Work computers and AI tools: 8 best practices for engineering teams
A practical baseline for AI at work: managed laptops, SSO, company AI plans, data classes, coding-agent guardrails, secret scanning and human review.
Nearshore Platform Notes
How we build and run cloud-native platforms and AI infrastructure for US teams. Real numbers, real configs, anonymized clients.
AI SRE agents on Kubernetes: read-only access, no Secrets, no exec
Give an AI SRE agent the cluster context it needs without kubectl: a view-bound ServiceAccount, a read-only MCP server, the MCP gateway and GitOps for writes.
LiteLLM as an AI gateway: guardrails, budgets and model routing
One LiteLLM proxy in front of Claude, Bedrock and self-hosted models: a virtual key per app, budgets per team, PII guardrails, fallbacks and spend metrics.
Sandboxing AI agents on Kubernetes with Agent Sandbox and gVisor
A Pod is not a sandbox. How to run agent-generated code on Kubernetes with Agent Sandbox, gVisor, warm pools, default-deny egress and one session per pod.
AI agents with Claude: chat, Cowork, Claude Code and orchestration
When to use Claude chat, Cowork, Claude Code or the Agent SDK, and what it takes to run an AI agent orchestrator in production: gateway, permissions, audit.
Self-hosted LLM inference on Kubernetes with LightLLM
Serving our own models behind the MCP gateway: GPU node pools, continuous batching with LightLLM, and autoscaling on queue depth instead of CPU.
One OpenTelemetry Collector, two clouds: Azure Monitor + Google Cloud
Send the same traces, metrics and logs to Azure Monitor and Google Cloud from one OpenTelemetry Collector pipeline on Kubernetes. Instrument once.
Stop deploying :latest: immutable image tags with Git SHAs
Tag images with the Git commit SHA, make the registry refuse overwrites, promote one image from dev to prod, and roll back with git revert.
Running an MCP gateway on Kubernetes for AI agents
One front door for AI agents: MCP servers behind a Kubernetes gateway with auth, per-tool authorization, session routing and a per-call audit log.
Zero-downtime datacenter to AWS: golden AMIs, DMS, Direct Connect
How we moved a recruitment platform’s ~40-instance .NET fleet and databases from an Ireland datacenter to multi-account AWS with a zero-downtime cutover.
GitOps with ArgoCD: zero config drift across multi-cloud Kubernetes
ArgoCD on a multi-cloud AI agent platform: app-of-apps, versioned Helm charts from GitHub Actions, selfHeal and prune, and what zero drift actually required.
FinOps audit of 737 hosts: the script, the buckets, the savings
How we inventoried 737 hosts across three clouds, sorted them into four buckets, and found the savings before buying a single Savings Plan.