A practical guide to reading AWS IAM policies: the core concepts, the anatomy of a policy statement, common mistakes, and helpful tools.

Envoy configuration is tough to set up when some services use mTLS with short-lived SPIFFE certificates, some only speak HTTP/1, and some need custom auth.

The jq filters I use the most at work to query and debug JSON APIs from the terminal, and that I keep forgetting the syntax for.

How overlay file systems stack read-only and writable layers into one view, with hands-on examples and how containers rely on them.

How O_PATH file descriptors and openat2() let you walk untrusted directory trees safely, avoiding path traversal and TOCTOU races.

A deep dive into Linux mounts: mount types, how mounting works internally, mount propagation, and how mount namespaces isolate containers.

Backward compatibility goes beyond endpoints and fields: real stories of breaking changes in platforms and APIs, and how to avoid them.

Lessons from a low-risk platform change that broke things at scale, and what good change communication looks like, with an email template.

What FUSE is, how it works under the hood, and why userspace filesystems are a practical way to expose awkward storage as ordinary files.

Why inline diagnostics disappeared in Neovim 0.11, and how namespaces, virtual text and vim.diagnostic.config control what you see.