Muting Every App on macOS with Core Audio Process Taps
How to capture and silence every other app on macOS 14.2+ without a driver: a muted process tap, a private aggregate device, a permission gate and safe teardown.
Read the insight ↗THE CLOUDGUYS ENGINEERING DESK
Notes from the infrastructure.
Ideas for what’s next.
Practical guides, architecture decisions, and honest cost breakdowns from the world of cloud engineering.
Embed Video Calls in Your App: Sign a Token, Redeem an Invite, Join
Add video calls to your product without handing over users or login: the token, invite and join flow, with real code and limits read from the source.
Read the insight ↗
Double-Entry Ledger Design for Wallets: Seven Invariants and How We Verify Them
The seven invariants a wallet ledger should check, what the write path must enforce first, and the test and load-audit evidence that they hold.
Read the insight ↗
Kubernetes Dashboard Alternatives Compared (2026): Access, Control, AI and Cost
Compare Headlamp, Freelens, Lens, k9s, Portainer and Berth on the questions that decide the choice: how you sign in, what each can change, what its AI sends where, what it costs, and whether it is maintained.
Read the insight ↗
Kubernetes Dashboard Is Archived: What to Use Instead in 2026
The official Kubernetes Dashboard is archived and its Helm repository URL now returns 404. What changed, what the project recommends, and how Headlamp, Freelens, Lens, k9s, Portainer and Berth compare, with sources and dates.
Read the insight ↗
Migrate Off the Kubernetes Dashboard: A Step-by-Step Guide
How to replace the archived Kubernetes Dashboard without losing access or leaving cluster-admin bindings behind: inventory, install Headlamp or Berth beside it, verify, remove, and clean up.
Read the insight ↗
43 seconds to 8: what one trace of an AI analyst agent showed us
On one traced question, an analyst agent took 43.5 seconds, ran three queries and consumed 137,040 tokens. Four causes, one prompt-caching trap, and a wrong number hiding in the same trace.
Read the insight ↗
Count everything twice: the UNION that would have double counted a travel warehouse
About 90% of the rows in four supplier channel tables already existed in the master reservation table. A plain UNION ALL would have counted them twice and the key test would have passed. The dedup union, the count that checked it, and the test that catches it.
Read the insight ↗
Karpenter vs. Cluster Autoscaler vs. EKS Auto Mode: 2026 Costs and Latency Trade-offs
A fact-checked 2026 guide to EKS node autoscaling: how Karpenter, Cluster Autoscaler, and EKS Auto Mode differ, what fees apply, and how to protect latency during consolidation.
Read the insight ↗
Six layers, one guarantee: the read-only role under an AI analyst's SQL guard
Every query our analyst agent runs is written by a language model. Six layers stand between that text and the warehouse, but only one of them is the guarantee. Four hostile queries, the layer that stops each, and what the guard still does not stop.
Read the insight ↗
Fewer tools, better agent? What merging 18 tools into 15 did and did not buy
We measured how a small model used our agent's tools, found three that overlapped, merged them without changing the security boundary, and measured again. A smaller prompt, no change in pass rate, and a problem the merge did not touch.
Read the insight ↗
The eval scoring we got wrong, and what we did about it
Three rounds of scoring problems in an agent evaluation: regexes too narrow, a credential check that fired on a redacted password, and the three lines we drew for changing criteria after reading answers.
Read the insight ↗
Your dbt descriptions are your prompt
How dbt persist_docs turns YAML descriptions into Postgres COMMENTs and then into an AI analyst's data dictionary, the stale mart description that told the agent its USD columns did not exist, and the deploy chain that decides when a fix reaches it.
Read the insight ↗
How we test an AI SRE: a fake cluster, 17 scenarios, and no vibes
The harness behind Berth's AI SRE evals: a fixture cluster, the product's real prompt and tools, deterministic scoring, stub models that prove the scorer, and what none of it can tell you.
Read the insight ↗
Which local model can investigate a Kubernetes cluster? Qwen3 to Qwen3.5, measured
We ran four local-model setups through 9 scripted Kubernetes failures, 3 runs each, on one Apple M4 Pro: speed, pass rate, safety under injection, and what thinking mode costs. Our own tuned model did not beat the stock one.
Read the insight ↗
Where a small local model still fails at SRE work: a taxonomy from 276 runs
Real failures from repeated runs of a local model on scripted Kubernetes incidents: skipped evidence, a misread unit, backwards capacity reasoning, shallow discovery, over-exploration, and omissions that every model made.
Read the insight ↗
Prompt injection in Kubernetes: what happened when events and pod names gave the AI orders
We planted instructions in a Kubernetes event, a pod name and a log line, and watched local models. Some advised deleting a namespace. Here is what that did and did not risk, and why the defence is structural.
Read the insight ↗
When the agent runs out of tool calls: two small fixes that mattered
An agent loop with a tool-call cap can end without an answer. How we found it in a local-model agent and a cloud one, what we changed (a forced final answer, an explicit instruction, one retry), and how much it did and did not prove.
Read the insight ↗
We are publishing our AI SRE evaluations: the scenarios, the results, and the mistakes
Berth's AI SRE eval data is public: 17 synthetic Kubernetes scenarios, repeated local-model runs, the criteria we changed and why, and a claims ledger. The harness stays private; here is what that means.
