Operations | Monitoring | ITSM | DevOps | Cloud

The latest News and Information on Containers, Kubernetes, Docker and related technologies.

Container hardening isn't a substitute for artifact management

Hardened base images are a great secure foundation. They're minimal, security-vetted, and have few dependencies to worry about. But almost nobody ships a bare base image. Teams build on top of it. This video cover whys that "on top of it" layer is where the risk actually lives: Skip the base image hardening and you're building on a shaky foundation. Skip artifact management and you're leaving everything built on top of that foundation ungoverned. A strong posture uses both.

Making Shared GPUs Even Safer with Kubex and HAMi-core

Table of Contents A few months ago, we introduced Kubex support for the KAI Scheduler to improve GPU sharing for production inference workloads. The basic model is simple: The KAI Scheduler handles placement and GPU sharing. Kubex continuously observes usage and adjusts those allocations as demand changes. KAI provides the scheduling foundation. It lets multiple workloads share a GPU while accounting for the amount of GPU each workload requests. Kubex then closes the loop.

We renovated the Civo Community Slack: Here's what changed and why

The Civo Community Slack has become home to over 35,000 engineers, platform teams, students, and practitioners. It’s one of the things we’re most proud of, a genuine space where the people who use Civo and the people who built Civo are in the same room. Since starting the Civo Community Slack, we’ve shipped an entirely new brand, launched Konstruct, and expanded our AI infrastructure.

Moving Beyond OOM Kills: Introducing Memory QoS in Kubernetes 1.37

Table of Contents For most of Kubernetes’ history, memory management has been a blunt instrument. Cross your limit, and the kernel kills your container. There has been no equivalent to CPU throttling, no graceful backpressure, just a hard stop. With Kubernetes 1.37, that changes: Memory QoS, built on cgroups v2, graduates to Beta and is enabled by default.

Shipped: Rightsize Kubernetes workloads without leaving your MCP client

Changing a Kubernetes resource request takes two numbers: what the workload requests, and what it uses. The CloudZero MCP server now returns both, by cluster, namespace, or workload. This gives you a number you can defend. Usage comes back as P95 over the date range you query, 30 days by default. When an engineering lead asks whether a service runs on a smaller request, that is the figure that settles it. Over-provisioning and under-provisioning show up on the same query.

The Safest Place to Run an AI Agent Is On a Cluster That Doesn't Trust It

Every organization running AI agents has already made a hosting decision. Most made it by accident. The sales team switched on the agent built into their CRM. Engineering is piloting a coding agent in a vendor’s cloud. Someone on the data team deployed a LangGraph service to a VM with a database key in an environment variable, and someone else is running an agent framework on a laptop with production credentials in a dotfile. Each of these is a hosting decision.

Task containers turn idle jobs into on-demand compute

Somewhere in most production setups there is a container that stays awake all week to do one job on Friday. Maybe it re-indexes a database. Maybe it runs a batch report, or a data migration that only matters at month end. Either way, the resources are billed for seven days. Task containers close that gap. They are ephemeral, API-triggered containers that spin up inside an Upsun Cloud environment, run exactly one command, and remove themselves when that command exits. Nothing sits idle between runs.

Built-in vs. custom: How to choose a Konstruct cluster template strategy

If you've ever inherited a cluster that nobody fully understands, or watched two teams solve the same infrastructure problem in completely different ways, you've already felt the cost of not having a template strategy. It's not always dramatic; it starts with a different CNI here, a missing cert-manager version there, but it compounds. Six months later, cluster configuration is tribal knowledge, and the platform team has become the bottleneck.