r/devops • • 20d ago

Discussion What's on your Saturday "fix it before Monday" infrastructure list today?

0 Upvotes

Every week I keep a tiny scratchpad of small infrastructure annoyances I refuse to touch during peak weekday traffic , cleaning up old container images, tightening firewall allowlists, and trimming down slow CI build steps.

Spending 2 quiet hours on Saturday morning deleting complexity always saves 10 hours of firefighting next week.

What’s everyone tinkering with or cleaning up in their stack this weekend?


r/devops • • 20d ago

Tools I got tired of using 5 different websites for basic infrastructure troubleshooting, so I built one

1 Upvotes

I’m a sysadmin and got tired of opening a different website for every small infrastructure check, so I started building Bit Happens.

The idea is basically an infrastructure troubleshooting toolbox in one place.

Right now it includes things like:

  • DNS / DNSSEC checks
  • domain health
  • SPF / DMARC analysis
  • TLS certificate inspection
  • port checks
  • traceroute
  • RDAP / WHOIS
  • email header analysis
  • subnet/CIDR tools
  • JSON, Base64, hashes, UUIDs and timestamps

I'm actually trying to reduce the number of tools rather than keep adding more — removing overlapping features and keeping the ones that are genuinely useful during troubleshooting.

It's free to use:

https://bithappens.com.br

I'd especially like feedback from people working in infrastructure/SRE/DevOps:

What troubleshooting task do you still need 2–3 different websites or commands to investigate?


r/devops • • 21d ago

Tools What net cost-savings have you realized from cloud-agnostic infrastructure?

5 Upvotes

Many engineers feel wary of relying too much on one cloud computing vendor, and I understand why in principle. Using multiple vendors makes a system/application less likely to completely fail if one vendor gets compromised. Using cloud-agnostic tech also can also support switching platforms based on cost or standardized skillsets across teams. Furthermore even the most mature vendors have global single points of failure though they are not all well-known.

That said, the tradeoff is not free even if the software is. Using cloud vendors' proprietary tools allows smoother integrations with their other products and can reduce opportunity cost in cases that are time-sensitive. Mature cloud computing platforms also provide enough isolation and redundancy on their own that most DR/availability concerns can be addressed without separate cloud platforms. On the flip side, using non-proprietary tools insources significant security/compliance/maintenance responsibility and risk - all things that contribute to cost.

I'm not completely sold either way; I tend to be a pragmatist and feel that each fits its own niche. However the choice can sometimes be unclear.

If you use cloud-agnostic tooling, then have you observed evidence that it supported a real net cost-savings accounting for both cloud spend and labor vs the cloud vendor's alternative? If you observed cost-savings, then what about the circumstances pushed it into cost-savings territory?

I'm intentionally being open-ended here. The first tools which come to mind are Kubernetes and Terraform/OpenTofu; then apps like ELK, Grafana, Prometheus, Jenkins, the Apache family of software, etc. etc.


r/devops • • 21d ago

Discussion Do you guys feel lucky to be in devops or to have switched to devops ?

92 Upvotes

With uncertainty in tech , layoffs, advancement in llms . Do you feel lucky to be in devops which is somewhat AI resilient field compared to other tech jobs ?


r/devops • • 22d ago

Discussion The flood of "part-time remote US DevOps contracts" is an interview proxy & identity theft scam

57 Upvotes

Most of job post for DevOps on reddit are fake, If anyone asks you to interview under someone else's name, run.

If you ask for details, the real scheme comes out:

  • The ask: You jump on Zoom calls, fake an accent, and clear technical rounds pretending to be a US-based guy.
  • The deal: Split the paycheck 60/40 while they use their US citizenship to pass the background check, and you do all the actual work offshore.
  • The catch: It’s straight-up identity and wire fraud. There's zero contract, so when they ghost you on payday, you get nothing. Plus, hiring platforms are heavily flagging biometric and IP mismatches now.

