Best option for Deploying on NodeJS runtime
Need to get a NextJS app online, which is best to pay for:
Cant go cloudflare pages because no nodejs runtime support and I need nodejs runtime for some prisma stuff on the server & some other apis not available in edge runtime
Vercel (cant go free cuz org)
Rawdog AWS
sst.dev
Some other option ??
https://redd.it/1k3rny3
@r_devops
Need to get a NextJS app online, which is best to pay for:
Cant go cloudflare pages because no nodejs runtime support and I need nodejs runtime for some prisma stuff on the server & some other apis not available in edge runtime
Vercel (cant go free cuz org)
Rawdog AWS
sst.dev
Some other option ??
https://redd.it/1k3rny3
@r_devops
SST
DevOps engineer roadmap
Hello guys i hope y'all doing well i have a question regarding DevOps i want to be a devops engineer but I don't know exactly where to start i work as a noc Engineer most of my works is monitoring servers and enterprise applications and network devices i want to hope on DevOps from your experience where someone can start thank you in advance
https://redd.it/1k3sckr
@r_devops
Hello guys i hope y'all doing well i have a question regarding DevOps i want to be a devops engineer but I don't know exactly where to start i work as a noc Engineer most of my works is monitoring servers and enterprise applications and network devices i want to hope on DevOps from your experience where someone can start thank you in advance
https://redd.it/1k3sckr
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community
Quick question
I’m currently deploying a PHP project on DigitalOcean App Platform and using PHPMailer to send emails via smtp.gmail.com on port 587 (TLS). I wanted to ask if anyone here has experience with this setup:
Does DigitalOcean App Platform’s networking/firewall configuration allow outbound SMTP connections on port 587?
Or does it block these requests by default for security reasons?
I’ve seen some hosting providers restrict outbound SMTP ports to prevent spam abuse, so I’d appreciate any confirmation or suggestions on how to properly configure this if it’s allowed.
Thank you in advance.
https://redd.it/1k3rk5g
@r_devops
I’m currently deploying a PHP project on DigitalOcean App Platform and using PHPMailer to send emails via smtp.gmail.com on port 587 (TLS). I wanted to ask if anyone here has experience with this setup:
Does DigitalOcean App Platform’s networking/firewall configuration allow outbound SMTP connections on port 587?
Or does it block these requests by default for security reasons?
I’ve seen some hosting providers restrict outbound SMTP ports to prevent spam abuse, so I’d appreciate any confirmation or suggestions on how to properly configure this if it’s allowed.
Thank you in advance.
https://redd.it/1k3rk5g
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community
Suggestions for my Devops youtube channel
Hey folks, I have 10+ years exp in sys admin and devops. Started recently live sessions in zoom with few of interested (~10) folks and uploading recorded session to YouTube.
Recently covered intro to devops and Linux 101 basics. Networking, git, CICD, docker, cloud, monitoring, K8s and so on. And live debug sessions and RCA for famous outages incident notes. Planning to go for 6 months to 1 year in path. Once settled , planning to make proper video content and latest devops(tech) updates n so on.
Looking for suggestions if I am going in right path.Feedback is welcome.
https://youtube.com/@devopsdattu
https://redd.it/1k3vlqo
@r_devops
Hey folks, I have 10+ years exp in sys admin and devops. Started recently live sessions in zoom with few of interested (~10) folks and uploading recorded session to YouTube.
Recently covered intro to devops and Linux 101 basics. Networking, git, CICD, docker, cloud, monitoring, K8s and so on. And live debug sessions and RCA for famous outages incident notes. Planning to go for 6 months to 1 year in path. Once settled , planning to make proper video content and latest devops(tech) updates n so on.
Looking for suggestions if I am going in right path.Feedback is welcome.
https://youtube.com/@devopsdattu
https://redd.it/1k3vlqo
@r_devops
YouTube
Devops with Dattu
Welcome to Devops with Dattu. Thank you for checking out my channel.
