THE ENGINEERING LIBRARY
Articles
Practical articles on AI, cloud and DevOps. Choose a story and get into the engineering.
blog
Kubernetes Agent Sandbox, Explained Like a Hotel
What a sandbox is, why AI agents need one, why a normal container is not enough, and how kubernetes-sigs/agent-sandbox gives every agent its own locked room. Verified against the official v1beta1 API.
blog
OpenAI's Agents API: The Managed Way to Run AI Agents in Production
OpenAI now runs your agent loop for you, on their infrastructure, inside a durable session you can disconnect from and resume. Here's what actually changes, what it costs, and a full worked example.
blog
AI Guardrails: The Model Is Not the Safety Layer
Guardrails are the runtime control plane around an LLM — what they are, why every production AI app needs them, and how to implement them with Bedrock Guardrails, NeMo Guardrails, and Llama Guard, with real configs.
blog
What Is a Forward Deployed Engineer? Field Notes on the Role Between Product and Customer
The forward deployed engineer doesn't build for the customer — they build with them. What the role actually is, where it came from, the glue code nobody sees, and how to tell if it's you.
blog
Loop Engineering: Stop Prompting Your Agent, Start Designing the Loop That Prompts It
Loop engineering is the 2026 shift from prompting AI agents turn-by-turn to designing the system that prompts, verifies, retries, and stops them. What it is, why it matters, and how to build one — with real loops.
blog
AWS Lambda MicroVMs: Isolated, Stateful Sandboxes for AI and User Code
AWS Lambda MicroVMs is a new serverless primitive giving every user or AI agent its own Firecracker sandbox — VM isolation, near-instant resume, and state for up to 8 hours. Here's how it works and how to run one.
blog
SLSA v1.2 in Production: Verifiable Build Provenance from Source to Admission Control
A comprehensive production guide to implementing SLSA v1.2: Build and Source Tracks, in-toto provenance, Sigstore keyless signing, and Kubernetes admission-time policy enforcement.
blog
OCI Workload Identity on OKE: Pod-Level Access to OCI Resources Without Instance Principals
Stop pinning pods to node pools for IAM. OKE Workload Identity grants Kubernetes pods fine-grained, policy-driven access to OCI resources scoped to a service account. Real policies, manifests, and SDK config.
blog
Kubernetes Certificates & TLS Explained: What Really Happens in the Backend
A beginner-friendly guide to how Kubernetes uses TLS certificates to secure your cluster. Learn what the CA is, which components get certificates, how mutual TLS works, and what happens behind the scenes from a security point of view.
blog
CI/CD for Absolute Beginners: What It Is and Why Environments Exist
A plain-English guide to CI/CD and deployment environments for anyone new to DevOps. Learn what dev, staging, and production are, how many you need, and why each one matters.
blog
The AWS MCP Server Is Now Generally Available
AWS announced the GA of their managed MCP Server, giving AI agents secure, authenticated access to 15,000+ AWS APIs, live documentation, and sandboxed script execution.
blog
Building AI Agents with Google ADK: The Complete Production Guide
A deep, hands-on guide to Google's Agent Development Kit (ADK 2.0). Real Python code for tools, sequential/parallel/loop pipelines, sub-agent delegation, callbacks, evaluation, and Cloud Run deployment — plus an honest comparison with LangGraph, CrewAI, and AutoGen.
blog
CUDA Explained Simply: How GPUs Make AI and Gaming So Fast
A beginner-friendly guide to understanding CUDA, GPUs, and why thousands of tiny cores are better than a few big ones for AI and modern computing.
blog
Kubernetes Observability in 2026: eBPF, OpenTelemetry, and Taming the Metrics Monster
Learn how to architect a modern Kubernetes observability stack using OpenTelemetry and eBPF, how to manage cardinality, and the best practices for production.
blog
What is Vectorless RAG? (Explained Simply)
AI is getting smarter, but it doesn't always need complex vector databases. Here is a simple explanation of Vectorless RAG and why it's becoming popular.
blog
Least-Privilege AWS IAM with an AI Agent
How iam-zero uses live CloudTrail logs and Anthropic Claude to audit over-permissive active policies, automatically opening secure pull requests.