DevOps、Docker、Kubernetes、可观测性
This collection features articles and community discussions in the 云原生 space, focusing on real-world engineering scenarios, tool selection, practical paths, and risk boundaries.
The page is continuously updated and serves as a learning roadmap, technology selection reference, and technical review entry point.
What happens when multiple users modify the same data at once? Optimistic locking (version numbers/CAS) suits low contention, while pessimistic locking (SELECT FOR UPDATE) suits high contention. This article explains their principles, implementations, use cases, and the practical rule: start optimistic, then switch if contention rises.
Waiting for failures passively is waiting for incidents. Chaos engineering proactively injects faults (kill containers, add latency, cut network) to verify resilience. Covers the steady-state hypothesis, common experiments (kill instances, network latency, CPU stress, slow DB), tools (Chaos Mesh/Gremlin), and safe practices starting small.
Creating a PrivateLink or PSC endpoint does not mean requests actually stay on the private network. This article validates inference paths using endpoint inventories, split-horizon DNS, routing evidence, and negative probes.
Third normal form is the textbook answer, but production systems often denormalize deliberately through redundancy and precomputation. This guide explains 1NF, 2NF, 3NF, and BCNF, common denormalization patterns such as counters and wide tables, and why sound engineering starts normalized and optimizes real read hotspots later.
Redis is an in-memory database, but data cannot live only in memory: when memory is gone, so is the data. This article explains RDB snapshots, AOF append-only logging, their trade-offs, the production-recommended RDB+AOF hybrid mode, and the compromises around fork latency, AOF rewrites, and recovery speed.
Prompts, responses, retrieval excerpts, and tool arguments spread through copies once they enter telemetry. This article covers field classification, pre-ingestion redaction, OTel Collector controls, a retention matrix, and incident response.
"Message queue" is not one thing. RabbitMQ (traditional AMQP and flexible routing), Kafka (a distributed log for high-throughput stream processing), and Redis Streams (lightweight streams) have fundamentally different designs. This article explains their core models, strengths, and how to choose by requirements rather than popularity.
Default Docker container permissions are excessive (root + no seccomp). This guide covers non-root operation, minimal images, Trivy/Grype scanning, seccomp/AppArmor, read-only filesystems, resource limits, and a production container security checklist.
When traffic spikes, Pods can be overwhelmed; when it subsides, idle Pods waste money. Kubernetes addresses different problems with three autoscaling layers: HPA (horizontal), VPA (vertical), and CA (nodes). This article explains CPU/custom-metric HPA, request-tuning VPA, node-scaling Cluster Autoscaler, cold starts, and predictive scaling.
Insert or update? UPSERT handles it in one statement. This article covers PostgreSQL INSERT ON CONFLICT (specifying conflict columns, DO UPDATE, DO NOTHING), MySQL ON DUPLICATE KEY UPDATE, idempotent write scenarios (sync/retry without duplication), and the pitfalls of ON CONFLICT (partial indexes, multi-column conflicts).
A single Terraform file is enough for a demo, but production requires modules and remote state. This article covers module inputs, outputs, and versions; remote state backends using S3 with DynamoDB locking or Terraform Cloud; state drift and imports; and a production-grade project structure.
Deployment isn’t just “pushing a new version”—how you push, cut over, and roll back when something breaks determines the risk. This article covers three strategies: blue-green (instant switch between two environments), canary (validate on small traffic before scaling), and rolling (gradual replacement), their fit and cost, and how to choose in production.