I am Sasi Datta Bitra, Sr. Devops Engineer with over 7+ years of experience. I started my journey as Application support Engineer.
I would like to teach and help of Devops and cloud to…
I am Sasi Datta Bitra, Sr. Devops Engineer with over 7+ years of experience. I started my journey as Application support Engineer.
I would like to teach and help of Devops and cloud to…
Deploying AWS Bedrock via Terraform
Deploying AWS Bedrock via Terraform isn’t exactly plug-and-play. When I first started building with Bedrock, I assumed it would be just like any other managed AWS service, pretty quick to deploy and easy to get up and running but that wasn’t quite the case.
Infrastructure as Code isn't just about managing VMs, databases or Kubernetes clusters anymore, it is also applicable for Gen AI. So here are few things that I observed and learnt during the setup process which hopefully benefits anyone else also looking to manage their Gen AI Infrastructure on AWS via Terraform.
1. Model Access isn’t automatic, even after setting up the correct set of IAM roles and policies with Terraform, calls to Bedrock models returned 403s. It took some digging to realize that model access needs to be manually requested in the AWS Console. There were no obvious error messages to guide you.
2. Not every model is available in every region. What worked in us-east-1 failed silently in us-west-2 because the model wasn’t supported there. This isn’t well-documented up front. I had to dig around AWS Bedrock service quotas to figure this out.
3. Bedrock doesn’t offer usage caps or rate limit alerts by default. So tracking usage via CloudWatch is essential to avoid surprises. I would recommend setting up alarms on the token usage of the foundational models to avoid unexpected charges.
If you want to learn more about provisioning and managing AWS Bedrock infra via Terraform then drop a comment or DM me and I will share link to my YouTube channel where I walk through it.
https://redd.it/1k3xspu
@r_devops
Deploying AWS Bedrock via Terraform isn’t exactly plug-and-play. When I first started building with Bedrock, I assumed it would be just like any other managed AWS service, pretty quick to deploy and easy to get up and running but that wasn’t quite the case.
Infrastructure as Code isn't just about managing VMs, databases or Kubernetes clusters anymore, it is also applicable for Gen AI. So here are few things that I observed and learnt during the setup process which hopefully benefits anyone else also looking to manage their Gen AI Infrastructure on AWS via Terraform.
1. Model Access isn’t automatic, even after setting up the correct set of IAM roles and policies with Terraform, calls to Bedrock models returned 403s. It took some digging to realize that model access needs to be manually requested in the AWS Console. There were no obvious error messages to guide you.
2. Not every model is available in every region. What worked in us-east-1 failed silently in us-west-2 because the model wasn’t supported there. This isn’t well-documented up front. I had to dig around AWS Bedrock service quotas to figure this out.
3. Bedrock doesn’t offer usage caps or rate limit alerts by default. So tracking usage via CloudWatch is essential to avoid surprises. I would recommend setting up alarms on the token usage of the foundational models to avoid unexpected charges.
If you want to learn more about provisioning and managing AWS Bedrock infra via Terraform then drop a comment or DM me and I will share link to my YouTube channel where I walk through it.
https://redd.it/1k3xspu
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community
Looking for advice to devops career in a start up company
Hi Everyone!
I am a senior CS graduate from school last year, and working in a Fin Start up company now. Although I am grateful to get the job with a chance to work with AWS and other kind of scripting thing, just want to get some advice to my next step and hopefully i could jump into a junior devops/platform like role in the next year.
Before my CS degree, i was a help desk in a international company, who force on support and coordinated infrastructure delivery. I quit my job and back to school for a proper CS degree. Since I feel like I can't just lie down and die here., and there is a big technical gap between us with other tech team, which create a cliff of internal mobility.
Back to now, i am working in a Fin Start up company who have history with less than a year as a support engineer. The good side of the company is they always lack of hands to work, there for I could shack into many places to learn and touch with real infrastructure stuff (like touch to AWS and CLI) and develop some script for helping my work (i.e. setup windows account and computer with powershell, prepare a .csv file and upload it to S3 bucket with python etc,). Although I am still cannot write a script right away, I start getting the concept about this.
