- Ratchet budgets: locking in cloud savings with AWS Budgets
- DeleteRestApi: the slowest API in AWS
- FOCUS billing: the dedup trap
- I was the cross-AZ villain all along
- The $450/month one-liner
- MCP wrapper pattern: make README setups survive real machines
- Ghost crons warming corpses
- Price your AI calls in satoshis
- Bedrock inference profiles route cross-region, and your SCP will block it
- Snowflake handled 6 million VARIANT rows. DuckDB crashed at 4,000,001.
- ElastiCache won’t let you PING
- DuckDB has a community extension that converts PascalCase to kebab-case in SQL
- AWS has 7 partitions, not 3 — the classified ones are in endpoints.json
- s3 is porcelain, s3api is the real service
- AWS won’t negotiate with hostages
- Query your AWS cost recommendations with DuckDB instead of clicking through the console
- I deleted a $1/mo charge from a service AWS canceled
- I’ve been typing timezone names from memory for years. TZ=[tab] was always there.
- Data engineering is archaeology
- cf-wait: stop refreshing your browser after a deploy
- The AI improved my epic by removing everything that made it useful
- Four AWS orgs, one command, skip the ones that are still valid
- sqlite3 :memory: is the CSV query engine you already have
- steps.sh doesn’t belong in your Kubernetes entrypoint
- Gunicorn 25 broke my read-only container
- Someone overwrote my ECR tag with a different architecture
- Your EKS nodes are dying and the ASG doesn’t care
- Docker buildx served my CI a stale COPY layer and nobody noticed
- Terraform can’t show you what ESO will deliver to your pod
- Your deploy workflow shows green. Your pods didn’t roll.
- Your WAF ‘10MB limit’ is actually an 8KB limit
- Hugo’s {{ range .Pages }} sorts oldest-first
- GovCloud SSO and the STS endpoint trap
- AWS_REGION and AWS_DEFAULT_REGION are not the same variable
- GovCloud root credential delivery requires a KMS policy you don’t have
- Your deploy workflow just tried to create a tenant that doesn’t exist
- Three layers of indirection: how API Gateway hides your Lambda version pin
- Your Lambda VPC migration worked. Your published versions didn’t.
- AWS said AccessDenied. CloudTrail said why.
- SSM Parameter Store version history as incident forensics
- ignore_changes doesn’t protect what isn’t in state yet
- your container is phoning home to china on every cold start
- bash ((count++)) kills your set -e script
- Silent exit 0 is worse than a crash — when scripts succeed with wrong inputs
- Deterministic naming means your teardown has a cache invalidation checklist
- Owner chain explains lineage. Reconciler chain explains behavior.
- Kubeflow version is a matrix, so snapshot runtime plus reconciler inputs
kubectl auth can-iis the fastest RBAC smoke test I was missing- Code blocks are operational UX, not decoration
- TIL: three layers between headscale and a private EKS endpoint
- ‘deadline’ is a line in the dirt where they shot you
- ‘cope’ traveled from incel forums to a welded cage on a Russian tank
- TIL: docker login silently fails when credsStore is set
- terraform show -json hides resources in child modules from naive jq queries
- GitHub Actions silently injects org secrets as empty strings on the free plan
- Terraform ignore_changes can target a single annotation key, not just the whole map
- Route53 requires one record set per name+type — your Terraform module needs to aggregate
- Kubernetes ResourceQuota needs 2x headroom for rolling updates, not 1x
- Wildcard MX records enable Fastmail subdomain addressing without per-subdomain config
- cloudflare_zone_dns_settings drifts on every plan — ignore_changes = all is the fix
- Cloudflare zone imports orange-cloud your DKIM CNAMEs and silently break email signing
- GitHub Actions PR comments — stop flooding, start updating
- ElastiCache RBAC key-prefix ACLs give you per-tenant Redis isolation on one cluster
- aws-error-utils gives you specific AWS exceptions instead of catch-all error swallowing
- Terraform S3 backend has native state locking now (no DynamoDB)
- Kopf’s @on.create handler fires on every kubectl apply, not just creation
- Hugo title-cases your tags everywhere (and how to stop it)
- Hugo clean URLs on S3 need a CloudFront Function
- Cloudflare Registrar locks your nameservers (and how to escape with multi-provider DNS)
- ACM wildcard and apex certs share the same validation CNAME
- EKS private endpoints need a security group rule for Headscale
- Claude Code /resume loses sessions — rebuild the index to get them back
- Claude Code safety hooks can be bypassed with chained commands
#acm
#ai
#alb
#api-gateway
#apigateway
#aws
#bash
#bedrock
#blogging
#ci-cd
#claude-code
#cli
#cloudflare
#cloudfront
#cmmc
#containers
#control-tower
#data
#data-engineering
#dataengineering
#debugging
#developer-experience
#devtools
#direnv
#dns
#docker
#docs
#duckdb
#ecr
#eks
#elasticache
#email
#eso
#etymology
#fastmail
#finops
#funnelhacker
#github-actions
#govcloud
#gunicorn
#headscale
#hugo
#iam
#incident-response
#internet-culture
#jq
#kms
#kopf
#kubectl
#kubeflow
#kubernetes
#lambda
#mcp
#metacontroller
#ml-ops
#multi-tenant
#networking
#oidc
#operations
#operators
#parquet
#performance
#platform-engineering
#platformengineering
#productivity
#python
#rbac
#redis
#reliability
#route53
#s3
#saas
#scp
#security
#seo
#shell
#snowflake
#sql
#sqlite
#ssm
#sso
#sts
#terraform
#til
#vpc
#waf
#war-stories
#zsh