Recent content on Git Push and Run
What if a business requirement could inspect the system it is about, challenge its own ambiguities, become an executable specification, and then move through implementation, review, deployment, and acceptance testing without losing human control? This is how we built a semi-deterministic production line around probabilistic coding agents. Most discussions about AI-assisted development start too…
Most Claude Code setup guides assume a developer laptop with direct internet access. This is not that guide. I spent a session getting Claude Code to run inside a fully network-isolated corporate sandbox – no direct internet, all traffic through a controlled gateway, per-binary egress policies enforced at the proxy level. What started as “remove sudo from this installer” turned…
CVE-2024-3094 was not just a backdoor. It was a two-year infiltration campaign that exploited a structural blind spot in how open source software is actually distributed. The malicious code was never committed to git at all. In March 2024, Andres Freund, a Microsoft engineer, noticed that SSH logins on his Debian testing machine were taking about 500ms longer than expected and consuming anomalous…
In a single session, I used Claude Code to build, deploy, break, fix, security-test, and iterate on a production-grade infrastructure template that generates fully configured AWS Fargate and Lambda projects. This is not a story about AI writing boilerplate. It is about using AI as an engineering partner across 30+ iterations of real infrastructure hitting real AWS accounts. I run a platform…
A production-realistic architecture for a cloud-native algorithmic trading platform: 15,000 concurrent users, sub-second order acknowledgement, real-time market data streaming, CQRS, event sourcing, and the async-sync bridge that holds it all together. The hardest problems in financial software are not algorithmic. They are architectural. A trading platform must be correct before it is fast,…
I have been using AI coding assistants seriously for about a year — not casually, not experimentally, but as a core part of how I do my job every day. This is not a post about AI generating code. It is about how AI changes the way an experienced engineer thinks, investigates, and makes decisions. The Shift That Actually Matters # The naive version of AI-assisted development is: you describe what…
I spent a single session building a DORA-compliant Third Party Management tool from scratch, adding Microsoft Entra ID SSO, migrating the entire infrastructure from CloudFormation to Terraform, deploying to both qual and prod on ECS Fargate, and fixing a cascade of real-world deployment problems along the way. Here is an honest account of what broke and how I fixed it. I built a DORA-compliant…
WebAssembly lets CPU-heavy work run entirely inside the browser tab — no server, no uploads, no cost. This post covers what WASM actually is, and how to self-host VERT, a fully local file converter, on AWS CloudFront for effectively zero dollars. What is WebAssembly? # WebAssembly (WASM) is a binary instruction format that runs inside the browser at near-native speed. Think of it as a portable…
What if your on-call engineer never slept, had instant access to every repository and every AWS account, and could trace a production issue from DNS to database in under a minute? This post walks through every layer of the architecture — from the authentication system to the agent framework, tool registry, streaming infrastructure, and deployment. Note This article describes an AI-powered SRE…
Platform engineering teams handle a constant stream of repetitive requests. This post walks through building an AI agent that automates common platform tasks — user provisioning, key rotation, service health checks — by giving an LLM access to internal tools through a structured tool-calling interface. Platform engineering teams handle a constant stream of repetitive requests: onboarding users,…
A set of battle-tested ECS Fargate patterns I apply to every production service — covering Spot strategies, deployment circuit breakers, ARM64 migration, health checks, and Aurora Serverless v2 cost optimization. I’ve deployed and managed many containerized services on ECS Fargate. Over time, a set of patterns has emerged that I apply consistently to every new service. This post documents…
A serverless document processing pipeline on AWS that uses LLMs to extract structured data from unstructured documents — invoices, contracts, reports — at scale. No GPU clusters required. Organizations process millions of documents every year: reports, contracts, invoices, correspondence. Traditionally, human operators read each document, classify it, extract the relevant fields, and enter the…
