP

Agent Skills are folders with a SKILL.md file that AI agents load on demand. How the open standard works, what each frontmatter field does, where Claude Code, Copilot and Codex look for skills, how skills differ from MCP, AGENTS.md and subagents, and why every skill you install is part of your software supply chain.

Sep 30, 202615 minIntermediate

WebMCP Explained: How Chrome Turns Your Website Into an MCP Server for AI Agents

WebMCP explained: how the new browser API lets AI agents call a website's JavaScript as MCP-style tools, how Chrome 149 implements registration, discovery and execution, how WebMCP differs from MCP servers, and what I learned shipping five WebMCP tools to production.

Sep 29, 202615 minIntermediate

Claude Sonnet 5.5 vs Opus 5.5: Half the Price, Nearly the Same Scores — and a Routing Trap

Claude Sonnet 5.5 vs Opus 5.5 compared on benchmarks, list price and real cost per agent turn, why the savings disappear at max effort, the five breaking changes from Sonnet 5, and why a Sonnet-Opus router silently drops the model's reasoning on the way back down.