Topic domain
Cloud Infrastructure
Elastic compute, storage, and network as programmable resources.
- Articles
- 80
- Clusters
- 8
- Foundational
- 24
- Intermediate
- 32
- Advanced
- 24
Instances, functions, and scheduling units.
- The Anatomy of a Virtual Instance: vCPU Threads, Guest Memory, and Device Models
- Steal Time and the Mechanics of CPU Oversubscription
- Cold Start Anatomy: What Happens Between a Request and the First Instruction
- Concurrency Per Environment and the Unit a Function Platform Scales
- Requests, Limits, and the Two Different Jobs They Do
- Interruptible Capacity: Eviction Notices, Checkpointing, and the Cost of Being Preempted
Object semantics, tiers, and consistency.
- The Flat Keyspace: What an Object Store Does and Does Not Provide
- What a Successful Write Guarantees: Durability and Read-After-Write Consistency
- Versioning, Delete Markers, and What a Delete Actually Removes
- Multipart Upload: Choosing a Part Size That Survives a Retry
- Storage Tiers Are a Bet on Access Frequency: Minimum Durations and Retrieval Cost
- Conditional Writes: Building a Lock Out of Single-Key Compare-and-Set
VPCs, load balancing, and private links.
- VPC Address Space, Subnets, and the Implicit Router
- Route Table Precedence and the Local Route
- Security Groups and the Stateful Connection Tracker
- Network ACLs and Stateless Filtering at the Subnet Boundary
- Internet Gateway, NAT, and Source Address Translation
- Load Balancer Listeners and Target Selection
Roles, policies, and least privilege.
- Deny Wins: How One Request Is Evaluated Against Many Policy Documents
- Role Assumption and the Shape of a Temporary Session
- Wildcard Semantics in Resource ARNs and Why They Span Separators
- Trust Policies, External IDs, and the Confused Deputy
- Permission Boundaries and Service Control Policies as Independent Ceilings
- Attribute Conditions: Constraining Access by Tag Instead of by Name
Declarative provisioning and drift.
- Desired State, Observed State, and the Reconciliation Loop
- Resource Graphs and Dependency Ordering
- State as a Mapping Between Addresses and Real Objects
- Count, for_each, and the Stability of Instance Addresses
- What a Plan File Records and Why Applying It Is Not a Re-Plan
- Detecting Drift Without Recreating the World
Failover, data residency, and latency.
- The Inter-Region Latency Floor Set by Fiber Paths
- Decomposing the Failover Time Budget
- DNS Failover and the Resolver Caching Bound
- Replication Lag as the Real Recovery Point Bound
- Conflict Resolution When Two Regions Accept Writes
- Quorum Placement and the Latency of the Second-Fastest Replica
Unit economics and capacity planning.
- Billing Units and Why a Cloud Bill Is an Estimate
- Allocating Shared Cost to a Unit of Work
- Egress Boundaries and Which Bytes Are Billed
- Storage Lifecycle Transitions and Minimum Durations
- Commitment Instruments and Break-Even Utilization
- Autoscaling Policies and the Cost of Headroom
Assessment, cutover, and rollback.
- Dependency Discovery from Observed Traffic and Configuration Graphs
- The Cutover Boundary of a Workload and Why It Is Never One Process
- Bulk Copy and Change Stream: Making an Online Copy Consistent
- DNS TTL, Resolver Caches, and the Real Duration of a Cutover
- Shadow Traffic and Differential Comparison Before a Cutover
- Rollback as a Question of Write Reversibility
All Cloud Infrastructure articles
- Oct 24, 2026 BGP Sessions and Route Propagation over Hybrid Links How a gateway exchanges prefixes with a customer network over a dedicated link, why the AS path and local preference determine the winner, and how a flapping session poisons a route table.
- Oct 20, 2026 Network ACLs and Stateless Filtering at the Subnet Boundary Why an ordered, stateless rule list needs an explicit rule for return traffic, how ephemeral port ranges make that rule hard to write, and where the ACL is evaluated relative to the interface.