Currently, I am doing my AWS SAA-C03 and hopefully I could completed this next month. However, I am not sure about my next step afterward. I like automation, but not a fan to cloud although I agree it is a useful technology and willing to learn about this. From my research on internet,
I should learn Terraform, Ansible, Docker, CI/CD (like git action), Grafana, properly AWS devops Associate also. But they looks a huge amount of content,...May i have some advice where should I start please? Or should I start with some course (like Udemy / KodeKloud / https://github.com/100daysofdevops/100daysofdevops) to learn about the basic first?
Is there any suggest that I could try to explore more in my current workplace please?
Thank you!
https://redd.it/1k41bna
@r_devops
Hi Everyone!
I am a senior CS graduate from school last year, and working in a Fin Start up company now. Although I am grateful to get the job with a chance to work with AWS and other kind of scripting thing, just want to get some advice to my next step and hopefully i could jump into a junior devops/platform like role in the next year.
Before my CS degree, i was a help desk in a international company, who force on support and coordinated infrastructure delivery. I quit my job and back to school for a proper CS degree. Since I feel like I can't just lie down and die here., and there is a big technical gap between us with other tech team, which create a cliff of internal mobility.
Back to now, i am working in a Fin Start up company who have history with less than a year as a support engineer. The good side of the company is they always lack of hands to work, there for I could shack into many places to learn and touch with real infrastructure stuff (like touch to AWS and CLI) and develop some script for helping my work (i.e. setup windows account and computer with powershell, prepare a .csv file and upload it to S3 bucket with python etc,). Although I am still cannot write a script right away, I start getting the concept about this.
Currently, I am doing my AWS SAA-C03 and hopefully I could completed this next month. However, I am not sure about my next step afterward. I like automation, but not a fan to cloud although I agree it is a useful technology and willing to learn about this. From my research on internet,
I should learn Terraform, Ansible, Docker, CI/CD (like git action), Grafana, properly AWS devops Associate also. But they looks a huge amount of content,...May i have some advice where should I start please? Or should I start with some course (like Udemy / KodeKloud / https://github.com/100daysofdevops/100daysofdevops) to learn about the basic first?
Is there any suggest that I could try to explore more in my current workplace please?
Thank you!
https://redd.it/1k41bna
@r_devops
GitHub
GitHub - 100daysofdevops/100daysofdevops
Contribute to 100daysofdevops/100daysofdevops development by creating an account on GitHub.
Do devs really value soft skills or is everyone just an 'antisocial genius'?
Good night, sub!
I'm a Computer Science student, and while I break my back learning frameworks and fixing a million bugs, I keep wondering: does the market actually expect us to be just coding machines?
I see tons of memes about devs who can’t communicate, meetings that turn into nightmares, and code reviews that feel like ego wars.
My existential doubts:
1. In practice, is a junior who asks a lot of questions seen as “incompetent”?
Or does asking clear questions help avoid massive screw-ups later?
2. Are code reviews technical discussions or just competitions to see who knows more?
I've heard stories of people taking “feedback” as personal attacks.
3. Does the myth of the “introverted dev who just codes” still exist?
Or are companies actually looking for people who can truly work in teams?
A scary example:
A friend of mine, who's an intern, was criticized for “talking too much” in a meeting (he just wanted to confirm the requirements before coding). That same day, another dev submitted super buggy code, but since it was done fast, no one complained.
Questions for those already in the field:
Startups vs. big companies: Which tends to value communication more?
Remote work: If you're not good at expressing yourself through text/calls, are you screwed?
Real advice: What can an intern/junior actually do to improve soft skills?
Note: If this sounds too “naive student,” feel free to say so. But I need honest answers before the market crushes me.
https://redd.it/1k40stq
@r_devops
Good night, sub!
I'm a Computer Science student, and while I break my back learning frameworks and fixing a million bugs, I keep wondering: does the market actually expect us to be just coding machines?
