Engineering posts, architecture writeups, and the occasional hot take.
CLRK pairs gVisor isolation with credential injection - Envoy intercepts every request, so agents never hold your API keys or touch your network directly.
Trainy's platform schedules GPU workloads across its customers' Kubernetes clusters and clouds. To do that, they need a reliable, secure connection into every one of those environments. Here's how they built it on Apoxy.
An interactive, in-browser TCP congestion control simulation using WebAssembly.
We measured runsc cold boot on a number of hosts across three clouds and one Mac. The fast number isn't the cloud, the slow part isn't the kernel, and most of the obvious fixes do nothing.
Why we built one control plane for HTTPRoute across clusters, and what shipping the managed gateway looks like for self-serve teams and in-VPC deployments.
Forking Julia Evans' Nginx Playground into an Envoy playground in an afternoon - sed, func-e, a CodeMirror fix, and a Fly.io deploy.
Introducing Apoxy: the proxy platform for improving the security, observability, and usability of APIs and services at scale, built on Envoy and WebAssembly.