DevOps、Docker、Kubernetes、可观测性
This collection features articles and community discussions in the 云原生 space, focusing on real-world engineering scenarios, tool selection, practical paths, and risk boundaries.
The page is continuously updated and serves as a learning roadmap, technology selection reference, and technical review entry point.
A new model version cannot be released based on container health alone. This article designs a model-serving rollout process spanning offline gates, shadow requests, staged canaries, and automatic rollback, while addressing caches, sessions, and GPU warm-up.
The first step to the cloud isn't creating a VM — it's understanding networking. Covers VPC/subnets/routing/security groups/NAT: public vs. private subnets (databases shouldn't face the public internet), security groups and NACLs, NAT gateways, and a classic 'two-tier subnet + minimal exposure' architecture.
When services run across machines, logs become scattered and hard to find during incidents. Log aggregation centralizes them for search, analysis, and alerts. This article explains the collection → transport → storage → query architecture, ELK vs. Loki tradeoffs, why structured JSON logs matter, and how to set level, sampling, and retention policies.
OFFSET pagination becomes painfully slow by page 1,000 because it really scans all preceding rows. This article explains OFFSET's O(N) cost, O(1) keyset pagination, compound cursor design, and when page jumps still make OFFSET necessary.
Which backend should receive an incoming request? The load balancer's strategy decides. This article explains L4 (network layer) vs. L7 (application layer), when to use round robin, weighted, least connections, IP hash, and consistent hashing, health checks and session persistence, and how to choose among Nginx, ALB, and Envoy.
API keys, database passwords, and JWT secrets become time bombs when hard-coded. This guide covers .env files for development, environment variables for Docker, production services such as HashiCorp Vault and AWS Secrets Manager, rotation and auditing, and incident response after a leak.
Not sure why a query is slow? EXPLAIN ANALYZE is PostgreSQL's X-ray machine, showing how SQL actually runs. Learn to read Seq Scan, Index Scan, Hash Join, and Nested Loop nodes, distinguish cost from actual time, spot estimate errors, full-table scans, and disk spills, and optimize from evidence.
A platform-wide KMS key proves only that data is encrypted; it cannot prevent cross-tenant substitution or unintended decryption. This article designs tenant key hierarchies, context binding, caching, and recovery validation.
How applications connect to databases determines concurrency. This article explains three architectures: in-process pools (Prisma/node-pg-pool), connection proxies, and Serverless pools (PgBouncer transaction mode), covering where each fits, its concurrency bottlenecks, and Serverless solutions such as Neon/SUPABASE poolers.
With enough microservices, must every service reimplement mTLS, traffic control, and observability? A service mesh moves these concerns out of code and into infrastructure. This article explains Sidecar proxies, Istio versus Linkerd, unified governance, and when a mesh does or does not make sense.
Org charts, menu trees, and nested comments can span N levels that fixed JOINs cannot handle. This article covers CTEs, recursive anchor and recursive terms, practical hierarchy queries, and PostgreSQL 14+ MATERIALIZED behavior.
What if a single region goes down? The cloud fails too (AWS us-east-1 has failed many times). Covers DR core concepts (RTO/RPO), strategies (backup & restore, Pilot Light, Warm Standby, Active-Active, multi-region), cost-vs-recovery-speed trade-offs, and when you should go multi-region.