I see tons of memes about devs who can’t communicate, meetings that turn into nightmares, and code reviews that feel like ego wars.
My existential doubts:
1. In practice, is a junior who asks a lot of questions seen as “incompetent”?
Or does asking clear questions help avoid massive screw-ups later?
2. Are code reviews technical discussions or just competitions to see who knows more?
I've heard stories of people taking “feedback” as personal attacks.
3. Does the myth of the “introverted dev who just codes” still exist?
Or are companies actually looking for people who can truly work in teams?
A scary example:
A friend of mine, who's an intern, was criticized for “talking too much” in a meeting (he just wanted to confirm the requirements before coding). That same day, another dev submitted super buggy code, but since it was done fast, no one complained.
Questions for those already in the field:
Startups vs. big companies: Which tends to value communication more?
Remote work: If you're not good at expressing yourself through text/calls, are you screwed?
Real advice: What can an intern/junior actually do to improve soft skills?
Note: If this sounds too “naive student,” feel free to say so. But I need honest answers before the market crushes me.
https://redd.it/1k40stq
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community
Looking for an active community to upskill together with
Hi all, I am working as a DBA in a company in an internship plus am looking to get into DevOps whilst not loosing touch with my Backend Development. I am looking for communities that can help me grow as in guidance from seniors, peers to work on projects with, sharing job opportunities and other such things. Please help me find such communities thnx
https://redd.it/1k44y71
@r_devops
Hi all, I am working as a DBA in a company in an internship plus am looking to get into DevOps whilst not loosing touch with my Backend Development. I am looking for communities that can help me grow as in guidance from seniors, peers to work on projects with, sharing job opportunities and other such things. Please help me find such communities thnx
https://redd.it/1k44y71
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community
I used to spin up full-blown VMs for everything… until Docker changed my brain.
Back when I started out, deploying even the smallest app meant:
1. Launching a fresh VM
2. Installing dependencies manually
3. Praying I didn't break the prod box
I didn’t “get” containers. Why bother when VMs work just fine?
Then one day I saw a tiny Dockerfile build a Python app in seconds… and run it without touching the host. No more dependency hell. No more “it works on my machine”. Just build, run, repeat.
It clicked.
Since then, Docker became my go-to for local dev, testing, and deployment.
I recently wrote a beginner-friendly post as part of a 60Days60Blogs ReadList series I’m writing to simplify Docker & Kubernetes, one post at a time. This is ReadList 1 and What's inside:
1. What Virtual Machines actually are
2. How Containers changed the game
3. What Docker really does behind the scenes
4. The Dockerfile → Registry → Run flow (in human terms)
If you're early in your DevOps journey (or mentoring someone who is), I think this might help:
Read: Build, Ship, Run: Why Docker Changed the Game for Developers
What helped you when learning Docker for the first time?
https://redd.it/1k47nr9
@r_devops
Back when I started out, deploying even the smallest app meant:
1. Launching a fresh VM
2. Installing dependencies manually
3. Praying I didn't break the prod box
I didn’t “get” containers. Why bother when VMs work just fine?
Then one day I saw a tiny Dockerfile build a Python app in seconds… and run it without touching the host. No more dependency hell. No more “it works on my machine”. Just build, run, repeat.
It clicked.
Since then, Docker became my go-to for local dev, testing, and deployment.
I recently wrote a beginner-friendly post as part of a 60Days60Blogs ReadList series I’m writing to simplify Docker & Kubernetes, one post at a time. This is ReadList 1 and What's inside:
1. What Virtual Machines actually are
2. How Containers changed the game
3. What Docker really does behind the scenes
4. The Dockerfile → Registry → Run flow (in human terms)
If you're early in your DevOps journey (or mentoring someone who is), I think this might help:
Read: Build, Ship, Run: Why Docker Changed the Game for Developers
What helped you when learning Docker for the first time?
https://redd.it/1k47nr9
@r_devops
Medium
Build, Ship, Run: Why Docker Changed the Game for Developers
Wait! Why Use Docker When You Have Virtual Machines? Here’s the Real Difference”, ReadList 1.
