Notes from the network
Engineering write-ups, infrastructure decisions and the occasional post-mortem.
The Real Costs of AI-Driven Development: Tokens Are the Cheap Part
Teams budget for AI coding tools by looking at the subscription price. Then the real invoice arrives: review hours, rework from vague specs, and the guardrail infrastructure you should have had anyway. An honest accounting.
- AI
- Agentic Development
- Engineering Management
Giving AI Agents Access to Real Infrastructure: MCP, Permissions, and Blast Radius
The Model Context Protocol makes it trivially easy to connect an AI agent to your database, your cluster, and your monitoring. The protocol will not stop you from doing it dangerously. Here's the security model you have to impose yourself.
- AI
- MCP
- Security
- Infrastructure
Adopting AI Coding Agents on a Small Team: A Practical Playbook
Most AI adoption advice is written for enterprises with platform teams and pilot committees. Here's the playbook for a team of two to ten: what to have in place first, where to start, what to measure, and the month-one failure modes to expect.
- AI
- Agentic Development
- Best Practices
- DevOps
Reviewing AI-Written Code: A Field Guide
AI coding agents fail differently than people do: the code looks right, reads well, and is wrong. How we review AI-generated code after shipping three tools this way — what to check first, the test-shaped-test trap, and a practical reviewer's checklist.
- AI
- Code Review
- Software Engineering
- Best Practices
Tools That Run on the Router: Why We Build Single-Binary, Local-First Infrastructure Software
Three open-source tools, one design philosophy: the control plane lives on the box, ships as one static binary, applies changes with an armed auto-revert, and tells you honestly what it owns. Here's why.
- Open Source
- Infrastructure
- Linux
Three Production-Grade Tools in Four Months: An Agentic Development Case Study
Between February and May we shipped three open-source infrastructure tools — a firewall UI, a BGP router UI, and a Suricata console — with AI coding agents doing most of the typing. What the agents were good at, what stayed human, and what the experience actually cost.
- AI
- Agentic Development
- Open Source
- Case Study
meerkat: A Suricata Console That Shows You Sources, Not Alerts
We open-sourced meerkat — a console for Suricata that runs on your router, rolls the alert flood up into a short list of source addresses, and turns each one into a decision: block, acknowledge, allowlist, or ignore.
- Security
- Suricata
- Open Source
- IDS
AI Agents for Infrastructure and DevOps: What Actually Works in 2026
AI agents can write Terraform, draft runbooks, and summarize incidents — but letting one apply changes to production is how you turn a typo into an outage. Here's where agents earn their keep in infrastructure work, and the guardrails that make them safe.
- AI
- DevOps
- Automation
- Infrastructure
birdy: a Web UI for BIRD 2.x That Runs on Your Router
We open-sourced birdy — a single Go binary that models your BGP config in a database, renders the whole bird.conf, and applies it with an armed auto-revert. Plus a live dashboard of what every session is actually doing.
- Networking
- BGP
- Open Source
- BIRD
Our AI-Driven Development Workflow: Plan Files, Guardrails, and Reviewed Diffs
The concrete workflow we use to ship software with AI coding agents: a human-written PLAN.md, milestones that can't break each other, CI as a hard gate, and small reviewed diffs. What we automate, what stays human, and what we do when the agent goes sideways.
- AI
- Agentic Development
- DevOps
- Best Practices
nftably: Managing nftables Without the Fear of Locking Yourself Out
We open-sourced nftably — a web UI that manages nftables as its real object model, applies every change as one atomic, dry-run-checked transaction, and arms an auto-revert so a bad rule can't lock you out of the box you're editing.
- Security
- Linux
- Open Source
- nftables
Agentic Development: What It Actually Is, What It Isn't, and What It Changes
Agentic development is not autocomplete and it is not autonomous software engineering. A practitioner's definition of AI coding agents, what actually changes in your workflow, and where the approach genuinely works — and fails.
- AI
- Agentic Development
- Software Engineering
Practical BGP Traffic Engineering: Local-Pref, Communities, and Prepending
Outbound traffic engineering is a setting; inbound is a negotiation. How we steer traffic across AS210622's three upstreams — what actually works, what barely works, and how to measure the difference.