- Sep 22, 2026 Multipart Upload: Choosing a Part Size That Survives a Retry Parts are immutable commit units. The 5 MiB floor, 10,000-part ceiling, and per-part checksums turn part size into a decision about retry cost and memory.
- Sep 17, 2026 Latency Targets and the Capacity Floor They Imply Why queueing delay grows without bound as utilization approaches one, how a p99 objective translates into a utilization ceiling, and what that ceiling costs per month.
- Aug 21, 2026 Rollback as a Question of Write Reversibility Why reverting traffic is easy and reverting state is not, how dual-write and tombstones change the rollback budget, and when a cutover becomes one-way.
- Aug 20, 2026 Role Assumption and the Shape of a Temporary Session How a caller exchanges long-lived identity for short-lived credentials, what the issued token actually carries, and why revocation is harder than expiry.
- Aug 5, 2026 Route Table Precedence and the Local Route Why a VPC route table has a local entry that cannot be deleted, how longest-prefix match interacts with static and propagated routes, and how a blackhole entry fails silently.
- Jul 27, 2026 Concurrency Per Environment and the Unit a Function Platform Scales Why serverless platforms scale environments rather than requests, how per-environment concurrency changes the arithmetic, and where the queue lives when the limit is reached.
- Jul 27, 2026 Decomposing the Failover Time Budget How detection delay, decision quorum, promotion, and traffic redirection add up into a recovery time, and which of the four terms an operator can actually shorten.
- Jun 10, 2026 Designing for Blast Radius in a Single Apply How state boundaries, replacement rules, and apply ordering determine how much infrastructure a failed run can take down, and what can be enforced before the call is made.
- May 30, 2026 Decommissioning a Source System: Proving Quiescence Why an idle-looking system is not an unused one, how to measure the absence of traffic, and the sequence that ends with a restore test rather than a shutdown.
- May 18, 2026 The Instance Credential Chain and What the Metadata Service Exposes How a virtual machine obtains role credentials without a stored secret, why network reachability becomes identity, and how the request-side defences work.
- May 1, 2026 Internet Gateway, NAT, and Source Address Translation How a VPC reaches the public internet without exposing private addresses, why a NAT gateway is one-way, and how the translation table interacts with connection tracking and path MTU discovery.
- Apr 24, 2026 Shadow Traffic and Differential Comparison Before a Cutover How mirrored requests expose behavioural differences between two implementations, why response bodies rarely compare cleanly, and what a comparison harness must normalise.
- Apr 22, 2026 MTU and Fragmentation Across a VPC Boundary Why the usable MTU inside a virtual network is smaller than the physical link MTU, how encapsulation and translation each consume bytes, and what happens when a packet that needs fragmenting is dropped instead.
- Apr 20, 2026 State as a Mapping Between Addresses and Real Objects What a provisioning state file actually stores, why it is the tool's only durable record of identity, and how concurrent access corrupts that record.
- Apr 9, 2026 Requests, Limits, and the Two Different Jobs They Do A request is a scheduling promise and a limit is an enforcement ceiling; conflating them produces nodes that look full but throttle, and pods that are evicted for reasons nobody expected.
- Mar 3, 2026 Deciding Whether a Policy Set Grants More Than Intended How an access policy becomes a logical formula, what an SMT solver can answer about it, and why the answer is only as good as the model of the request.
- Feb 24, 2026 Trust Policies, External IDs, and the Confused Deputy Why a trust policy naming a principal is not enough when that principal acts for many customers, and how a shared secret in the assumption request closes the gap.
- Feb 12, 2026 The Anatomy of a Virtual Instance: vCPU Threads, Guest Memory, and Device Models What an instance is composed of beneath the API: a set of host threads, a second-level page table, and a set of emulated or shared devices.
- Jan 30, 2026 Count, for_each, and the Stability of Instance Addresses How a resource with a repetition argument becomes several state addresses, why index keys renumber on deletion while map keys do not, and what that costs at apply time.
- Jan 27, 2026 Deny Wins: How One Request Is Evaluated Against Many Policy Documents The order in which identity policies, resource policies, boundaries, and organization policies combine to produce a single allow or deny, and why that order is not additive.
