Blind XXE: Exfiltrating Data When You Can't See the Response 👁️

https://instatunnel.my/blog/blind-xxe-exfiltrating-data-when-you-cant-see-the-response

https://redd.it/1opoocl
@r_devops

GitLab: Wait for other pipelines to finish?

Hi,

just got asked whether it is possible for a pipeline to wait for another pipeline to finish? The idea is that there are several repositories (3 in that case) with pipelines that somewhat interfer during a step (deploy to a server). The person would like the pipeline to know whether a certain other pipeline is running.

Is this possible in GitLab?

We would still like to have concurrent runners - so using a tag and just have one runner for this tag, is not the ideal option.

https://redd.it/1opsmbq
@r_devops

What do you look for in node metrics?

Hey folks

I’m currently working on a little hobby project to get to know logging and observability - something us developers tend to ignore a lot.

When you’re looking at node/server metrics, what do you find most useful/required when it comes to your dashboards showing node health, resource utilisation etc?

I’m in the process of configuring my Prometheus stack and I don’t want to be bombarding myself with extra data I don’t need/isn’t really useful in the real world.

Thanks!


https://redd.it/1opv8og
@r_devops

What are the projects i could build to show you that you can trust me as your junior cloud engineer in you company?

I am a WordPress developer transitioning to devops or cloud engineering. I am in route to get AWS solutions architect certification currently reviewing using udemy Stephane Maarek course. I built a serverless portfolio website in Amazon with the help of AI. I changed my laptop OS to ubuntu to get use of linux commands. I am experimenting in pulling different projects from github and test it in docker. So this trying to be familiar with terms, tools, and anything that can submerged my head in the field. I am maybe looking for a path of thinga to do and show to my employeer soon that would come from who is already there in the industry.

https://redd.it/1opw5p4
@r_devops

Self-Hosting a Production Mobile Server: A Guide on How to Not Melt Your Phone

I don't know about everyone else, but I didn't want to pay for a server, and didn't want to host one on my computer. I have a flagship phone; an S25+ with Snapdragon 8 and 12 GB RAM. It's ridiculous. I wanted to run intense computational coding on my phone, and didn't have a solution to keep my phone from overheating. So. I built one. This is non-rooted using sys-reads and Termux (found on Google Play) and Termux API (found on F-Droid), so you can keep your warranty.

What my project does: Monitors core temperatures using sys reads and Termux API. It models thermal activity using Newton's Law of Cooling to predict thermal events before they happen and prevent Samsung's aggressive performance throttling at 42° C.

Target audience: Developers who want to run an intensive server on an S25+ without rooting or melting their phone.

Comparison: I haven't seen other predictive thermal modeling used on a phone before. The hardware is concrete and physics can be very good at modeling phone behavior in relation to workload patterns. Samsung itself uses a reactive and throttling system rather than predicting thermal events. Heat is continuous and temperature isn't an isolated event.

I didn't want to pay for a server, and I was also interested in the idea of mobile computing. As my workload increased, I noticed my phone would have temperature problems and performance would degrade quickly. I studied physics and realized that the cores in my phone and the hardware components were perfect candidates for modeling with physics. By using a "thermal bank" where you know how much heat is going to be generated by various workloads through machine learning, you can predict thermal events before they happen and defer operations so that the 42° C thermal throttle limit is never reached. At this limit, Samsung aggressively throttles performance by about 50%, which can cause performance problems, which can generate more heat, and the spiral can get out of hand quickly.

The hardware properties of modern mobile devices are perfect for modeling with physics. Here is what I have found.

Total predictions: 2142 Duration: 60 minutes MAE: 1.51°C RMSE: 2.70°C Bias: -0.95°C Within ±1°C: 58.2% Within ±2°C: 75.6%

Per-zone MAE: BATTERY : 0.27°C (357 predictions) CHASSIS : 2.92°C (357 predictions) CPU_BIG : 1.60°C (357 predictions) CPU_LITTLE : 2.50°C (357 predictions) GPU : 0.96°C (357 predictions) MODEM : 0.80°C (357 predictions)

0.27°C on the hardware that matters, 30 seconds in advance.

On S25+, throttling decisions are made almost entirely based on battery status.

Predictive Modeling > Reactive Throttling.