Bubbletea brings the Elm architecture to the terminal, making it possible to build rich, interactive CLI tools in Go with clean state management. This post covers the fundamentals with a practical example. If you’ve ever wanted to build a terminal application that feels more like a proper UI than a wall of text, the charmbracelet ecosystem is the way to go. I’ve been using it to build…
Managing Terraform across multiple AWS accounts and environments without duplicating code. This post covers the workspace pattern, remote state, cross-account role assumptions, and the module structure that scales from 3 accounts to 30. When you’re managing infrastructure across dozens of AWS accounts, you need patterns that scale. In this post I’ll share the approach I use to manage…
Chess engines are fascinating pieces of software that combine various computer science concepts: position evaluation, tree search, move generation, and optimization techniques. This guide will walk you through implementing a chess engine, with a particular focus on position… Chess engines are fascinating pieces of software that combine various computer science concepts: position evaluation,…
JWTs are not sessions. They are signed, self-contained claims that cannot be revoked without additional infrastructure. Understanding that tradeoff before you reach for JWT is more important than any implementation detail. This post covers HS256 vs RS256, correct validation middleware, token revocation with Redis, and a JWKS endpoint for service-to-service verification. JWTs are widely misused.…
Graph shortest-path problems appear constantly in platform engineering: network routing, dependency resolution, service mesh path optimization, and CI pipeline scheduling all reduce to finding the minimum-cost path through a directed weighted graph. Dijkstra’s algorithm is the workhorse for these problems when edge weights are non-negative. This post covers a correct Go implementation, the…
Accidentally typing a password into the wrong field and having it sit in your clipboard is a real security risk. A clipboard monitor can detect common secret patterns and redact them automatically before you paste them somewhere they should not go. This post builds a production-quality clipboard watcher in Go: regex-based secret detection, thread-safe polling with context cancellation, desktop…
Multi-account log centralization is table stakes for any platform team. If your Lambda functions live in one AWS account and your observability tooling in another, you need a production-grade pipeline that ships logs across account boundaries without compromising security. Here is the complete Terraform setup. Every mature AWS organization eventually separates workloads from shared services into…
SRP in Go is about package boundaries and exported surfaces, not just splitting methods into files. When a package has one reason to change, you can test it in isolation, swap implementations behind an interface, and reason about its behavior without reading the rest of the codebase. The Single Responsibility Principle (SRP) is often stated as “a class should have one reason to…
Cron triggers in GitHub Actions are powerful for automation that should not need a human to fire it: nightly vulnerability audits, weekly cost checks, certificate expiry alerts. This is the practical guide – real workflows, real use cases, and the traps to avoid. Most GitHub Actions tutorials cover push and pull request triggers. The schedule trigger gets less attention, but it is often…
Branch management is one of the most common sources of confusion and mistakes in team workflows. Branches pile up, remote tracking refs go stale, and people either delete the wrong thing or never clean up at all. This is the reference you’ll want to bookmark. After a few months on a shared repository, the branch list starts to look like an archaeological dig. There are feature branches from…
Git has four main verbs for undoing things: restore, reset, revert, and reflog. Picking the wrong one either rewrites history that others have already pulled, or throws away work you wanted to keep. Here is the mental model for choosing correctly. The “how do I undo this?” question comes up constantly, and the answer depends on one critical variable: has anyone else already pulled the…
Go approaches design patterns differently from Java or C++. Because Go uses composition instead of inheritance, and because functions are first-class values, many patterns that require elaborate class hierarchies in OOP languages collapse into a few idiomatic Go constructs. This post shows the correct, production-ready implementations and, just as importantly, tells you when not to reach for a…
NATS is a single binary, sub-millisecond messaging system built for cloud-native workloads. It is not Kafka, and it is not Redis Streams. Knowing when to choose it and what it cannot do is as important as knowing how to use it. This post covers core NATS pub/sub, queue groups, request/reply, JetStream persistence, pull consumers, and authentication. Kafka, NATS, Redis Streams, and RabbitMQ all…