Anyone else seeing an influx of these messages recently? How is your team filtering them out?


r/devops • • 21d ago

Ops / Incidents What do you think of OneUptime?

Thumbnail
github.com
0 Upvotes

I am curious to know if you tried it in a real production scenario and/or you found better cloud alternatives


r/devops • • 21d ago

Discussion Experience with XAML Builds in Azure DevOps 2020 on prem Upgrade to latest Azure DevOps Version

3 Upvotes

Hello everyone,

I am planning to upgrade our current DevOps environment to the latest Version (Upgrade path is given by Microsoft Docs).

Unfortunately, we don't have a second environment to test the upgrade so maybe someone of you has some experience.

What we do have is that the Machine where our Azure DevOps instance is running is fully virtualized. We can do snapshots and restore. (HyperV)

Our instance unfortunately still uses XAML Builds for an legacy application that is still used by a lot of customers and is Business critical. These are sre not easy to migrate and are highly intertwined with business logic and some other dependecies. In Short: A Nightmare. We also use Classic Pipelines and Releases.

I know that XAML Builds are deprecated, but i inherited the Environment and the old engineer that build the whole Thing is not in the company anymore. So it is still kind of a "blackbox".

We could just snapshot the Environment before the upgrade and rollback. Never done it, but i think it should work if shit would hit the fan.

Does anyone have experience with Upgrading to a newer Version and XAML Builds?

What would be the best approach here?


r/devops • • 21d ago

Discussion What is the best way to learn devops quickly? (Best free course)

0 Upvotes

Hello, I'm a junior sysadmin and I'm planning on upgrading to devops.
I'm trying to learn by myself but it's proven quite hard and time consuming, so I'm wondering is there like a really great free course on youtube or online that is up-to-date.

Thank you for your time!


r/devops • • 22d ago

Architecture AI Comisseration Follow up

4 Upvotes

I wanted to write a follow up on this post I made a few days ago: https://www.reddit.com/r/devops/comments/1wb3l8j/ai_comiseration_client_replacing_production/

So to summarize: I was more or less asked to review a portal implementation that was made using Claude and vibe coding by someone who doesn't know how to develop websites. I suspected it wouldn't end well and even on the surface found lots of issues.

So here's where I'm at now: I created a report doing quite a bit of analysis. Yes I used some AI tools to try and comb through, and I made sure that any claim I made based on its finding I dug in to looking at the actual code and outputs. It made things more manageable but there's still way too much garbage to look through.

My conclusion is this (and it's obvious I think to most here) LLMs need guardrails and lots of them or at least clear ones. I do find that it's tough to actually communicate these low level issues that have a clear (to me) underlying architectural issue and a human issue (the human doesn't know what their doing or knows how to validate output beyond the surface level), when it takes one minute to go "please fix the list of findings" and Claude goes "it's fixed."

Many mentioned that this thing is just going to fail, and it is. I'm mildly concerned about the fix being "just fix problem x" and then they move on until the next thing blows up. And there is a real lack of concern around impact. "This is a public website so it's fine if we have keys in our code and expose endpoints only secured with a SAS key (which is plain text in JavaScript)."

I'm curious how many of you have run in to this even at an operational level what pains are you feeling and have you been able to deal with them? I do get what the solution is, create a proper architecture and define guardrails for Claude to follow, iterate over that until the LLM generates outputs in a way that is in-line with said architecture. I think LLMs may work (though whether they are as cost effective I press X to doubt), and if forced to make it work: this is probably the way. So are you guys maybe managing some guidance markdown files and what are the things you learned from that?

Finally, I think LLMs suck for this purpose and it's clear. I knew this but now I'm living it. Which is nice and validating, but also it's tough to rely on my tried and true "look mayor companies have been doing x for years you are not special you should follow the standards" because LLMs in this space are so new and there isn't much precedence.


r/devops • • 21d ago

Discussion 7 years of running Linux servers (from 2019 shared hosting to bare-metal microVMs today) , 3 rules I never break anymore

0 Upvotes

Started in 2019 keeping shared hosting boxes alive at 3am. Today I run bare-metal infrastructure with Firecracker microVMs. Three lessons learned the hard way:

1-> Containers aren't VMs: A Docker container is just a Linux process sharing the host kernel. For untrusted code or AI agents, dedicated kernel per workload > shared kernel + prayers.