How are you managing increasing AI/ML pipeline complexity with CI/CD?
As more teams in my org are integrating AI/ML models into production, our CI/CD pipelines are becoming increasingly complex. We're no longer just deploying apps — we’re dealing with:
Versioning large models (which don’t play nicely with Git)
Monitoring model drift and performance in production
Managing GPU resources during training/deployment
Ensuring security & compliance for AI-based services
Traditional DevOps tools seem to fall short when it comes to ML-specific workflows, especially in terms of observability and governance. We've been evaluating tools like MLflow, Kubeflow, and Hugging Face Inference Endpoints, but integrating these into a streamlined, reliable pipeline feels... patchy. Here are my questions:
1. How are you evolving your CI/CD practices to handle ML workloads in production?
2. Have you found an efficient way to automate monitoring/model re-training workflows with GenAI in mind?
3. Any tools, patterns, or playbooks you’d recommend?
Thank you for the help in advance.
https://redd.it/1k474mn
@r_devops
As more teams in my org are integrating AI/ML models into production, our CI/CD pipelines are becoming increasingly complex. We're no longer just deploying apps — we’re dealing with:
Versioning large models (which don’t play nicely with Git)
Monitoring model drift and performance in production
Managing GPU resources during training/deployment
Ensuring security & compliance for AI-based services
Traditional DevOps tools seem to fall short when it comes to ML-specific workflows, especially in terms of observability and governance. We've been evaluating tools like MLflow, Kubeflow, and Hugging Face Inference Endpoints, but integrating these into a streamlined, reliable pipeline feels... patchy. Here are my questions:
1. How are you evolving your CI/CD practices to handle ML workloads in production?
2. Have you found an efficient way to automate monitoring/model re-training workflows with GenAI in mind?
3. Any tools, patterns, or playbooks you’d recommend?
Thank you for the help in advance.
https://redd.it/1k474mn
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community
Will WSL Perform Better Than a VM on My Low-End Laptop?
Here are my device specifications:
- Processor: Intel(R) Core(TM) i3-4010U @ 1.70GHz
- RAM: 8 GB
- GPU: AMD Radeon R5 M230 (VRAM: 2 GB)
I tried running Ubuntu in a virtual machine, but it was really slow. So now I'm wondering: if I use WSL instead, will the performance be better and more usable? I really don't like using dual boot setups.
I mainly want to use Linux for learning data engineering and DevOps.
https://redd.it/1k4aaaz
@r_devops
Here are my device specifications:
- Processor: Intel(R) Core(TM) i3-4010U @ 1.70GHz
- RAM: 8 GB
- GPU: AMD Radeon R5 M230 (VRAM: 2 GB)
I tried running Ubuntu in a virtual machine, but it was really slow. So now I'm wondering: if I use WSL instead, will the performance be better and more usable? I really don't like using dual boot setups.
I mainly want to use Linux for learning data engineering and DevOps.
https://redd.it/1k4aaaz
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community
Tutorial - expose local dev server with SSH tunnel and Docker
Hello everyone.
In development, we often need to share a preview of our current local project, whether to show progress, collaborate on debugging, or demo something for clients or in meetings. This is especially common in remote work settings.
There are tools like ngrok and localtunnel, but the limitations of their free plans can be annoying in the long run. So, I created my own setup with an SSH tunnel running in a Docker container, and added Traefik for HTTPS to avoid asking non-technical clients to tweak browser settings to allow insecure HTTP requests.
I documented the entire process in the form of a practical tutorial guide that explains the setup and configuration in detail. My Docker configuration is public and available for reuse, the containers can be started with just a few commands. You can find the links in the article.
Here is the link to the article:
https://nemanjamitic.com/blog/2025-04-20-ssh-tunnel-docker
I would love to hear your feedback, let me know what you think. Have you made something similar yourself, have you used a different tools and approaches?
https://redd.it/1k4bgni
@r_devops
Hello everyone.
