Latest
AI isn't slop. It's just the generic average. And not you
My agent's PR description had 10 AI tells in 99 words. My version of the same PR had 0.
Notes from running code we have never seen.
Notes on Kubernetes, containers and sandboxing: the root cause, the fix, and the upstream PR when there is one.
Start here
- A node that reported Ready and started nothing: four parts, one containerd fixFrom an outage that lasted hours to a client-side timeout in containerd, through a merge, a revert and a second PR.
- One lost signal, five days stuck, 45,000 frozen threads: fixing a gVisor hang upstreamOne lost signal hangs pod deletion. The maintainer's smaller fix was the better one.
- containerd part 2: 17 lines, 40 days, 30 reviewsWriting the fix was easy. The review was where the engineering happened.
Notes
More writing
- Notes
7 articles in 4 years, then 10 in a month: the blog I kept not starting
For years the good stuff from my day job died in PR descriptions. Then Claude Code built me a blog on Wix Headless in one evening, and now every fix worth telling becomes a post.
- containerd · part 4
Same day, two fixes: 5 days in one project, 175 in containerd
Part 4. The containerd fix finally merged. It isn't the fix I wrote, and two maintainers are the reason.
- gVisor
My fix for this hang was already running. The sandbox hung anyway.
gVisor shifts its stub memory by a random gap, but since 2023 one queue was not moved with it. When the gap is small, that queue can land on a thread's stack and the sandbox can hang for good. The fix was one line.
- gVisor
gVisor, a kernel in Go: what sits between untrusted code and Linux
gVisor answers your app's system calls with its own kernel, the Sentry, written in Go and running in user space. I learned its map one review comment at a time, from the maintainer who kept correcting me.
- Agent tooling
STPA-inspired questions tied a plain checklist in my coding agent. Their one win: Claude asking about timing.
A safety method from MIT, three replayed changes, 54 plans, two blind judges, and a headline I had to take back.
- Notes
I built it for my terminal. A week later, strangers were fixing it for each other
I built prismantis for one terminal, mine. Seven days later it had 60 stars, 10 forks and PRs from people I've never met, and two of them were testing each other's fixes for the same bug. This is that week, day by day.
- gVisor
Pod stuck in Terminating: what it is actually waiting for
A pod in Terminating is not dying, it is waiting.
- Notes
prismantis: real charts, tables and code in Claude Code's terminal
prismantis is a Claude Code mod that redraws Claude's replies with colored tables, highlighted code and mermaid charts, and nudges Claude to actually draw them. I launched it on 2 Oct and update this page with every release.
- gVisor
One lost signal, five days stuck, 45,000 frozen threads: fixing a gVisor hang upstream
One lost signal hangs pod deletion. The maintainer's smaller fix was the better one.
- containerd · part 3
containerd part 3: the fix got reverted
People share their victories. A month later mine got reverted, and that was the right call.
- containerd · part 2
containerd part 2: 17 lines, 40 days, 30 reviews
Writing the fix was easy. The review was where the engineering happened.
- containerd · part 1
A node that reported Ready and started nothing: four parts, one containerd fix
From an outage that lasted hours to a client-side timeout in containerd, through a merge, a revert and a second PR.
- Kubernetes
Running kubectl commands on multiple clusters
One shell function that runs any kubectl command on every cluster.
- AWS
Fixing EKS overprivileged cluster settings
The cluster creator gets admin by default. Now you can take it back without a rebuild.
- Kubernetes
My first open source PR was 3 lines
An unhandled AppArmor case, millions of log lines, and a CLA nobody at work could pick.
