Cloud, Kubernetes & DevSecOps Blog

Engineering JournalNew every weekday

Deep-Dives in Cloud, Kubernetes, Security & Architecture

Field notes from running Google Cloud in production at enterprise scale — Kubernetes, cloud security, DevSecOps, system architecture and AI infrastructure. Written for engineers who ship, not for slide decks. A new article every weekday, in English and German.

Articles: 109
Topics: 8
Languages: EN · DE

Aleksei AleinikovSenior Cloud Platform & Security Engineer

Google Cloud Ambassador
5× GCP Professional
Published author

Start here

Pick your track

Eight focused engineering hubs. Each one gathers the deep-dive articles, real-world context and FAQs for a single domain — start where you want to go deepest.

Browse all topic hubs

Free toolsCloud & Kubernetes ToolsIAM checks, cost estimates and more — free, no sign-up, runs in your browser.Explore the tools

All articles109 Articles

Sort

AI Gateway (LLM Gateway) Explained: What It Does, When You Need One and What It Costs

Featured

Oct 22, 202620 minNewIntermediate

AI Gateway (LLM Gateway) Explained: What It Does, When You Need One and What It Costs

What an AI gateway (LLM gateway) is, what sits inside one, how it differs from an API gateway, when you need one and what breaks in production: streaming, fallback, budgets, caching. With an open benchmark of nginx, Kong, Portkey and LiteLLM on the same mock model, a self-hosted vs managed comparison, and what the LiteLLM 1.107.0 compromise teaches about running one.

Key takeawayAn AI gateway and an LLM gateway are the same thing: one proxy between your apps and every model provider that handles keys, limits, budgets, routing, fallback and logs. "AI gateway" is the broader name, because most also cover embeddings, images, audio and MCP tool calls.

TypeScript 7 vs TypeScript 6: What Changed, What Breaks and How to Upgrade

TypeScript 7 is the same language on a new native compiler written in Go. What changed between TypeScript 6 and 7, an own benchmark on type-fest, kysely and hono, every option that is now a hard error, the tooling that does not work yet, and a safe upgrade path through 6.0, with the 7.1 beta in view.

Data

Oct 20, 202616 minNewIntermediate

DuckDB Explained: When a Database on Your Laptop Beats SQLite, Polars and BigQuery

DuckDB is an in-process SQL database built for analytics: no server, columnar, vectorised, and able to query Parquet, CSV and S3 directly. What it is, a reproducible benchmark against SQLite, pandas and Polars on 11.2 million taxi trips, where it beats BigQuery and where it does not, plus Quack, DuckLake, MotherDuck and DuckDB 2.0.

The Outbox Pattern: Reliable Events Without Distributed Transactions

Architecture

Oct 19, 202612 minNewIntermediate

The Outbox Pattern: Reliable Events Without Distributed Transactions

Saving data and publishing an event are two writes to two systems, and no retry can make them atomic. The transactional outbox writes the event in the same database transaction and ships it afterwards. Schema, polling vs CDC with Debezium, idempotent consumers, ordering and operations.

Oct 16, 202615 minNewIntermediate

Muse Spark Open vs GLM 5.3 vs Kimi K3: Meta's Open Model Isn't the Smartest. It's the Cheapest to Run

Meta's Muse Spark Open against China's two strongest open-weight models, GLM 5.3 and Kimi K3: independent Artificial Analysis scores, Meta's own benchmark table and why its competitor numbers differ from the vendors', cost per task, the GPU memory each model needs, license fine print and safety results.

NIS2 for Cloud Teams, Part 1: Requirements Checklist for AWS, Azure and Google Cloud

Security

Oct 15, 202614 minIntermediate

NIS2 for Cloud Teams, Part 1: Requirements Checklist for AWS, Azure and Google Cloud

Part 1 of the NIS2 for Cloud Teams series. Article 21 lists ten minimum security measures and none of them mentions a cloud. This checklist maps each one to concrete controls in AWS, Azure and Google Cloud, separates what your provider covers from what you own, and gives a 30-day plan.