In development, we often need to share a preview of our current local project, whether to show progress, collaborate on debugging, or demo something for clients or in meetings. This is especially common in remote work settings.
There are tools like ngrok and localtunnel, but the limitations of their free plans can be annoying in the long run. So, I created my own setup with an SSH tunnel running in a Docker container, and added Traefik for HTTPS to avoid asking non-technical clients to tweak browser settings to allow insecure HTTP requests.
I documented the entire process in the form of a practical tutorial guide that explains the setup and configuration in detail. My Docker configuration is public and available for reuse, the containers can be started with just a few commands. You can find the links in the article.
Here is the link to the article:
https://nemanjamitic.com/blog/2025-04-20-ssh-tunnel-docker
I would love to hear your feedback, let me know what you think. Have you made something similar yourself, have you used a different tools and approaches?
https://redd.it/1k4bgni
@r_devops
Nemanjamitic
Expose local dev server with SSH tunnel and Docker - Nemanja Mitic
A practical example how to temporarily expose your local service to the internet.
I've taken the last 2 years off, what have I missed?
What's been going on since spring 2023? What have I missed?
https://redd.it/1k4g29o
@r_devops
What's been going on since spring 2023? What have I missed?
https://redd.it/1k4g29o
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community
A practical guide to building agents
https://cdn.openai.com/business-guides-and-resources/a-practical-guide-to-building-agents.pdf
https://redd.it/1k4gntq
@r_devops
https://cdn.openai.com/business-guides-and-resources/a-practical-guide-to-building-agents.pdf
https://redd.it/1k4gntq
@r_devops
What do you use to monitor performance on a Swarm Cluster?
Hi everyone,
I've recently deployed several services to a Swarm cluster running in an on-premise data center (this organization doesn't use any cloud services at all). For monitoring, I'm currently using a combination of cAdvisor, Node Exporter, Prometheus, and Grafana to track performance at both the node and container levels and so far its been working just fine.
Since I'm fairly new to the world of DevOps, I'm curious — what monitoring stack or solution do you use for production performance monitoring?
https://redd.it/1k4if71
@r_devops
Hi everyone,
I've recently deployed several services to a Swarm cluster running in an on-premise data center (this organization doesn't use any cloud services at all). For monitoring, I'm currently using a combination of cAdvisor, Node Exporter, Prometheus, and Grafana to track performance at both the node and container levels and so far its been working just fine.
Since I'm fairly new to the world of DevOps, I'm curious — what monitoring stack or solution do you use for production performance monitoring?
https://redd.it/1k4if71
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community
Timoni/Cuelang Kubernetes master templates
Because Cuelang unification is associative, commutative and idempotent which makes the order irrelevant I wonder if anyone (or Timoni) has created a set of generic Kubernetes templates for the default and/or most used objects?.
I have my own templates but I wonder if there's someone doing a better approach on this.
My current paradigm is:
The values files tend to be repetitive. Setting namespaces, name, additional labels, annotations, containers[\] values, volumes, etc.
The good thing about Cue is that I can just patch any part of the schema with the values that I need and not to worry of knowing if there's a stupid conditional with a custom variable name that might or might not have a default value somewhere other template engines do and if there is it will complain a lot when evaluated pointing exactly where the issue is.
#
https://redd.it/1k4jkrf
@r_devops
Because Cuelang unification is associative, commutative and idempotent which makes the order irrelevant I wonder if anyone (or Timoni) has created a set of generic Kubernetes templates for the default and/or most used objects?.
I have my own templates but I wonder if there's someone doing a better approach on this.
My current paradigm is:
templates/: abstract k8s.cue that contains object schemas and constraints. I also reference values from a values file where I load specific data.values/${env}/${service}/${service.}.cue: I try to avoid (unsuccessfully) using custom variables as I want to keep myself on the mental model of the object schema.templates/${services}/k8s.cue: This is specific definition which at this point I believe I can avoid. More and more I feel the values file and the service template directory overlaps as I try to keep the same object schema but it requires having a better generic system.The values files tend to be repetitive. Setting namespaces, name, additional labels, annotations, containers[\] values, volumes, etc.
