Cloud, Kubernetes & DevSecOps Blog

Engineering JournalNew every weekday

Deep-Dives in Cloud, Kubernetes, Security & Architecture

Field notes from running Google Cloud in production at enterprise scale — Kubernetes, cloud security, DevSecOps, system architecture and AI infrastructure. Written for engineers who ship, not for slide decks. A new article every weekday, in English and German.

Articles: 111
Topics: 8
Languages: EN · DE

Aleksei AleinikovSenior Cloud Platform & Security Engineer

Google Cloud Ambassador
5× GCP Professional
Published author

Start here

Pick your track

Eight focused engineering hubs. Each one gathers the deep-dive articles, real-world context and FAQs for a single domain — start where you want to go deepest.

Browse all topic hubs

Free toolsCloud & Kubernetes ToolsIAM checks, cost estimates and more — free, no sign-up, runs in your browser.Explore the tools

All articles111 Articles

Sort

JWT Explained: What a JSON Web Token Is and How It Breaks

Featured

Security

Oct 26, 202613 minNewIntermediate

JWT Explained: What a JSON Web Token Is and How It Breaks

A JWT is a signed JSON object in three base64url parts: header, payload and signature. Anyone can decode it; only the key holder can sign it. How a JWT is built, how to verify one correctly, HS256 vs RS256 vs ES256, the attacks that still work (alg none, algorithm confusion, weak secrets, kid and jku injection) and how to decode a token without leaking it.

Key takeawayA JWT is three base64url parts joined by dots: a header, a JSON payload of claims and a signature over both. Base64url is an encoding, not encryption, so anyone holding the token can read every claim.

PostgreSQL Indexes: Which Type to Use (10M-Row Benchmark)

A PostgreSQL index is a separate structure that lets the database find rows without reading the whole table. Which type to use, from B-tree and hash to BRIN, GIN and partial or covering indexes, measured on 10 million rows with PostgreSQL 18.

Oct 22, 202620 minNewIntermediate

AI Gateway (LLM Gateway) Explained: What It Does, When You Need One and What It Costs

What an AI gateway (LLM gateway) is, what sits inside one, how it differs from an API gateway, when you need one and what breaks in production: streaming, fallback, budgets, caching. With an open benchmark of nginx, Kong, Portkey and LiteLLM on the same mock model, a self-hosted vs managed comparison, and what the LiteLLM 1.107.0 compromise teaches about running one.

TypeScript 7 vs TypeScript 6: What Changed, What Breaks and How to Upgrade

Programming

Oct 21, 202615 minNewIntermediate

TypeScript 7 vs TypeScript 6: What Changed, What Breaks and How to Upgrade

TypeScript 7 is the same language on a new native compiler written in Go. What changed between TypeScript 6 and 7, an own benchmark on type-fest, kysely and hono, every option that is now a hard error, the tooling that does not work yet, and a safe upgrade path through 6.0, with the 7.1 beta in view.

Data

Oct 20, 202616 minNewIntermediate

DuckDB Explained: When a Database on Your Laptop Beats SQLite, Polars and BigQuery

DuckDB is an in-process SQL database built for analytics: no server, columnar, vectorised, and able to query Parquet, CSV and S3 directly. What it is, a reproducible benchmark against SQLite, pandas and Polars on 11.2 million taxi trips, where it beats BigQuery and where it does not, plus Quack, DuckLake, MotherDuck and DuckDB 2.0.

The Outbox Pattern: Reliable Events Without Distributed Transactions

Architecture

Oct 19, 202612 minIntermediate

The Outbox Pattern: Reliable Events Without Distributed Transactions

Saving data and publishing an event are two writes to two systems, and no retry can make them atomic. The transactional outbox writes the event in the same database transaction and ships it afterwards. Schema, polling vs CDC with Debezium, idempotent consumers, ordering and operations.

Oct 16, 202615 minIntermediate

Muse Spark Open vs GLM 5.3 vs Kimi K3: Meta's Open Model Isn't the Smartest. It's the Cheapest to Run

Meta's Muse Spark Open against China's two strongest open-weight models, GLM 5.3 and Kimi K3: independent Artificial Analysis scores, Meta's own benchmark table and why its competitor numbers differ from the vendors', cost per task, the GPU memory each model needs, license fine print and safety results.