- Jan 8, 2026 Federating Workloads with OIDC: Which Claims a Trust Policy Must Pin How a workload proves its identity with a signed token instead of a secret, why audience and subject both need pinning, and where claim matching goes wrong.
- Jan 2, 2026 Byte-Range Reads: Partial Responses, Alignment, and Parallel Fetch A Range header turns one object into many concurrent reads. What the 206 response guarantees, why alignment matters for throughput, and where range requests break.
- Dec 23, 2025 Commitment Instruments and Break-Even Utilization What a reserved-capacity or savings-plan discount actually buys, how the hourly commitment becomes a sunk cost, and where the break-even utilization sits relative to list price.
- Dec 17, 2025 Anomaly Detection on a Bill That Is Mostly Flat Why a fixed threshold catches nothing in a periodic cost series, how to model a baseline from history, and what a change in resource count does to a detector tuned for price.
- Nov 29, 2025 Replication Lag as the Real Recovery Point Bound Why asynchronous cross-region replication sets an RPO that varies with write rate and network conditions, and how to measure the lag that actually matters for data loss.
- Nov 21, 2025 Cross-Region Replication and the Window Between Two Copies Replication is asynchronous by default, so the second region lags the first. What the lag does to failover, to deletes, and to any read that crosses the boundary.
- Nov 19, 2025 Allocating Shared Cost to a Unit of Work Why dividing a cluster bill by resource requests overcharges some tenants, how idle capacity hides in an allocation model, and where the normalization factor comes from.
- Nov 13, 2025 Billing Units and Why a Cloud Bill Is an Estimate How usage records become invoice lines: instance-hours, the GB-month integral, minimum billing increments, and the order in which discounts are applied.
- Nov 12, 2025 Bulk Copy and Change Stream: Making an Online Copy Consistent Why a snapshot must be pinned to a stream position before the copy begins, how the catch-up phase terminates, and where replication lag turns into an unbounded delay.
- Nov 7, 2025 Sizing Regional Capacity for the Loss of a Region Why N+1 regional capacity is larger than the arithmetic suggests, how queueing turns the last few percent of utilization into latency, and where failover load comes from.
- Nov 4, 2025 Fencing Tokens and the Arithmetic of Lease Expiry Why a promoted primary must wait out the old primary lease before accepting writes, how fencing tokens stop a stalled writer, and where the wait comes from.
- Oct 30, 2025 Why VPC Peering Is Not Transitive and What a Transit Gateway Adds How a peering connection is a pairwise route exchange rather than a shared fabric, why a hub VPC cannot relay between its peers, and what a transit gateway changes about the routing model.
- Oct 25, 2025 Storage Tiers Are a Bet on Access Frequency: Minimum Durations and Retrieval Cost Cheaper storage classes trade per-byte price for retrieval fees, minimum storage durations, and latency. The break-even arithmetic decides which tier a dataset belongs in.
- Oct 17, 2025 DNS TTL, Resolver Caches, and the Real Duration of a Cutover How negative caching, recursive resolvers, and connection reuse stretch a five-minute TTL into hours of split traffic, and what actually bounds the redirect window.
- Oct 6, 2025 Security Groups and the Stateful Connection Tracker How an interface-level firewall decides that a returning packet belongs to an existing flow, why there is no rule for replies, and what happens when the tracking table fills.
- Oct 2, 2025 The Flat Keyspace: What an Object Store Does and Does Not Provide Object storage maps opaque keys to immutable byte strings. The operations it omits, including rename, append, and multi-key atomicity, shape every design built on top of it.
- Sep 27, 2025 Pinning Data to a Region Without Freezing the Control Plane How residency constraints translate into placement rules, which metadata still leaks across borders, and why the control plane and data plane need different regionality.
- Sep 17, 2025 Cold Start Anatomy: What Happens Between a Request and the First Instruction The stages a function invocation passes through before user code runs, which stages dominate the delay, and why warm pools change the shape of the curve.
- Aug 31, 2025 Spot Capacity and the Price of Interruption How interruptible capacity is priced, why the discount is compensation for a termination notice, and how checkpoint interval trades against lost work.