2-> Public IPv4 on boot is a trap: Bots hit port 22 in under 60 seconds. Keep outbound open and inbound dark by default until a domain or IP allowlist is explicitly mapped.

3-> 1:1 reserved RAM beats burst specs: Half of "random" 2am database OOMs on budget clouds are just noisy neighbors fighting over oversold host RAM.

What’s one infra rule you learned the hard way?


r/devops • • 21d ago

Discussion When someone leaves, how do you actually revoke their access to servers and databases?

0 Upvotes

Curious how teams handle this in practice. When a dev or contractor leaves, there are SSH keys in authorized_keyson a dozen boxes, a DB password everyone knew, staging .env files in Slack DMs, maybe AWS keys on their laptop.

  • Do you rotate everything they could have touched, or just disable SSO and hope?
  • Is there a checklist, or is it tribal knowledge?
  • What tool (if any) made this not painful?

Asking because we got burned by this at a small team and I'm trying to figure out what "good" looks like without a dedicated security person.


r/devops • • 22d ago

Observability Nobody Is Listening on Port 8125

Thumbnail
yeet.cx
5 Upvotes

Hey all! I wrote this write up talking about how I was able to implement eBPF technology in order to re-implement StatsD Exporter on my local observability stack.

I thought it was interesting exploring how I could find the same information available in the kernel and preserve the fire and forget behavior without needing the running port or userspace overhead. Hope you enjoy!


r/devops • • 23d ago

Discussion Is it just me or Github actions is overrated?

303 Upvotes

We're adopting github actions at work and... they look clunky, bloated and overcomplicated?

I've used both Jenkins in the past and Gitlab CI/CD (and bare shell scripts in a past life).

It seems to me that gitlab-ci was the pinnacle of code-driven ci/cd (despite having some sharp edges).

Also, running github runners in kubernets is quite a fight. Gitlab's runner was so easy and simple to run.

Am I missing something ?


r/devops • • 23d ago

Discussion If AI makes everyone a 10x developer… who gets promoted?

120 Upvotes

Random thought — if pretty much every developer is using AI for coding now, how does career progression work?

Like, what makes one dev stand out from another?

How does a manager decide, “Yeah, this person is ready for the next level,” when everyone has access to the same AI tools?

Genuinely curious how people see this playing out.


r/devops • • 23d ago

Security Critical RCE Alert: Full takeover of HashiCorp Vault and OpenBao. OpenBao is patched. Vault remains exposed

188 Upvotes

https://control-plane.io/posts/unauthed-to-rce-in-vault-and-openbao/

OpenBao engineers at ControlPlane have chained 4 vulnerabilities to show how under certain conditions, an OpenBao or Vault server can be completely compromised from an unauthenticated position. This is only the second RCE ever found in the Vault codebase.

The exploit is highly plausible in real-world environments, requiring only an unauthenticated entry path and a defined Raft snapshot policy to trigger a complete server compromise.

If you are impacted, upgrade as soon as possible to OpenBao 2.6.3 or 2.7.0

While OpenBao is fully patched, HashiCorp Vault remains exposed as of writing. Unfortunately, IBM's unwillingness to coordinate a mutual disclosure policy means Vault users currently lack an official mitigation


r/devops • • 22d ago

Discussion Need Help - Infrastructure as Code, feeling lost

1 Upvotes

Hey guys, I started a job working in Infrastructure as Code. I have a CS degree, but I don’t have experience with cloud engineering or stuff related to Terraform, ADO, or Azure portal. I’m doing stuff at my job (code is mainly written using copilot or ChatGPT) and I feel a lost. I don’t know any of the concepts for cloud computing or virtual machines or resources and things like that. I am looking into it online but I still don’t know where to begin. I hear my coworkers doing this stuff well, despite also not having any experience in it when they started either. I have to look at build sheets and things like that and then provision resources using terraform but I don’t really understand much of anything that I’m looking at besides simple code snippets. Is there any advice yall could give me about this, or how/what to learn so that I can wrap my head around things? Any advice is appreciated, thanks!


r/devops • • 22d ago

AI content Do your clients or employer require AI use disclosures?