Sudoku solving is a classic constraint satisfaction problem (CSP). The same algorithmic techniques – backtracking with constraint propagation – appear in production systems for job scheduling, resource allocation, and configuration validation. Understanding how to implement and optimize a Sudoku solver gives you a concrete mental model for tackling these problems at scale. Problem…
TCP is a stream protocol, not a message protocol. If you read bytes into a fixed buffer, you will silently truncate messages larger than that buffer. You need framing. This post covers length-prefixed framing, a multi-client broadcast server, and WebSocket support for browser clients. The first thing most tutorials about sockets in Go get wrong is the buffer. Reading into make([]byte, 1024) is not…
A tracking pixel is a 1x1 transparent image embedded in an HTML email. When an email client renders the image, it fires an HTTP GET request to your server – logging the open event. Used correctly, tracking pixels power read receipts, delivery confirmation, and engagement analytics for transactional and marketing emails. Used carelessly, they violate GDPR and produce misleading metrics. This…
Stockfish is the world’s strongest chess engine. Communicating with it from Go via the UCI protocol takes about 30 lines. This post shows the real implementation: process spawning, the UCI handshake, FEN input, evaluation parsing, and a complete reusable Engine struct. The original version of this post called non-existent methods like chess.NewEngine("stockfish") , SetDifficulty , and…
Memoization is the optimization technique of caching the return value of a pure function so that repeated calls with the same inputs skip the computation entirely. It applies whenever a function is expensive, deterministic, and called multiple times with the same arguments. Done correctly in Go it requires a mutex, and in modern code a generic wrapper makes it reusable across types. Memoization is…
Alpaca provides commission-free, API-first trading with a paper trading environment for safe strategy testing. This post covers the actual Go SDK patterns, correct order placement, real-time data retrieval, a simple momentum strategy, and the risk management you need before going live. The original version of this post called functions like alpaca.PlaceOrder , alpaca.GetQuote , and…
Elasticsearch is not just a database with a search box. It is a distributed relevance engine built on inverted indexes, and understanding that distinction changes how you design schemas, queries, and aggregations. I have run Elasticsearch in production for log analytics, product search, and document retrieval pipelines. The same mistakes appear every time a team treats it like a relational…
Go’s testing philosophy is stdlib-first and table-driven. You rarely need an external framework. The testing package, combined with interfaces for dependency injection and httptest for HTTP, covers almost everything you will encounter in production codebases. A lot of Go developers coming from Python or Java reach for testify or gomock before they need to. Go’s standard library is…
git fetch is always safe. git pull is fetch plus merge (or rebase), and that second step is where things go wrong. Understanding the difference changes how you collaborate on shared branches. Most developers learn git pull first and use it reflexively. It works fine in isolation, but on a team with an active shared branch it quietly adds merge commits to your history, can fail mid-operation if…
Proper video streaming in HTTP is not about piping bytes. It is about range requests that let players seek, HLS segments that allow adaptive bitrate, and keeping FFmpeg as a subprocess while Go handles HTTP. Get these three things right and you have a working video server. http.ServeFile actually does handle range requests correctly for static files. The problem comes when you try to build…
FastAPI is excellent for rapid API development. Protobuf is excellent for compact, typed binary payloads. You can combine them without any magic Pydantic integration – just read raw bytes, parse with the generated class, and return bytes with the right Content-Type. If you search for “FastAPI protobuf” you will find many posts that try to use Pydantic models as a bridge to…
The context package exists for one primary reason: goroutine lifecycle management. It gives you a standard, composable way to propagate cancellation signals, deadlines, and request-scoped metadata across API boundaries. Understanding how it works in production is the difference between a service that drains cleanly and one that leaks goroutines under load. Every non-trivial Go service uses context…
Async/await is not magic. It is cooperative multitasking for I/O-bound work, built on a single-threaded event loop. Getting it wrong does not crash your program; it silently makes it slower and harder to debug. This post covers what the event loop actually does, how to use asyncio correctly, the FastAPI async model, and the mistakes that cost teams weeks. Python’s async / await syntax landed…
