Cloud, Kubernetes & DevSecOps Blog

Engineering JournalNew every weekday

Deep-Dives in Cloud, Kubernetes, Security & Architecture

Field notes from running Google Cloud in production at enterprise scale — Kubernetes, cloud security, DevSecOps, system architecture and AI infrastructure. Written for engineers who ship, not for slide decks. A new article every weekday, in English and German.

Articles: 115
Topics: 8
Languages: EN · DE

Aleksei AleinikovSenior Cloud Platform & Security Engineer

Google Cloud Ambassador
5× GCP Professional
Published author

Start here

Pick your track

Eight focused engineering hubs. Each one gathers the deep-dive articles, real-world context and FAQs for a single domain — start where you want to go deepest.

Browse all topic hubs

Free toolsCloud & Kubernetes ToolsIAM checks, cost estimates and more — free, no sign-up, runs in your browser.Explore the tools

All articles115 Articles

Sort

Gemini 4 Carbon Review: Benchmarks, Price, Access and Who It Is Actually For

Featured

Oct 30, 202616 minNewIntermediate

Gemini 4 Carbon Review: Benchmarks, Price, Access and Who It Is Actually For

A plain review of Gemini 4 Carbon, Google's new top model: the benchmark table and who ran each test, cost per task against Claude Opus 5.5 and GPT-6 Astra, why almost nobody can use it yet, how to get access, and who should care.

Key takeawayGemini 4 Carbon is number one on the Artificial Analysis Intelligence Index v5 with 59, one point above Claude Opus 5.5 (58) and two above GPT-6 Astra (57). The overall margin is thin. The big gaps are in long context, security tasks and SaaS automation.

Ghidra MCP vs REA: How AI Agents Reverse Engineer Software, and What the Setup Changes on Your Machine

Ghidra MCP servers connect one decompiler to an AI agent. REA puts many analysis tools, Ghidra included, behind a single MCP server. How the two differ, what their setup changes on your machine, what can go wrong, and where the law draws lines.

Tailscale vs WireGuard: What the Control Plane Buys You, and What the SSH Flaws Cost

Security

Oct 28, 202620 minNewIntermediate

Tailscale vs WireGuard: What the Control Plane Buys You, and What the SSH Flaws Cost

Tailscale runs on WireGuard, so the real comparison is a bare tunnel against a tunnel plus a control plane. What that control plane adds, what it costs in speed and money, and what the October Tailscale SSH vulnerabilities actually change.

Oct 27, 202616 minNewIntermediate

GPT-6.1 Terra vs Claude Sonnet 5.5 vs GPT-6.1 Sol: Half the Price per Token Is Not Half the Bill

GPT-6.1 Terra vs Claude Sonnet 5.5 vs GPT-6.1 Sol compared on official specs, vendor benchmarks, independent Artificial Analysis results and real cost per agent turn: why Terra's half price shrinks to 44% per task, where Sonnet 5.5 still leads, what changes past 272K tokens, and which model to pick.

JWT Explained: What a JSON Web Token Is and How It Breaks

Security

Oct 26, 202613 minNewIntermediate

JWT Explained: What a JSON Web Token Is and How It Breaks

A JWT is a signed JSON object in three base64url parts: header, payload and signature. Anyone can decode it; only the key holder can sign it. How a JWT is built, how to verify one correctly, HS256 vs RS256 vs ES256, the attacks that still work (alg none, algorithm confusion, weak secrets, kid and jku injection) and how to decode a token without leaking it.

PostgreSQL Indexes: Which Type to Use (10M-Row Benchmark)

Data

Oct 23, 202614 minIntermediate

PostgreSQL Indexes: Which Type to Use (10M-Row Benchmark)

A PostgreSQL index is a separate structure that lets the database find rows without reading the whole table. Which type to use, from B-tree and hash to BRIN, GIN and partial or covering indexes, measured on 10 million rows with PostgreSQL 18.