The good thing about Cue is that I can just patch any part of the schema with the values that I need and not to worry of knowing if there's a stupid conditional with a custom variable name that might or might not have a default value somewhere other template engines do and if there is it will complain a lot when evaluated pointing exactly where the issue is.
#
https://redd.it/1k4jkrf
@r_devops
Cuetorials
Foundations | Overview | Cuetorials
Foundations for Cue
HOWTO DAST in DevOps ?
I've recently started working in a DevOps role at my organization and my first task is to implement DAST (Dynamic Application Security Testing) in the existing CI/CD pipeline. I've mostly covered the SAST part by integrating tools like Semgrep, Snyk, Gitleaks, and DefectDojo/Dependency-Track.
However, I'm a bit unsure about how to move forward with implementing DAST, especially since our environment only involves APIs and no web applications. For now, I've chosen Nuclei and written a script to perform DAST using the default Nuclei templates..
There's also a requirement to create custom Nuclei templates for various API related attacks. This part is a bit overwhelming for me tbh, given the vast number of potential attack vectors for APIs. I suggested an alternative approach like cloning GitHub repositories that contain community contributed Nuclei templates and then categorising them based on the OWASP API Top 10 but again this segregation process is time consuming.
I came across a blog where Burp Suite was recommended for API DAST. Since most of our infrastructure is cloud-based, so I was wondering if it is possible to run Burp Suite in the cloud for automated DAST on APIs? It might sound like a noob question but I'm genuinely unsure about how to set that up.
Does anyone have suggestions on how to implement DAST either as part of the CI/CD pipeline or as a standalone workflow?
https://redd.it/1k4ljpx
@r_devops
I've recently started working in a DevOps role at my organization and my first task is to implement DAST (Dynamic Application Security Testing) in the existing CI/CD pipeline. I've mostly covered the SAST part by integrating tools like Semgrep, Snyk, Gitleaks, and DefectDojo/Dependency-Track.
However, I'm a bit unsure about how to move forward with implementing DAST, especially since our environment only involves APIs and no web applications. For now, I've chosen Nuclei and written a script to perform DAST using the default Nuclei templates..
There's also a requirement to create custom Nuclei templates for various API related attacks. This part is a bit overwhelming for me tbh, given the vast number of potential attack vectors for APIs. I suggested an alternative approach like cloning GitHub repositories that contain community contributed Nuclei templates and then categorising them based on the OWASP API Top 10 but again this segregation process is time consuming.
I came across a blog where Burp Suite was recommended for API DAST. Since most of our infrastructure is cloud-based, so I was wondering if it is possible to run Burp Suite in the cloud for automated DAST on APIs? It might sound like a noob question but I'm genuinely unsure about how to set that up.
Does anyone have suggestions on how to implement DAST either as part of the CI/CD pipeline or as a standalone workflow?
https://redd.it/1k4ljpx
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community
Am I a good fit to transition into a DevOps role with my current background?
Hey everyone,
I’m interested in transitioning into a DevOps role and wanted to get some insight from professionals already in the field. I’d really appreciate any feedback on whether my background and experience align well with DevOps, and what I should focus on next.
Here’s a summary of my background:
• 2.5 years of experience in IT support / sysadmin roles, handling user accounts, managing servers, basic networking, scripting tasks, and general troubleshooting.
• 1.5 years as a full-stack web and mobile developer, building and maintaining web apps, REST APIs, and mobile apps.
• Current responsibilities also include:
• Light CI/CD work (setting up pipelines using GitHub Actions and scripting basic automation tasks).
• Exposure to Docker (creating Dockerfiles, containerizing apps for dev/test environments).
• Working with AWS EC2 and RDS for hosting web apps and APIs.
• Occasional DBA tasks (MySQL).
