Technical articles by Aleksei Aleinikov — Senior Cloud Platform Engineer, Cloud Security Architect, and Published Technical Author. Topics: cloud architecture, Kubernetes, DevSecOps, Go, AI/ML, security hardening.
Idempotency is not a header you add. It is a property your storage layer either has or doesn't. What RFC 9110 actually says, how Stripe's model works, and the race condition that breaks most implementations.
Keycloak is Apache 2.0 with no paid tier. authentik is open core — MIT plus a proprietary enterprise directory. That licensing difference matters more than any feature table, and SCIM coverage is not equal either.
Kubernetes now enforces policy in-process: ValidatingAdmissionPolicy went stable in 1.30, MutatingAdmissionPolicy in 1.36. So the real question is no longer OPA or Kyverno — it's what you still need a controller for.
Installing Falco takes ten minutes. Making it useful takes months. A practical guide to runtime security that survives contact with production — rule maturity, tuning out noise, and what to actually alert on.
"We encrypted everything" does not take a system out of PCI DSS scope, and tokenization does not take you out of GDPR. A practical guide to what each one actually buys you — and where teams get it wrong.
Your prompt is fine. Your agent still loses the plot. Context engineering treats the context window as a finite budget — here's what goes in it, why bigger windows don't fix it, and the three techniques that do.
A 70B model needs 140 GB of VRAM at full precision — until you quantize it. A practical guide to GGUF, K-quants, Q4 vs Q8, what quality you actually lose, and exactly how much VRAM you need.
"SQL vs NoSQL" is the wrong first question. A practical 2026 guide to database types, what relational really means, ACID vs BASE, and a decision framework to choose by your access patterns — not by hype.
An MCP server is how you give an AI agent real capabilities — safely. A practical 2026 guide: what the protocol actually is, how to build a server, what breaks in production, and the security rules you cannot skip.
Domain-Driven Design is not a folder structure or a bag of patterns. It's a way to align software with the business. A practical 2026 guide: strategic vs tactical DDD, bounded contexts, aggregates, when it's worth it, and how to start — no jargon.
Neither a monolith nor microservices is 'modern' or 'legacy'. Each trades one kind of complexity for another. An honest 2026 guide: the real trade-offs, where each wins, the anti-patterns, and a decision framework — no dogma.
A backup is a copy of your data. Disaster recovery is getting the whole service running again — infra, network, DNS and all. Confusing the two is a multi-hour outage waiting to happen. RTO vs RPO, the four DR strategies, and why an untested plan is the real failure.
An SBOM is an inventory, not a defense. Generating one would not have stopped Log4Shell. What would: continuous CVE correlation, signed provenance, and VEX to kill the noise. A practical supply-chain security guide for 2026.
The CAP theorem is not 'pick two of three.' Partitions aren't optional, so the real choice is consistency vs availability during a network split — plus PACELC for the 99% of the time nothing is broken. A practical guide to choosing a database.
Over 100,000 tech workers were laid off last year, yet AI mostly deleted the shallow half of the job — not the job. The developer who only wires CRUD is exposed; the one who owns the system isn't. The durable 2026 skill is orchestrating AI, not competing with it.