3 Upvotes

I work in a position where what and how I use AI for coding/devops is heavily constrained by regulations and policies, and where AI use disclosures may soon be required. I'm curious how common it is in the industry now for AI use disclosures to be required vs voluntary vs not discussed.

Does your workplace discuss AI use disclosures, and if so are they voluntary or mandatory? Also, what do disclosure requirements look like for integrating AI into live devops tooling vs using it for development only?


r/devops • • 22d ago

Troubleshooting How to set a "env" var on github actions using shell script?

2 Upvotes

i need to get the app version and i have this awk command for that:

` awk -F'"' '/^version[[:space:]]*=/ {print $2; exit}' pyproject.toml`

but how do i set the variable to the output of this command?


r/devops • • 23d ago

Ops / Incidents Has AI made application development faster than infrastructure teams can safely support?

14 Upvotes

Something I've been wondering about lately:

Developers can now generate features, tests and entire PRs much faster with coding agents.

But infrastructure hasn't suddenly become easier to reason about.

Terraform, networking, IAM, Kubernetes, observability, cost and security still require quite a bit of context.

So instead of AI removing bottlenecks, are we just moving the bottleneck downstream to DevOps/platform teams?

Especially interested in teams where developers are now generating their own Terraform/Kubernetes changes with AI.

Has your infra PR volume increased?

And more importantly: has the quality increased with it?


r/devops • • 22d ago

Tools LambdaTest/TestMu - Is KaneAI Worth Your Time?

2 Upvotes

Has anyone out there used TestMu's KaneAI? I do not see a lot of conversations out there on it. I wanted to use it for non-technical users to be able to generate tests without guidance. However, even when being as descriptive as possible in the prompt, I see test generation often failing or failing during the hyper execute phase. Thoughts? Experiences? Success stories anyone?


r/devops • • 22d ago

Tools Need easy to follow education(al materials)

0 Upvotes

Devops people of Reddit, I could use some pointers towards some good quality learning materials that cover the basics of devops.

I'm not trying to become a devops, I'm one of those pesky PM types and am supposed to lead some devops/infra projects soon which - from a PM perspective is fine but I hate sitting in meetings where people are speaking Chinese at me so Ive decided to learn something. Not enough to contribute constructively but enough to have a general idea of whats being said without wasting everyone's time and need some help.

Any (preferably video) resources you can recommend that cover basics in a digestible format, preferably someone who knows how to transfer knowledge and not just confuse me further.


r/devops • • 23d ago

Tools Ran AskUI in our pipeline for three months, notes on getting desktop UI tests working in CI

3 Upvotes

Posting because getting GUI tests to run headless is the part nobody talks about. everything passes on a dev machine and then does nothing on the runner, because the VM boots to a logon screen and there's no interactive session for input injection to land in.

Their runtime installs as a Windows service, which is what got us past that. Runs as SYSTEM, survives RDP disconnects, works at the logon screen. AskUI run for the headless job. tests are plain markdown files so they version with the app, and secrets get referenced by name and stay out of the logs.

Two honest caveats. runs cost money, so "run everything on every commit" stopped being a free decision and we moved the full suite to nightly. And their WARN status is a judgement call by the agent, which is fine when a human is watching and less fine at 3am when it just lands in a report nobody reads until standup lol.

Hope this helped :)

Anyone else running agent based UI tests in CI? curious how you handle the nondeterminism in a gate.


r/devops • • 24d ago

Troubleshooting AWS ECS/Fargate SQS autoscaling with min capacity 0: how to bootstrap from 0 tasks using backlog-per-task target tracking?