I’m comfortable with the command line, scripting (Bash/Node.js), and understand how modern web applications are built and deployed. I’ve also worked with Linux servers fairly extensively.
My goal is to grow into a DevOps role full time — eventually aiming to work with Kubernetes, Terraform, and cloud infrastructure more deeply.
Based on this, do you think I’m a good candidate to pivot into DevOps? Are there specific skills or projects you’d recommend I tackle to be a stronger candidate for entry- to mid-level DevOps positions? I'm currently studying the tools used in DevOps.
Thanks in advance!
https://redd.it/1k4p1z4
@r_devops
Hey everyone,
I’m interested in transitioning into a DevOps role and wanted to get some insight from professionals already in the field. I’d really appreciate any feedback on whether my background and experience align well with DevOps, and what I should focus on next.
Here’s a summary of my background:
• 2.5 years of experience in IT support / sysadmin roles, handling user accounts, managing servers, basic networking, scripting tasks, and general troubleshooting.
• 1.5 years as a full-stack web and mobile developer, building and maintaining web apps, REST APIs, and mobile apps.
• Current responsibilities also include:
• Light CI/CD work (setting up pipelines using GitHub Actions and scripting basic automation tasks).
• Exposure to Docker (creating Dockerfiles, containerizing apps for dev/test environments).
• Working with AWS EC2 and RDS for hosting web apps and APIs.
• Occasional DBA tasks (MySQL).
I’m comfortable with the command line, scripting (Bash/Node.js), and understand how modern web applications are built and deployed. I’ve also worked with Linux servers fairly extensively.
My goal is to grow into a DevOps role full time — eventually aiming to work with Kubernetes, Terraform, and cloud infrastructure more deeply.
Based on this, do you think I’m a good candidate to pivot into DevOps? Are there specific skills or projects you’d recommend I tackle to be a stronger candidate for entry- to mid-level DevOps positions? I'm currently studying the tools used in DevOps.
Thanks in advance!
https://redd.it/1k4p1z4
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community
AWS Shield Advanced vs UDP flooding
Anyone here has experience with Shield Advanced mitigating UDP attacks? I'm talking at least 10Gbps / 10mil pps and higher.
We've exhausted our other options - not even big bare metal / network-optimized instances with an eBPF XDP program configured to drop all packets for the port that's under attack helped (and the program itself indeed works), the instance still loses connectivity after a minute or two and our service struggles. Seems to me we'll have to pony up the big money and use Shield Advanced-protected EIPs.
Amy useful info is appreciated - how fast are the attacks detected and mitigated (yeah I've read the docs)? Is it close to 100% effectiveness? Etc.
https://redd.it/1k4pdtj
@r_devops
Anyone here has experience with Shield Advanced mitigating UDP attacks? I'm talking at least 10Gbps / 10mil pps and higher.
We've exhausted our other options - not even big bare metal / network-optimized instances with an eBPF XDP program configured to drop all packets for the port that's under attack helped (and the program itself indeed works), the instance still loses connectivity after a minute or two and our service struggles. Seems to me we'll have to pony up the big money and use Shield Advanced-protected EIPs.
Amy useful info is appreciated - how fast are the attacks detected and mitigated (yeah I've read the docs)? Is it close to 100% effectiveness? Etc.
https://redd.it/1k4pdtj
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community
Which CaC tool to learn
Hello r/devops! I have just a quick question. How do you know which CaC tool to learn? Will learning one make it easier to know them all if you run into another one? I want to start with Ansible but my knowledge on Linux is limited. Is Chef and Puppet viable tools to learn instead?
https://redd.it/1k4ibay
@r_devops
Hello r/devops! I have just a quick question. How do you know which CaC tool to learn? Will learning one make it easier to know them all if you run into another one? I want to start with Ansible but my knowledge on Linux is limited. Is Chef and Puppet viable tools to learn instead?
https://redd.it/1k4ibay
@r_devops
Reddit
From the devops community on Reddit
Explore this post and more from the devops community