Rust is an unusual choice for a Telegram bot, but the trade-offs are real: a single statically linked binary, sub-10MB Docker images, and memory usage that stays flat under load. Teloxide is the community-standard Rust Telegram library and it makes the async plumbing invisible. Most Telegram bot tutorials reach for Python or Node. Rust is genuinely worth considering if you care about deployment…
FastAPI combines Python type hints with automatic OpenAPI documentation and near-Go performance. It has become the default choice for Python APIs. This post covers the patterns that matter in production: Pydantic models, dependency injection, background tasks, and multi-worker deployment. FastAPI is not a thin wrapper around Starlette. The combination of Pydantic v2 for validation, Depends() for…
A generator is a lazy sequence. It produces values one at a time on demand instead of materializing everything into memory at once. For large datasets, streaming APIs, and data processing pipelines, generators are the correct default, not an optimization applied after the fact. Python generators are one of the most practically useful features in the language, and one of the most underused by…
Protocol Buffers give you binary serialization that is roughly 40% smaller and 6x faster than JSON. That trade-off is worth it for internal microservice traffic. It is not worth it for a public REST API that humans need to read with curl. Protocol Buffers (protobuf) are Google’s binary serialization format. The pitch is simple: define your data schema once in a .proto file, generate typed…
Cobra is the de-facto standard for serious Go CLIs. kubectl, the GitHub CLI, and Docker all use it. If you are building a command-line tool with multiple subcommands, typed flags, and shell completion, this is how you do it properly. Raw os.Args parsing works for a single command with one positional argument. The moment you add a second subcommand or a --dry-run flag, you are reinventing the…
Static sites are the most cost-efficient way to host content. No servers to maintain, no runtime costs, no scaling surprises. With Hugo and GitHub Actions you get a fast, version-controlled blog deployed automatically on every push, for effectively zero cost. Why Hugo Over Gatsby or Next.js # Gatsby had a good run, but the ecosystem has shifted. The project was acquired, maintenance slowed, and…
Redis is not just a cache. It is a data structure server that speaks TCP, persists to disk, replicates across nodes, and handles pub/sub fan-out in a single binary. This post covers how to use it properly from Go with go-redis/v9: connection pools, TTL management, the cache-aside pattern, sorted sets for rate limiting, pub/sub, and pipelines. Most teams reach for Redis when they need a fast…
Fyne is Go’s best cross-platform UI toolkit. One codebase compiles to Windows, macOS, and Linux, shipping as a native binary with no runtime dependency. This post builds a real stock market dashboard, covering Fyne’s widget system, layout engine, goroutine safety rules, and distribution. Why Fyne # Go desktop applications have historically been awkward. CGo-based bindings to GTK or Qt…
JSONB is not a replacement for normalized schemas. It is a tool for genuinely semi-structured data where the shape varies per row and you need to query inside it. Use it precisely, and it saves you from premature schema commits. Use it everywhere, and you have reinvented a document store on top of a relational database. PostgreSQL’s JSONB type is one of the most powerful and most misused…
Go’s net/http standard library is production-ready. With Go 1.22+ enhanced routing, method and path pattern matching are built in. You do not need a framework for most services – but you do need to configure timeouts, graceful shutdown, and middleware correctly from the start. Most Go HTTP tutorials show http.ListenAndServe(":8080", nil) and call it a day. That code will run, but it…
Go interfaces are implicit. You do not declare that a type implements an interface. If a type has the right methods, it satisfies the interface. This single design decision makes Go interfaces more flexible, more composable, and more powerful for testing than explicit interface implementations in Java or C#. Interfaces are the mechanism Go uses to express polymorphism, to decouple consumers from…
The factory pattern in Go is primarily about interface-based construction that enables dependency inversion and testing. The toy animal example is fine for learning the syntax. This post shows the version that matters in production: storage backends, notification senders, and testable services. The original version of this post had two paragraphs and a Dog.Speak() example. That covers the syntax…