By using Newton's Law of Cooling in combination with measured estimates based on hardware constraints and adaptive damping for your specific device, you can predict thermal events before they happen and defer inexpensive operations, pause expensive operations, and emergency shutdown operations in danger territory. This prevents us from ever reaching the 42°C throttle limit. At this limit, Samsung aggressively throttles performance by about 50%, which can cause performance problems, which can generate more heat, and the spiral can get out of hand quickly.

Mathematical Model
Core equation (Newton's law of cooling):

T(t) = T_amb + (T₀ - T_amb)·exp(-t/τ) + (P·R)·(1 - exp(-t/τ))
Where:

τ = thermal time constant (zone-specific)

R = thermal resistance (°C/W)

P = power dissipation (W)

T_amb = ambient temperature

Per-zone constants (measured from S25+ hardware):

Battery: τ=540s, C=45 J/K (massive thermal mass)

CPU cores: τ=6-9s, C=0.025-0.05 J/K (fast response)

GPU/Modem: τ=9s, C=0.02-0.035 J/K

Prediction horizon: 30s at 10s sampling intervals

Adaptive damping: Prediction error feedback loop

damping = f(bias, confidence, sample_count)
T_predicted_adjusted = T_predicted - damping·ΔT
Maintains per-zone error history with confidence weighting. Damping strength scales inversely with thermal time constant (battery gets minimal damping due to high predictability, CPU

gets aggressive damping).

Result: 0.27°C MAE on battery.



My solution is simple: never reach 42° C.



https://github.com/DaSettingsPNGN/S25_THERMAL-

Please take a look and give me feedback.

Thank you!

https://redd.it/1opvxum
@r_devops

Cost optimization teams, is that a thing?

Hi

I have for the last year been heavily focused on. Cost reduction for our vloud infrastructure (and sometimes non cloud services). Although it isn't the most exciting thing in the world to be the person that goes around trying to save money, it is needed.

In general engineering is unaware/uninterested on how much the resources they consume cost. So in order to control the waste this tends to be something done by a random person in the team when red lights start flashing in a short term tactical manner.

I am wondering if there are teams that specialize in this cost optimization work for technology infrastructure. Is this a thing? Is management willing to invest money to be able to cut percentage points from their infrastructure bill?

I feel this is a need because the skills for someone to be able to do this work sit between an accountant, procurement and engineering. It seems someone hard to get.

https://redd.it/1opvgsz
@r_devops

Here is why you have a bad experience with AI while software engineers enjoy it

There is almost no value in writing infrastructure code.

It’s short, not repetitive, and anything boilerplate is already wrapped in modules. Typing it out isn’t the hard part.

The real work in DevOps is understanding the environment, the dependencies, the risks, and what can break if you touch something. Most popular and generic AI tools don’t handle that. They wait for your instructions, they guess context, and they produce changes you still have to validate line by line and consider their impact.

So you end up guiding the AI instead of getting help. Might as well type it out yourself while you are thinking.

Here is where we make our bet. Agents that can actually do the complete job - discover the problem, solve it end-to-end, validate it, document it, justify the decision, and guide you through what’s changing and why. It can make mistakes just like humans, but at least it went ahead and did 90% of the useful research and provides direction from which engineer can then jump off.

That’s when AI become from "mildly useful to check documentation" to actually being deployed for serious DevOps work.

What do you think?

https://redd.it/1oq03xz
@r_devops

DevOps Internship DevSkiller Questions

I just got invited to do a coding test for a DevOps Internship. I'm kinda new to this, it's my first time I got past the CV check phase. The test is on DevSkiller platform and it includes 32 multi-choice questions. I have 20 minutes only, so I assume they won't make it too hard. Topics will be Bash, Cybersecurity, Linux, Powershell, cloud, DevOps, QA, CI/CD, Containers, Docker, Kubernetes... I don't know how to start preparing, so any advice would be appreciated. Anyone had any experience with this platform? Or can someone tell me what would be the most efficient way to prepare for this? Thanks!

https://redd.it/1oq1fmr
@r_devops

How to use a .env File with Devcontainers/Codespaces

Ever wanted to use `"runArgs": \["--env-file",".env"\]` in your `devcontainer.json` but get errors when booting the devcontainer for the first time since the file doesn't exist yet? Maybe you clone onto your host machine, add your .env, then "Reopen in Devcontainer," but what if you're on a Codespace, or cloning into a volume?