- Aug 28, 2025 What CPU Quotas Cannot Bound: Cache, Bandwidth, and SMT Contention Between Tenants Fair-share scheduling accounts for time, not for shared microarchitectural state; the resources that leak between co-tenants and the placement choices that limit the leak.
- Aug 26, 2025 Conditional Writes: Building a Lock Out of Single-Key Compare-and-Set A precondition on an object write gives one writer a win and the rest a 412. How to use that primitive for leases, exactly-once publication, and safe fan-out.
- Jun 25, 2025 Dependency Discovery from Observed Traffic and Configuration Graphs Why declared configuration undercounts a system's real dependencies, what a flow record can prove, and how sampling and timeouts corrupt an inferred call graph.
- Jun 13, 2025 Permission Boundaries and Service Control Policies as Independent Ceilings How two documents that grant nothing restrict what other documents grant, what each one cannot cap, and how their scopes differ by blast radius.
- May 26, 2025 The Cutover Boundary of a Workload and Why It Is Never One Process How to decide which processes, data stores, and identities must move as one unit, what breaks when a boundary is drawn too small, and the cost of drawing it too large.
- May 1, 2025 VPC Address Space, Subnets, and the Implicit Router How a CIDR block becomes an isolated forwarding domain, where the router joining its subnets actually runs, and why several addresses in every subnet are never usable.
- Apr 22, 2025 Conflict Resolution When Two Regions Accept Writes Last-writer-wins, version vectors, and application merge: what each guarantees about concurrent cross-region updates, and which invariants each one breaks.
- Apr 18, 2025 DNS Failover and the Resolver Caching Bound How record TTLs, negative caching, and resolver behaviour put a floor under DNS-based traffic redirection, and why the observed switchover time exceeds the TTL.
- Apr 10, 2025 Steal Time and the Mechanics of CPU Oversubscription How a hypervisor shares physical cores among more vCPUs than it has, how the guest learns it was descheduled, and what the accounting can and cannot reveal.
- Apr 8, 2025 Placement as Bin Packing: Multi-Dimensional Fit and the Fragmentation It Creates Why a scheduler with free cores and free memory can still refuse a pod, how multi-dimensional packing produces unusable holes, and which scoring functions trade density against headroom.
- Mar 31, 2025 What a Successful Write Guarantees: Durability and Read-After-Write Consistency A 200 response means the bytes survive disk failure, not that every reader sees them yet. How replication, quorums, and listing indexes set the visibility rules.
- Mar 17, 2025 Resource Graphs and Dependency Ordering How references between resources become directed edges, why a cycle is rejected before anything is created, and how ordering decisions change apply time and blast radius.
- Mar 5, 2025 Autoscaling Control Loops: Why the Metric Lags the Demand The feedback loop behind replica count: measurement windows, stabilization, and the delay stack that makes a fast scaler overshoot and an accurate one react too late.
- Mar 4, 2025 Instance Shape Selection and the vCPU-to-Memory Ratio Why a workload that fits one instance family strands half of another, how joint utilization percentiles differ from per-dimension ones, and what burstable credits hide.
- Feb 12, 2025 Attribute Conditions: Constraining Access by Tag Instead of by Name How principal tags and resource tags become condition keys, why the two-sided check needs both halves, and what happens when a tag is missing or renamed.
- Feb 3, 2025 Sequencing a Cutover Against a Dependency Graph Why the ordering of moves is constrained by who calls whom, how to find a valid sequence, and what happens when the graph contains a cycle.
- Jan 27, 2025 Quorum Placement and the Latency of the Second-Fastest Replica How the geometry of replica placement decides commit latency for majority quorums, and why adding a distant replica to a three-node group can be free or fatal.
- Dec 30, 2024 The Inter-Region Latency Floor Set by Fiber Paths Why the minimum round-trip time between two regions is fixed by geography and glass rather than by provisioning, and how to compute that floor before choosing a topology.
- Dec 15, 2024 Private Endpoint Services and the Reverse-Direction Connection How a service in one VPC becomes reachable from another through an address that lives in the consumer subnet, why the connection is accepted by the provider, and what the endpoint does not hide.
