The engineering notebook
Practical articles on AI, cloud and DevOps. Choose a story and get into the engineering.
30 articles
A plain-language guide to NVIDIA OpenShell: why AI agents need a sandbox, how the gateway, supervisor and sandbox fit together, how policies and hidden credentials work, and how to try it.
Agent Runtimes · Part 4
A plain-language guide to AI costs: what tokens are, where the hidden ones come from, how to read usage and trace it by feature, and how FinOps budgets and levers keep the bill in check.
Understand Google AX through a shared office: tasks, workspaces, runners, and how Agent Substrate provides the sandbox. Follow one simple README check.
Agent Runtimes · Part 3
A clear introduction to Agent Substrate: why idle agents need a different home, what actors and workers mean, and how snapshots let work continue later.
Agent Runtimes · Part 2
What a sandbox is, why AI agents need one, why a normal container is not enough, and how kubernetes-sigs/agent-sandbox gives every agent its own locked room. Verified against the official v1beta1 API.
Agent Runtimes · Part 1
Follow one forecast through data cutoffs, delayed labels, release and monitoring. An illustrated MLOps introduction for Cloud and DevOps engineers.
MLOps: From Model to Production · Part 1
A plain-language deep dive into a modern GPU, using the NVIDIA H100: GPCs, TPCs and SMs, every unit inside an SM, the memory system, occupancy, Hopper's clusters and TMA, copy engines, NVLink and NVSwitch, MIG, the graphics units, and where TFLOPS numbers come from.
Masterclass · Part 3
A plain-language masterclass on GPUs. What a CPU is brilliant at and where it struggles, latency vs throughput, Streaming Multiprocessors, warps and divergence, latency hiding, memory bandwidth and the roofline, Tensor Cores and low precision. No hardware background needed.
Masterclass · Part 2
A plain-language masterclass on inference engineering. Prefill and decode, the KV cache, batching, latency vs throughput, and how vLLM's PagedAttention, continuous batching, prefix caching and speculative decoding make AI fast and cheap. No AI background needed.
Masterclass · Part 1
Part 1 of Agent Harness Engineering. Why the same model can be a chatbot or a reliable coding agent, the seven parts every harness has, one bug fix traced through all of them, and the lessons Anthropic and OpenAI published about building harnesses.
Agent Harness Engineering · Part 1
Part 2 of Agent Harness Engineering. Build a real coding-agent harness in about 120 lines of Python, with a workspace jail, a policy that protects the tests, a done gate that runs the tests itself, checkpoints and traces. Then break it on purpose, and see how each piece grows up for production.
Agent Harness Engineering · Part 2
Part 1 of AI Agents from Zero. A spoon-fed explanation of what an AI agent really is, how it differs from a chatbot and a workflow, the five parts every agent has, and the think-act-observe loop, walked through one real example.
AI Agents from Zero · Part 1
Part 2 of AI Agents from Zero. Open the hood: the exact messages an agent sends, how tool calling really works, three kinds of memory, how agents plan, and a complete working agent in about 80 lines of Python with no framework.
AI Agents from Zero · Part 2
Part 3 of AI Agents from Zero. The five building blocks behind most real agent systems with runnable code, when several agents beat one, a refund agent designed step by step, and how agents get attacked (prompt injection, the lethal trifecta) and defended.
AI Agents from Zero · Part 3
Part 4 of AI Agents from Zero. Everything between a working agent and one you can trust with real users: a simple reference architecture, reliability, identity and secrets, approvals, versioning, evals and red-teaming, safe rollouts, monitoring, cost, privacy, MCP security, an incident runbook, a launch plan and the checklist.
AI Agents from Zero · Part 4
OpenAI now runs your agent loop for you, on their infrastructure, inside a durable session you can disconnect from and resume. Here's what actually changes, what it costs, and a full worked example.
Guardrails are the runtime control plane around an LLM — what they are, why every production AI app needs them, and how to implement them with Bedrock Guardrails, NeMo Guardrails, and Llama Guard, with real configs.
The forward deployed engineer doesn't build for the customer — they build with them. What the role actually is, where it came from, the glue code nobody sees, and how to tell if it's you.
Loop engineering is the 2026 shift from prompting AI agents turn-by-turn to designing the system that prompts, verifies, retries, and stops them. What it is, why it matters, and how to build one — with real loops.
AWS Lambda MicroVMs is a new serverless primitive giving every user or AI agent its own Firecracker sandbox — VM isolation, near-instant resume, and state for up to 8 hours. Here's how it works and how to run one.
A comprehensive production guide to implementing SLSA v1.2: Build and Source Tracks, in-toto provenance, Sigstore keyless signing, and Kubernetes admission-time policy enforcement.
Stop pinning pods to node pools for IAM. OKE Workload Identity grants Kubernetes pods fine-grained, policy-driven access to OCI resources scoped to a service account. Real policies, manifests, and SDK config.
A beginner-friendly guide to how Kubernetes uses TLS certificates to secure your cluster. Learn what the CA is, which components get certificates, how mutual TLS works, and what happens behind the scenes from a security point of view.
A plain-English guide to CI/CD and deployment environments for anyone new to DevOps. Learn what dev, staging, and production are, how many you need, and why each one matters.
AWS announced the GA of their managed MCP Server, giving AI agents secure, authenticated access to 15,000+ AWS APIs, live documentation, and sandboxed script execution.
A deep, hands-on guide to Google's Agent Development Kit (ADK 2.0). Real Python code for tools, sequential/parallel/loop pipelines, sub-agent delegation, callbacks, evaluation, and Cloud Run deployment — plus an honest comparison with LangGraph, CrewAI, and AutoGen.
A beginner-friendly guide to understanding CUDA, GPUs, and why thousands of tiny cores are better than a few big ones for AI and modern computing.
Learn how to architect a modern Kubernetes observability stack using OpenTelemetry and eBPF, how to manage cardinality, and the best practices for production.
AI is getting smarter, but it doesn't always need complex vector databases. Here is a simple explanation of Vectorless RAG and why it's becoming popular.
How iam-zero uses live CloudTrail logs and Anthropic Claude to audit over-permissive active policies, automatically opening secure pull requests.
Agentic Cloud Security · Part 1
Nothing matches this search. Try another topic or keyword.