- Networking
- BGP
- AS210622
GRE Tunnels in Production: MTU, Fragmentation, and the Pitfalls Nobody Warns You About
GRE is thirty years old and still everywhere — scrubbing return paths, network islands, routing protocols over hostile underlays. Here's the MTU math, the PMTUD blackholes, and the MSS clamping that make it work in production.
- Networking
- GRE
- Infrastructure
Kubernetes Security Hardening: A Production Checklist
Default Kubernetes installations are not production-ready. Here's our battle-tested checklist for locking down clusters — from RBAC to network policies, pod security, and runtime protection.
- Kubernetes
- Security
- DevOps
- Infrastructure
Building a Resilient Network: Our Journey with AS210622
How we designed and built our autonomous system from scratch — BGP peering, transit selection, and lessons learned operating AS210622.
- Networking
- BGP
- AS210622
- Infrastructure
Terraform at Scale: Managing Multi-Environment Infrastructure Without Losing Your Mind
Terraform is easy to start with and hard to scale. Here's how we structure Terraform for 50+ environments — state management, module design, CI/CD integration, and the patterns that keep us sane.
- DevOps
- Terraform
- Infrastructure
- Automation
Platform Engineering: Building Golden Paths for Your Developers
What is platform engineering, why every growing engineering team needs it, and how to start building your Internal Developer Platform.
- Platform Engineering
- DevOps
- Developer Experience
- Kubernetes
Zero-Downtime Deployments: Blue-Green, Canary, and Rolling Strategies Compared
Your users shouldn't know you're deploying. We compare blue-green, canary, and rolling deployment strategies — when to use each, how to implement them, and the tradeoffs nobody talks about.
- DevOps
- Kubernetes
- Reliability
- Deployments
Building an Incident Response Playbook That Works at 3 AM
Incidents don't wait for business hours. Here's how we structure incident response — from detection to post-mortem — so the on-call engineer at 3 AM knows exactly what to do.
- SRE
- Incident Response
- Reliability
- Operations
SRE Practices: Implementing SLOs That Actually Work
A practical guide to implementing Service Level Objectives that balance reliability with feature velocity. Lessons from running production systems at scale.
- SRE
- Reliability
- Monitoring
- Observability
Container Networking Deep Dive: From veth Pairs to Service Mesh
How does a packet get from one container to another? We trace the journey through Linux networking primitives — veth pairs, bridges, iptables, and how Kubernetes networking actually works under the hood.
- Networking
- Kubernetes
- Containers
- Infrastructure
GitOps: Infrastructure as Code Done Right
GitOps goes beyond storing configs in Git. It's a complete operational model where Git is the single source of truth and reconciliation is continuous. Here's how we implement it.
- DevOps
- GitOps
- Kubernetes
- Infrastructure
PostgreSQL Performance Tuning for Production Workloads
Default PostgreSQL settings are designed for a laptop. Here's how we tune Postgres for production — memory, connections, vacuum, indexing strategies, and the queries that kill your database at 3 AM.
- Database
- PostgreSQL
- Performance
- Infrastructure
Observability Beyond Monitoring: Logs, Metrics, and Traces in Practice
Monitoring tells you something is broken. Observability tells you why. A practical guide to implementing the three pillars — and how they work together to reduce MTTR.
- Observability
- Monitoring
- SRE
- Infrastructure
DDoS Mitigation at the Network Edge: A Layered Approach
Volumetric and application-layer attacks need completely different answers. A walk through the layers of edge DDoS mitigation — transit filtering, BGP Flowspec, XDP, scrubbing, and L7 — and what each one is actually good for.
- Networking
- Security
- DDoS
Disaster Recovery Planning: RTO, RPO, and the Tests Nobody Runs
Every company has a disaster recovery plan. Almost nobody tests it. Here's how to build a DR strategy that actually works when your primary datacenter goes dark — with real RTO/RPO targets and tested runbooks.
- SRE
- Disaster Recovery
- Reliability
- Infrastructure