The solution: include a `.env.example` file in your repo root and add these commands to your `.devcontainer.json`:

* `"initializeCommand": "cp -n .env.example .env"`
* `"runArgs": ["--env-file",".env"]`
* `"onCreateCommand": "sudo chown $(whoami):$(whoami) .env"`

Now, the *first* time you boot up you'll have a .env file ready to be filled out. Then you simply `Rebuild Container` and voila! No errors and no weird volume editing or recovery container shenanigans.

https://redd.it/1oq35l7
@r_devops

How I will now handle "wait-until-ready" problems in CI/CD

I ran several time into the same issue in CI/CD pipelines needing to wait for a service to reach a ready state before running the next step.

At first I handled this with arbitrary sleep timers and retry loops, but it felt wrong so I ended up building a small command-line utility that does state-based polling instead for the job.

For example, waiting until a service becomes healthy before tests run:

watchfor \
-c "curl -s https://api.myservice.com/health" \
-p '"status":"green"' \
--max-retries 10 \
--interval 5s \
--backoff 2 \
--on-fail "echo 'Service never became healthy'; exit 1" \
-- ./run_tests.sh


Recently, I added regex and case-insensitive matching so it can handle more flexible patterns, may it be useful for things like Kubernetes pod readiness checks?:

watchfor \
-c "kubectl get pod my-app-pod -o jsonpath='{.status.containerStatuses[0].ready}'" \
-p "true" \
--ignore-case \
--timeout 2m \
--on-fail "echo 'Pod did not become ready in time'; exit 1" \
-- echo "Kubernetes pod is ready!"


I found this approach handy for preventing race conditions or flaky runs when waiting for services to stabilize.
If anyone else deals with similar “wait-until-X” scenarios, I’d love to hear how you solve them (or what patterns you use).

(Code and examples here if you’re curious: [github.com/gregory-chatelier/watchfor](https://github.com/gregory-chatelier/watchfor))

https://redd.it/1oq43is
@r_devops

Built a GitHub PR security scanner (79+ checks, AI auto-fix). Need beta testers.

Hey r/learnjava,


I'm Vitor, solo dev who spent 4 months building CodeSlick.dev - automated security analysis for GitHub PRs.


What it does:
- Scans PRs for 79+ security vulnerabilities (SQL injection, XSS, command injection, hardcoded secrets, etc.)
- Static analysis + dependency scanning (npm, pip, Maven)
- API security checks (insecure HTTP, missing auth, CORS misconfig)
- AI-powered auto-fix suggestions (one-click fixes)
- OWASP Top 10 2021 compliance (100% coverage)
- Sub-3s analysis time per file


Tech stack:
- Next.js 15 + TypeScript
- Acorn parser for JS/TS analysis
- Custom Python/Java AST parsers
- Google OSV for dependency vulnerabilities
- CVSS scoring + CWE mapping
- Neon Postgres + Vercel hosting


Languages supported:
JavaScript, TypeScript, Python, Java


Need beta testers:
- Free for 3 months (Nov-Jan)
- 5-minute GitHub App install
- Test on 2-3 PRs, give feedback
- Ideal: Teams of 2-5 devs using GitHub


What I need from you:
- 30 mins total time (install + test + feedback)
- Honest feedback (what works, what sucks)
- If you like it, a testimonial quote


Limitations (being transparent):
- No C/C++/Go/Rust support yet (roadmap Q1 2026)
- GitHub only (no GitLab/Bitbucket yet)
- EU hosting only (Vercel EU)
- Solo founder (just me, no 24/7 support)


Security/Privacy:
- Only reads PRs you approve (GitHub App permissions)
- Nothing stored long-term (analysis cached 24h max)
- GDPR compliant
- Open to security audit if anyone wants to review


Comment "interested" or DM me for beta access.

https://redd.it/1oq5zm1
@r_devops

How to Use OIDC to Give GitHub Actions Secure Access to AWS

i wrote about a step by step guide on setting up OIDC with github actions. you can read the full breakdown on linkedin

https://redd.it/1oq7ncn
@r_devops

Is This Worth It For A Brand New IT interested guy?

