Notes from the network
Engineering write-ups, infrastructure decisions and the occasional post-mortem.
All articles
27 articles
AI & agentsGiving AI Agents Access to Real Infrastructure: MCP, Permissions, and Blast RadiusThe Model Context Protocol makes it trivially easy to connect an AI agent to your database, your cluster, and your monitoring. The protocol will not stop you from doing it dangerously. Here's the security model you have to impose yourself.7 min readAI & agentsAdopting AI Coding Agents on a Small Team: A Practical PlaybookMost AI adoption advice is written for enterprises with platform teams and pilot committees. Here's the playbook for a team of two to ten: what to have in place first, where to start, what to measure, and the month-one failure modes to expect.7 min readAI & agentsReviewing AI-Written Code: A Field GuideAI coding agents fail differently than people do: the code looks right, reads well, and is wrong. How we review AI-generated code after shipping three tools this way — what to check first, the test-shaped-test trap, and a practical reviewer's checklist.6 min readOpen sourceTools That Run on the Router: Why We Build Single-Binary, Local-First Infrastructure SoftwareThree open-source tools, one design philosophy: the control plane lives on the box, ships as one static binary, applies changes with an armed auto-revert, and tells you honestly what it owns. Here's why.6 min readAI & agentsThree Production-Grade Tools in Four Months: An Agentic Development Case StudyBetween February and May we shipped three open-source infrastructure tools — a firewall UI, a BGP router UI, and a Suricata console — with AI coding agents doing most of the typing. What the agents were good at, what stayed human, and what the experience actually cost.6 min readSecuritymeerkat: A Suricata Console That Shows You Sources, Not AlertsWe open-sourced meerkat — a console for Suricata that runs on your router, rolls the alert flood up into a short list of source addresses, and turns each one into a decision: block, acknowledge, allowlist, or ignore.6 min readAI & agentsAI Agents for Infrastructure and DevOps: What Actually Works in 2026AI agents can write Terraform, draft runbooks, and summarize incidents — but letting one apply changes to production is how you turn a typo into an outage. Here's where agents earn their keep in infrastructure work, and the guardrails that make them safe.6 min readNetworkingbirdy: a Web UI for BIRD 2.x That Runs on Your RouterWe open-sourced birdy — a single Go binary that models your BGP config in a database, renders the whole bird.conf, and applies it with an armed auto-revert. Plus a live dashboard of what every session is actually doing.6 min readAI & agentsOur AI-Driven Development Workflow: Plan Files, Guardrails, and Reviewed DiffsThe concrete workflow we use to ship software with AI coding agents: a human-written PLAN.md, milestones that can't break each other, CI as a hard gate, and small reviewed diffs. What we automate, what stays human, and what we do when the agent goes sideways.6 min readSecuritynftably: Managing nftables Without the Fear of Locking Yourself OutWe open-sourced nftably — a web UI that manages nftables as its real object model, applies every change as one atomic, dry-run-checked transaction, and arms an auto-revert so a bad rule can't lock you out of the box you're editing.6 min readAI & agentsAgentic Development: What It Is, and Where It WorksAI coding agents, defined by a team that ships with them: not autocomplete, not autonomous engineering. What changes in your workflow — and where it fails.6 min readNetworkingPractical BGP Traffic Engineering: Local-Pref, Communities, and PrependingOutbound traffic engineering is a setting; inbound is a negotiation. How we steer traffic across AS210622's three upstreams — what actually works, what barely works, and how to measure the difference.6 min readNetworkingGRE Tunnels in Production: MTU, Fragmentation, and the Pitfalls Nobody Warns You AboutGRE is thirty years old and still everywhere — scrubbing return paths, network islands, routing protocols over hostile underlays. Here's the MTU math, the PMTUD blackholes, and the MSS clamping that make it work in production.7 min readSecurityKubernetes Security Hardening: A Production ChecklistDefault Kubernetes installations are not production-ready. Here's our battle-tested checklist for locking down clusters — from RBAC to network policies, pod security, and runtime protection.4 min readNetworkingBuilding a Resilient Network: Our Journey with AS210622How we designed and built our autonomous system from scratch — BGP peering, transit selection, and lessons learned operating AS210622.3 min readDevOpsTerraform at Scale: Managing Multi-Environment Infrastructure Without Losing Your MindTerraform is easy to start with and hard to scale. Here's how we structure Terraform for 50+ environments — state management, module design, CI/CD integration, and the patterns that keep us sane.6 min readKubernetesPlatform Engineering: Building Golden Paths for Your DevelopersWhat is platform engineering, why every growing engineering team needs it, and how to start building your Internal Developer Platform.3 min readKubernetesZero-Downtime Deployments: Blue-Green, Canary, and Rolling Strategies ComparedYour users shouldn't know you're deploying. We compare blue-green, canary, and rolling deployment strategies — when to use each, how to implement them, and the tradeoffs nobody talks about.6 min readReliabilityBuilding an Incident Response Playbook That Works at 3 AMIncidents don't wait for business hours. Here's how we structure incident response — from detection to post-mortem — so the on-call engineer at 3 AM knows exactly what to do.5 min readReliabilitySRE Practices: Implementing SLOs That Actually WorkA practical guide to implementing Service Level Objectives that balance reliability with feature velocity. Lessons from running production systems at scale.3 min readNetworkingContainer Networking Deep Dive: From veth Pairs to Service MeshHow does a packet get from one container to another? We trace the journey through Linux networking primitives — veth pairs, bridges, iptables, and how Kubernetes networking actually works under the hood.7 min readKubernetesGitOps: Infrastructure as Code Done RightGitOps goes beyond storing configs in Git. It's a complete operational model where Git is the single source of truth and reconciliation is continuous. Here's how we implement it.5 min readDatabasesPostgreSQL Performance Tuning for Production WorkloadsDefault PostgreSQL settings are designed for a laptop. Here's how we tune Postgres for production — memory, connections, vacuum, indexing strategies, and the queries that kill your database at 3 AM.7 min readReliabilityObservability Beyond Monitoring: Logs, Metrics, and Traces in PracticeMonitoring tells you something is broken. Observability tells you why. A practical guide to implementing the three pillars — and how they work together to reduce MTTR.5 min readSecurityDDoS Mitigation at the Network Edge: A Layered ApproachVolumetric and application-layer attacks need completely different answers. A walk through the layers of edge DDoS mitigation — transit filtering, BGP Flowspec, XDP, scrubbing, and L7 — and what each one is actually good for.7 min readReliabilityRTO, RPO, and the Disaster Recovery Test Nobody RunsSet real RTO and RPO targets — then prove them with tested runbooks and known-good backups, so recovery holds when your primary datacenter goes dark.7 min read