- Oct 29, 2024 Desired State, Observed State, and the Reconciliation Loop Why declarative provisioning converges instead of executing steps, what a provider must implement to make convergence possible, and where the model stops describing reality.
- Oct 16, 2024 Cell-Based Isolation and the Blast Radius of a Bad Deployment How partitioning a regional deployment into independent cells limits the reach of a failure, what the cell map costs, and why cells differ from availability zones.
- Oct 16, 2024 Load Balancer Listeners and Target Selection How a listener decides to accept a connection, how a target is chosen from a registered set, and why the balancer terminates the client connection instead of forwarding packets.
- Sep 11, 2024 Deriving Least Privilege from Recorded Access Instead of from Intent Why an audit trail is an incomplete oracle for permissions, how to turn call history into a candidate policy, and what such a policy systematically omits.
- Aug 18, 2024 Provider Versions, Schema Changes, and State Migration How a provider upgrade can change the meaning of stored state, why schema versions exist per resource type, and what an upgrade path can and cannot fix.
- Jul 11, 2024 Importing Existing Resources into a Declarative Configuration What adoption actually writes into state, why a written resource block must match the object before the plan is clean, and where import cannot reach.
- Jun 18, 2024 Request Rate Limits and Why Key Prefixes Are Partitioned A bucket scales by splitting its keyspace across index partitions. Sequential keys hammer one partition, so the naming scheme decides the achievable request rate.
- Jan 16, 2024 Wildcard Semantics in Resource ARNs and Why They Span Separators How the star and question-mark metacharacters match against ARN strings, where their reach exceeds the intent of the author, and how policy variables substitute before matching.
- Dec 28, 2023 Moving Workloads with Overlapping Private Address Space Why two RFC 1918 networks that both use 10.0.0.0/8 cannot be joined by routing alone, how translation state makes the link fragile, and where addresses embedded in payloads defeat it.
- Dec 12, 2023 What a Plan File Records and Why Applying It Is Not a Re-Plan How the plan is computed, what it stores beyond the proposed changes, and why the saved artifact can disagree with the world it is applied to.
- Jul 2, 2023 Interruptible Capacity: Eviction Notices, Checkpointing, and the Cost of Being Preempted What a preemptible instance actually promises, how the notice arrives, and which workload properties determine whether the discount is worth the interruption.
- Apr 21, 2023 Autoscaling Policies and the Cost of Headroom How a scaling policy converts a load signal into an instance count, why the control loop lags the load, and what each unit of headroom costs per month.
- Jan 17, 2023 Storage Lifecycle Transitions and Minimum Durations How a lifecycle rule becomes a charge: the transition request, the per-object metadata charge in each class, minimum storage durations, and early-deletion fees.
- Jan 14, 2023 Detecting Drift Without Recreating the World How a refresh distinguishes remote change from remote absence, why some differences cannot be seen at all, and what remediation does to the objects that were changed outside the tool.
- Dec 30, 2022 Module Interfaces and the Cost of Hiding Structure Why a module boundary turns a graph into a black box, which abstractions leak through the interface, and how validation and outputs shape what callers can express.
- Nov 9, 2022 Egress Boundaries and Which Bytes Are Billed Where traffic is metered in a cloud network, why the same byte can be free or charged twice depending on the path it takes, and how NAT and private endpoints move the boundary.
- Jul 1, 2022 Gang Scheduling: All-or-Nothing Allocation for Distributed Workloads Why a training job or MPI rank set cannot be placed one member at a time, how reservation schemes avoid deadlock, and what each scheme costs the rest of the cluster.
- Jun 26, 2022 Committing a Dataset to an Object Store Without a Rename Table formats publish by writing a pointer, not by moving a directory. How snapshots, manifest lists, and garbage collection work when the commit is one small object.
- May 21, 2022 Versioning, Delete Markers, and What a Delete Actually Removes Enabling versioning turns overwrite into append and delete into a placeholder. The state machine has three modes, and the suspended mode is where most surprises live.
- Feb 7, 2022 Post-Cutover Reconciliation and Drift Detection How to prove that a destination holds the same state as its source after the switch, why checksums over large tables lie, and how to detect divergence that appears later.