Hi, I am interested in getting into the DevOps world as I have links and people in my network who currently work directly as DevOps technicians or have other IT positions. I wanted to know if this degree will help me? It has promising things on the website, including an internship and I do know people who graduate from here get into a role much easier than just doing stuff by yourself and hoping for a role. https://madisoncollege.edu/academics/programs/cloud-support-associate

https://redd.it/1oq8u25
@r_devops

Game developing

If you’re working on a game but don’t have the skills to make it yet is it better to focus on writing down all your ideas for now?


https://redd.it/1oqajrx
@r_devops

Alternate to Chainguard libraries for Python

I recently came across this blog by Chainguard: Chainguard Libraries for Python Overview.

As both a developer and security professional I really appreciate artifact repositories that provide fully secured libraries with proper attestations, provenance and SBOMs. This significantly reduces the burden on security teams to remediate critical-to-low severity vulnerabilities in every library in every sprint or audit or maybe regularly

I've experienced this pain firsthand tbh so right now, I pull dependencies from PyPI and whenever a supply chain attack occurs and then I have to comb through entire SBOMs to identify affected packages and determine appropriate remediations. I need to assess whether the vulnerable dependencies actually pose a risk to my environment or if they just require minor upgrades for low-severity CVEs or version bumps. This becomes incredibly frustrating for both developers and security professionals.

Also i have observed a very very common pattern i.e., developers pull dependencies from global repositories like NPM and PyPI then either forget to upgrade them or face situations where packages are so tightly coupled that upgrading requires massive codebase changes often because newer versions introduce breaking changes or cause build failures.

Chainguard Libraries for Python address these issues by shipping packages securely with proper attestations and provenance. Their Python images are CVE-free, and their patching process is streamlined. My Question is I'm looking for less expensive or open-source alternatives to Chainguard Libraries for Python that I can implement for my team (especially python developers) and use to benchmark our current SCA process.

Does anyone have recommendations or resources for open-source alternatives that provide similar security guarantees?

https://redd.it/1oqcomb
@r_devops

Any warp alternative?

I have been using warp for a year now and and for $20 a month I used to get 2500 AI credits that used to be enough for me but now they decide to go goblin mode and for $20 a month they give 1500 credits and extra 1000 credits cost extra $20. And I fell the credits burn faster too, so can you guys suggest me a good alternative?

https://redd.it/1oqedgk
@r_devops

Does anyone integrate real exploit intelligence into their container security strategy?

We're drowning in CVE noise across our container fleet. Getting alerts on thousands of vulns but most aren't actively exploited in the wild.

Looking for approaches that prioritize based on actual exploit activity rather than just CVSS scores. Are teams using threat intel feeds, CISA KEV, or other sources to filter what actually needs immediate attention?

Our security team wants everything patched yesterday but engineering bandwidth is finite. Need to focus on what's actually being weaponized.

What's worked for you?



https://redd.it/1oqbsfz
@r_devops

System design interviews for SRE prep help

Hi All,


I have an upcoming system design interview which is based on SRE and I'm really struggling to prepare on it. There are so many resources out there that I have used like hello interview previously but they have absolutely zero on SRE. I've been informed this is a system design prompt on cloud agnostic architecture and I have no idea if that means I will not only do the traditional system design along with doing the cloud infra e.g. no more of that whiteboarding an API Gateway/Load Balancer in the same box, now they absolutely must be separated with the flow clearly explained - or if now I basically put the actual service in a similar little box whilst drafting the cloud architecture around it.

Has anyone had anything similar? Any resources for this?

https://redd.it/1oqgilr
@r_devops

SRE SE Interview at Google - Help Appreciated

# I got a phone screen in few weeks time, and it is a practical coding/noscripting round. Anyone here interviewed for this role?

Prep guide does mention it’s not algorithmically complex, but I’ll need familiarity with basic DSA like hash tables, trees, recursion and linked lists

If anyone interviewed for SE SRE, can you share how you prepped for this round? Is there any problem-set that i can look at online to practice such questions? I tried looking online, but very limited info for SE role.

https://redd.it/1oqfod1
@r_devops

Experimenting with AI for sprint management?

Has anyone tried using AI tools to help with sprint planning, retrospectives, or other agile ceremonies? Most tools just seem like glorified assistants but wondering if anyone's found something actually useful.

https://redd.it/1oqdvqy
@r_devops