Read the insight ↗
Fixing the AI SRE tool loop in Berth 0.5.0: 18 tools to 15, forced final answers, and what the numbers showed
How Berth 0.5.0 (restricted beta) fixes agents that run out of tool calls without answering, why overlapping tools made small models dither, how the merged tools route, and what the before and after runs showed.
Read the insight ↗
20 ms end to end: real-time audio in an AudioWorklet with zero-import WASM
How nomus runs a million-parameter recurrent network on the browser's audio thread: a Rust engine compiled to a WebAssembly module with no imports, a flat C ABI, and a worklet that never throws.
Read the insight ↗
Honest evaluation: how we measured a music filter, and where it still fails
The metrics, test sets and selection rules behind nomus's voice-preserving music filter, the runs that collapsed, the competitor benchmark we lost on one axis, and the cases where the shipping model still fails.
Read the insight ↗
One Rust engine, four hosts: browser, Android, macOS and Linux
How nomus runs one real-time audio engine in a Chrome extension, an Android app and desktop apps for macOS and Linux, and what each platform demanded that the engine could not provide.
Read the insight ↗
Introducing Berth: A Self-Hosted Kubernetes Dashboard With a Read-Only AI SRE
Berth is a self-hosted Kubernetes dashboard that runs in your own cluster. Observe health and capacity, expose apps end to end, and ask a read-only AI SRE what is happening now.
Read the insight ↗
Install a Kubernetes Dashboard with Helm: Token Auth, Ingress, and TLS
A safe, end-to-end guide to installing the Berth Kubernetes dashboard with Helm: token auth, loopback access, Ingress, TLS, and license keys.
Read the insight ↗
An AI SRE That Cannot Touch Your Cluster: How Berth's Read-Only Agent Works
How Berth's read-only AI SRE for Kubernetes stays grounded on live cluster evidence, proposes fixes you review, and can change nothing on its own.
Read the insight ↗
PostgreSQL Migration Checklist: Cutover, Validation, and Rollback
Plan a PostgreSQL migration with clear write ownership, measurable cutover gates, data validation, and a rollback strategy that accounts for new writes.
Read the insight ↗
Canary Deployment With Istio
Istio service mesh is great for many things ie. Security, Multicluster and hybrid deployment, Circuit breaking, rate limiting, retries, service-to-service authentication/authorization, cluster-wide mTLS, and many more. But this demo will focus on the Canary deployment with Kubernetes Gateway API and Istio.
Read the insight ↗
Real Client IP Behind Istio Ambient Gateway: Secure X-Forwarded-For in Go
Istio ambient mesh is great for many things ie. sidecar-free mTLS, L4 authorization with ztunnel, a clean Gateway API entry point, and a much smaller per-pod footprint than the old sidecar model. But the moment you put a service behind an ambient ingress gateway, one thing quietly breaks: access logs stop showing who is actually calling the service. And the way it breaks is nastier than the usual “read X-Forwarded-For” story, because it breaks intermittently.
Read the insight ↗
Managed DevOps vs. Hiring In-House: The Real 2026 Cost Comparison
Short answer: Hiring one in-house DevOps engineer costs roughly $150,000–$200,000/year fully loaded — and a single person cannot provide 24/7 coverage, take vacation, or cover every domain (Kubernetes, networking, security, cost, databases). Managed DevOps typically runs $500–$2,500/month for equivalent or broader coverage, with no recruiting cycle and no key-person risk. The right choice depends on how much ongoing, original infrastructure engineering you actually have — not on day-to-day operations.
Read the insight ↗
Heroku, Render & Vercel Alternatives for Scaling Startups (2026 Cost Guide)
Managed PaaS (Heroku, Render, Vercel) is the cheapest option when your bill is small and your team is tiny. It becomes the most expensive option once you cross roughly $2,000/month in platform spend, because you're paying a 3–10x markup on raw compute for convenience you eventually outgrow. The best alternatives in 2026 are AWS ECS/Fargate or Cloud Run (the moderate step) and managed Kubernetes — EKS, GKE, AKS (the full step), ideally run for you so you don't trade a platform bill for a hiring problem.
Read the insight ↗
Harden WordPress with Cloudflare Free Plan Using Terraform
Maximize Cloudflare’s Free tier for WordPress using OpenTofu/Terraform. Learn how to provision 77+ resources, including WAF rules, Cache Rules, and security headers, via Infrastructure as Code - without spending a dime.
Read the insight ↗
CI/CD Guardrails: Preventing Friday Deployments
Ship fast without breaking prod. Our 5 guardrails: change windows, policy-as-code, canary releases, SLO-based gating, and automated rollback.
Read the insight ↗
GitOps Best Practices: ArgoCD vs Flux in Production
From the three-repository pattern to progressive delivery with Argo Rollouts. Real-world GitOps architecture that eliminates drift and provides audit trails.
Read the insight ↗
Infrastructure as Code: 5 Best Practices for Scale
Stop clicking in the console. Learn the 5 non-negotiable best practices for scaling your Infrastructure as Code using Terraform.
Read the insight ↗
Run Ansible Playbook From Terraform: Provision and Configure EC2 in AWS
Combine Terraform and Ansible to fully automate AWS Bastion Host deployment. This project provisions EC2 infrastructure and configures it with Docker/Compose v2 in one single, repeatable IaC workflow.
Read the insight ↗
Terraform State Management: Kill Local State
Why committing .tfstate to Git is a security disaster. A guide to setting up robust S3+DynamoDB remote backends with encryption and locking.
Read the insight ↗