OpenTelemetry Explained: Traces, Metrics, Logs and the Collector

DevOps

Oct 14, 202623 minIntermediate

OpenTelemetry Explained: Traces, Metrics, Logs and the Collector

What OpenTelemetry is and is not, how traces, metrics and logs fit together, how the API, SDK, OTLP and the Collector move data, agent vs gateway deployments, zero-code instrumentation on Kubernetes, sampling, and the production mistakes that make observability expensive.

Webhooks Explained: How They Work, How to Secure Them, How to Scale Them

Architecture

Oct 13, 202622 minIntermediate

Webhooks Explained: How They Work, How to Secure Them, How to Scale Them

What a webhook is, how it compares with API polling and WebSockets, how Stripe, GitHub, Shopify and Slack sign and retry their deliveries, how to verify HMAC signatures without the classic raw-body bug, and how to receive and send webhooks reliably at scale.

Oct 12, 202620 minIntermediate

Mistral Large 4 vs Kolibri vs Beam: Three Open-Weight LLMs in Four Days — Which One to Self-Host

Mistral Large 4, Aleph Alpha Kolibri and Reflection Beam compared for self-hosting: release status, licenses, architecture, every benchmark at least two of them share (gaps filled with independent scores), the GPU memory each model needs, and what sovereignty and the EU AI Act mean for each.

Google reCAPTCHA Explained: v2 vs v3 vs Enterprise, Pricing, Scores and Every Key Type

Security

Oct 9, 202621 minIntermediate

Google reCAPTCHA Explained: v2 vs v3 vs Enterprise, Pricing, Scores and Every Key Type

A complete, practical guide to Google reCAPTCHA as it works today: what v2, v3 and Enterprise mean now, every key type (score, checkbox, policy-based, Universal, Android, iOS, WAF, express), real pricing with worked examples, how the score works, production code for a v3-style integration, mobile apps with Firebase App Check, AI agents and the new QR code challenge, and a fix list for when reCAPTCHA is not working.

Oct 8, 202616 minIntermediate

Claude Haiku 5.5 vs Sonnet 5.5 vs Opus 5.5: 20× Cheaper Than Sonnet — and a 100K-Token Price Cliff

Claude Haiku 5.5 vs Sonnet 5.5 vs Opus 5.5 compared on Anthropic's benchmarks, list price and monthly cost for three real workloads, the 100K-token price cliff that only Haiku has, what breaks when you migrate from Haiku 4.5, and how to let Opus plan while Haiku does the work.

shadcn/ui vs MUI vs Mantine: I Built the Same Screen Five Ways and Measured It

Programming

Oct 7, 202613 minIntermediate

shadcn/ui vs MUI vs Mantine: I Built the Same Screen Five Ways and Measured It

shadcn/ui vs MUI vs Mantine on a real benchmark: the same React screen built five ways, gzip bundle sizes, npm packages shipped, the code you end up owning, what changed when shadcn made Base UI its default instead of Radix, what MUI 9 and Mantine 9 changed, the traps I hit, and which library to pick.

Oct 6, 202613 minIntermediate

GPT-6.1 Sol vs Claude Opus 5.5: Half the Price, a Different Tier — and Where the Gap Disappears

GPT-6.1 Sol vs Claude Opus 5.5 compared on specs, list price and real cost per agent turn: why Sol is OpenAI's middle model and not a flagship, which benchmarks exist, why the 2× price gap shrinks to about 6% past 272K input tokens, and what EU data residency looks like on each.

Cilium vs Calico: Which Kubernetes CNI Should Run Your Production Cluster?

DevOps

Oct 5, 202620 minIntermediate

Cilium vs Calico: Which Kubernetes CNI Should Run Your Production Cluster?

Cilium 1.20 and Calico 3.33 shipped within weeks of each other, and the old "eBPF vs iptables" framing no longer describes either. A production comparison: dataplanes, network policy models, observability, encryption, Gateway API, what GKE, EKS and AKS actually run, and the migration traps nobody mentions.

Cloud

Oct 2, 202610 minIntermediate

Gemini 4 Argon on Google Cloud: What Actually Changes for Platform Teams (2026)

Gemini 4 Argon launched on 30 September 2026 — but only for vetted cyber defenders. What platform teams on Google Cloud should change now: the 1M-token output budget, Argon vs Gemini 3.8 Flash routing, agent guardrails, and the deadlines that land before Argon does.