NIS2 for Cloud Teams, Part 1: Requirements Checklist for AWS, Azure and Google Cloud

Security

Oct 15, 202614 minIntermediate

NIS2 for Cloud Teams, Part 1: Requirements Checklist for AWS, Azure and Google Cloud

Part 1 of the NIS2 for Cloud Teams series. Article 21 lists ten minimum security measures and none of them mentions a cloud. This checklist maps each one to concrete controls in AWS, Azure and Google Cloud, separates what your provider covers from what you own, and gives a 30-day plan.

OpenTelemetry Explained: Traces, Metrics, Logs and the Collector

DevOps

Oct 14, 202623 minIntermediate

OpenTelemetry Explained: Traces, Metrics, Logs and the Collector

What OpenTelemetry is and is not, how traces, metrics and logs fit together, how the API, SDK, OTLP and the Collector move data, agent vs gateway deployments, zero-code instrumentation on Kubernetes, sampling, and the production mistakes that make observability expensive.

Webhooks Explained: How They Work, How to Secure Them, How to Scale Them

Architecture

Oct 13, 202622 minIntermediate

Webhooks Explained: How They Work, How to Secure Them, How to Scale Them

What a webhook is, how it compares with API polling and WebSockets, how Stripe, GitHub, Shopify and Slack sign and retry their deliveries, how to verify HMAC signatures without the classic raw-body bug, and how to receive and send webhooks reliably at scale.

Oct 12, 202620 minIntermediate

Mistral Large 4 vs Kolibri vs Beam: Three Open-Weight LLMs in Four Days — Which One to Self-Host

Mistral Large 4, Aleph Alpha Kolibri and Reflection Beam compared for self-hosting: release status, licenses, architecture, every benchmark at least two of them share (gaps filled with independent scores), the GPU memory each model needs, and what sovereignty and the EU AI Act mean for each.

Google reCAPTCHA Explained: v2 vs v3 vs Enterprise, Pricing, Scores and Every Key Type

Security

Oct 9, 202621 minIntermediate

Google reCAPTCHA Explained: v2 vs v3 vs Enterprise, Pricing, Scores and Every Key Type

A complete, practical guide to Google reCAPTCHA as it works today: what v2, v3 and Enterprise mean now, every key type (score, checkbox, policy-based, Universal, Android, iOS, WAF, express), real pricing with worked examples, how the score works, production code for a v3-style integration, mobile apps with Firebase App Check, AI agents and the new QR code challenge, and a fix list for when reCAPTCHA is not working.

Oct 8, 202616 minIntermediate

Claude Haiku 5.5 vs Sonnet 5.5 vs Opus 5.5: 20× Cheaper Than Sonnet — and a 100K-Token Price Cliff

Claude Haiku 5.5 vs Sonnet 5.5 vs Opus 5.5 compared on Anthropic's benchmarks, list price and monthly cost for three real workloads, the 100K-token price cliff that only Haiku has, what breaks when you migrate from Haiku 4.5, and how to let Opus plan while Haiku does the work.

shadcn/ui vs MUI vs Mantine: I Built the Same Screen Five Ways and Measured It

Programming

Oct 7, 202613 minIntermediate

shadcn/ui vs MUI vs Mantine: I Built the Same Screen Five Ways and Measured It

shadcn/ui vs MUI vs Mantine on a real benchmark: the same React screen built five ways, gzip bundle sizes, npm packages shipped, the code you end up owning, what changed when shadcn made Base UI its default instead of Radix, what MUI 9 and Mantine 9 changed, the traps I hit, and which library to pick.

Oct 6, 202613 minIntermediate

GPT-6.1 Sol vs Claude Opus 5.5: Half the Price, a Different Tier — and Where the Gap Disappears

GPT-6.1 Sol vs Claude Opus 5.5 compared on specs, list price and real cost per agent turn: why Sol is OpenAI's middle model and not a flagship, which benchmarks exist, why the 2× price gap shrinks to about 6% past 272K input tokens, and what EU data residency looks like on each.