Oct 22, 202620 minIntermediate

AI Gateway (LLM Gateway) Explained: What It Does, When You Need One and What It Costs

What an AI gateway (LLM gateway) is, what sits inside one, how it differs from an API gateway, when you need one and what breaks in production: streaming, fallback, budgets, caching. With an open benchmark of nginx, Kong, Portkey and LiteLLM on the same mock model, a self-hosted vs managed comparison, and what the LiteLLM 1.107.0 compromise teaches about running one.

TypeScript 7 vs TypeScript 6: What Changed, What Breaks and How to Upgrade

Programming

Oct 21, 202615 minIntermediate

TypeScript 7 vs TypeScript 6: What Changed, What Breaks and How to Upgrade

TypeScript 7 is the same language on a new native compiler written in Go. What changed between TypeScript 6 and 7, an own benchmark on type-fest, kysely and hono, every option that is now a hard error, the tooling that does not work yet, and a safe upgrade path through 6.0, with the 7.1 beta in view.

Data

Oct 20, 202616 minIntermediate

DuckDB Explained: When a Database on Your Laptop Beats SQLite, Polars and BigQuery

DuckDB is an in-process SQL database built for analytics: no server, columnar, vectorised, and able to query Parquet, CSV and S3 directly. What it is, a reproducible benchmark against SQLite, pandas and Polars on 11.2 million taxi trips, where it beats BigQuery and where it does not, plus Quack, DuckLake, MotherDuck and DuckDB 2.0.

The Outbox Pattern: Reliable Events Without Distributed Transactions

Architecture

Oct 19, 202612 minIntermediate

The Outbox Pattern: Reliable Events Without Distributed Transactions

Saving data and publishing an event are two writes to two systems, and no retry can make them atomic. The transactional outbox writes the event in the same database transaction and ships it afterwards. Schema, polling vs CDC with Debezium, idempotent consumers, ordering and operations.

Oct 16, 202615 minIntermediate

Muse Spark Open vs GLM 5.3 vs Kimi K3: Meta's Open Model Isn't the Smartest. It's the Cheapest to Run

Meta's Muse Spark Open against China's two strongest open-weight models, GLM 5.3 and Kimi K3: independent Artificial Analysis scores, Meta's own benchmark table and why its competitor numbers differ from the vendors', cost per task, the GPU memory each model needs, license fine print and safety results.

NIS2 for Cloud Teams, Part 1: Requirements Checklist for AWS, Azure and Google Cloud

Security

Oct 15, 202614 minIntermediate

NIS2 for Cloud Teams, Part 1: Requirements Checklist for AWS, Azure and Google Cloud

Part 1 of the NIS2 for Cloud Teams series. Article 21 lists ten minimum security measures and none of them mentions a cloud. This checklist maps each one to concrete controls in AWS, Azure and Google Cloud, separates what your provider covers from what you own, and gives a 30-day plan.

OpenTelemetry Explained: Traces, Metrics, Logs and the Collector

DevOps

Oct 14, 202623 minIntermediate

OpenTelemetry Explained: Traces, Metrics, Logs and the Collector

What OpenTelemetry is and is not, how traces, metrics and logs fit together, how the API, SDK, OTLP and the Collector move data, agent vs gateway deployments, zero-code instrumentation on Kubernetes, sampling, and the production mistakes that make observability expensive.

Webhooks Explained: How They Work, How to Secure Them, How to Scale Them

Architecture

Oct 13, 202622 minIntermediate

Webhooks Explained: How They Work, How to Secure Them, How to Scale Them

What a webhook is, how it compares with API polling and WebSockets, how Stripe, GitHub, Shopify and Slack sign and retry their deliveries, how to verify HMAC signatures without the classic raw-body bug, and how to receive and send webhooks reliably at scale.

Oct 12, 202620 minIntermediate

Mistral Large 4 vs Kolibri vs Beam: Three Open-Weight LLMs in Four Days — Which One to Self-Host

Mistral Large 4, Aleph Alpha Kolibri and Reflection Beam compared for self-hosting: release status, licenses, architecture, every benchmark at least two of them share (gaps filled with independent scores), the GPU memory each model needs, and what sovereignty and the EU AI Act mean for each.