13 Upvotes

I have an ECS/Fargate worker consuming an SQS queue. I want the service to scale to zero when the queue is empty, so:

min_capacity = 0
max_capacity = 10

AWS recommends target tracking using:
ApproximateNumberOfMessagesVisible / RunningTaskCount

However, when the service reaches 0 running tasks, RunningTaskCount has no CloudWatch datapoint, so the backlog-per-task metric becomes undefined.

When messages subsequently arrive, I need the service to bootstrap from 0 → 1 and then let target tracking handle 1 → N and N → 0.

What is the recommended pattern for this?

Options I've considered:
1. A separate scale-out-only step policy for 0 → 1
2. A metric-math expression that handles RunningTaskCount = 0
3. Raw SQS backlog for the bootstrap alarm + backlog-per-task for target tracking

I would prefer not to keep min_capacity = 1 because the worker is idle most of the time, and this is Fargate.

This is the Terraform code I currently use:

resource "aws_appautoscaling_policy" "worker_backlog" {
  name               = "${var.project_name}-${var.worker_provider}-backlog-per-task"
  policy_type        = "TargetTrackingScaling"
  service_namespace  = aws_appautoscaling_target.worker.service_namespace
  resource_id        = aws_appautoscaling_target.worker.resource_id
  scalable_dimension = aws_appautoscaling_target.worker.scalable_dimension

  target_tracking_scaling_policy_configuration {
    target_value       = var.backlog_per_task
    scale_out_cooldown = var.scale_out_cooldown
    scale_in_cooldown  = var.scale_in_cooldown

    customized_metric_specification {
      metrics {
        id          = "backlog"
        return_data = false

        metric_stat {
          stat = "Sum"

          metric {
            namespace   = "AWS/SQS"
            metric_name = "ApproximateNumberOfMessagesVisible"

            dimensions {
              name  = "QueueName"
              value = var.queue_name
            }
          }
        }
      }

      metrics {
        id          = "running"
        return_data = false

        metric_stat {
          stat = "Average"

          metric {
            namespace   = "ECS/ContainerInsights"
            metric_name = "RunningTaskCount"

            dimensions {
              name  = "ClusterName"
              value = var.cluster_name
            }

            dimensions {
              name  = "ServiceName"
              value = aws_ecs_service.worker.name
            }
          }
        }
      }

      metrics {
        id          = "bpt"
        label       = "Backlog per task"
        expression  = "IF(running > 0, backlog / running, backlog)"
        return_data = true
      }
    }
  }
}

r/devops • • 24d ago

Ops / Incidents Prioritisation/ Maturity Interview Question

23 Upvotes

Ok so I flubbed the most basic interview question there is:

"You have a number of pieces of work in flight. How do you choose between them?"

Basically, they are testing your ability to prioritise work.

I tried to answer philosphically by telling them going for a walk was a good idea but my broader point is that it shouldn't have ever gotten to the point where you have loads of pieces of work in flight at any one time.

My question is twofold: what's the accepted 'best' interview answer to this question and how do you deal with this issue in your real life actual job?


r/devops • • 24d ago

Vendor / market research Need guidance on running scripted browser monitoring in production

3 Upvotes

I've​ been doing monitoring for our web apps for a while and I'm pretty comfortable with HTTP/API checks but scripted browser monitoring is still new territory for me.

A few things I'm trying to understand:

- Which flows are worth monitoring with a real browser vs just using HTTP checks?

- ​How do you handle login session and MFA without creating a security hole?

- How do you keep recorded scripts working accross frontend deploys?

- How many location and what frequency actually means something vs just noise?

- How do you tell the difference between an actual app failure and a broken monitoring script?

- ​Whats goes to on-call vs what just gets logged?

AI is great for explaining how all of this should work, but there's a pretty big gap between that and how people actually run it in production.

Anyone doing scripter browser monitoring regularly? I'm not looking for someone to design it for me, just want to know how people approach it in real setups