Planning an EU launch. Looking for real-world GDPR implementation advice.

I'm currently leading the GDPR implementation for our company, and honestly, the deeper we get into it, the more I realize how much there is to do.

Our platform wasn't originally built with GDPR in mind. Right now our primary database is in Australia, and we serve customers in multiple countries from the same infrastructure. As we're planning an EU launch, we're now figuring out what needs to change to become GDPR compliant.

Initially, I thought this would mostly be about infrastructure and documentation, but it's becoming clear that there are quite a few application-level changes as well. It's made me realize that if there's even a chance your product will serve EU users in the future, it's probably worth considering GDPR from day one rather than trying to retrofit it later.

For those who've actually implemented GDPR, I'd love to hear about your experience.

Some things I'm curious about:

What ended up being the hardest part?
Was it more of a legal/compliance challenge or a technical one?
Did you end up redesigning your architecture?
Did you create a separate AWS account or separate EU infrastructure, or keep everything in the same account?
How did you handle data residency and cross-border data transfers?
If your database was already in another region, did you migrate it or keep it where it was?
How did you handle backups when users requested data deletion?
Were there any code changes that surprised you?
Did any third-party services become a problem?
Did you use tools like CompAI, Vanta, Drata, or Secureframe? Were they worth it?
If you have a single admin portal managing multiple regions (US, AU, CA, EU), how did you handle access to EU customer data? Did you keep one global admin system with role-based access, or did you separate access by region (e.g., EU admins only seeing EU data)? How did you handle this in practice?
Looking back, what do you wish you'd known before starting?

I'm basically looking for the "I wish someone had told me this before we started" kind of advice.

If you've been through a GDPR implementation and wouldn't mind answering a few questions, please leave a comment or send me a DM.

https://redd.it/1v7qey5
@r_devops

Alternatives to Kubernetes for medium-sized organizations?

Kubernetes is a great platform, but it can be expensive and may be more than what’s needed for many medium-sized organizations.

What are the common alternatives being used in production?

Interested in hearing what solutions have worked well in real-world environments and the reasons behind those choices.

https://redd.it/1v7u665
@r_devops

Automated my tech support / investigation workflow using CLI, MCPs, and custom subagents. Here is the architecture.

**Hey everyone,**

Quick workflow showcase/idea for anyone who gets enterprise access to AI CLIs at work (Gemini CLI, Claude Code, etc.) and still finds themselves manually jumping between tools during investigations or routine support tasks.

I recently set up a workflow that basically turns my CLI into an automated agent that runs investigations for me. If you have enterprise access and tool integrations available, you’re missing out if you aren't doing this.

# The Setup:

1. **CLI + Enterprise Access:** Using the company-provided enterprise CLI directly in the terminal.
2. **MCP (Model Context Protocol) Integration:** Connected the CLI to the actual operational and diagnostic tools used daily (monitoring, databases, logs, ticketing APIs, etc.).
3. **Custom Subagents & Commands:** Built specific subagent prompts and custom CLI commands tailored to my precise, repetitive investigation steps.

# How it works in practice:

Instead of manually opening 4 tabs, running 3 queries, and checking status logs when an issue comes up:

1. I trigger a custom slash command or alias in my CLI.
2. The subagent kicks off, uses the connected MCP tools to pull relevant context, inspect logs, run diagnostic checks, and correlate data.
3. It hands back a summarized breakdown of what happened, root cause hypotheses, and recommended next steps.

# Why do this?

* **Zero Context Switching:** You stay in the terminal.
* **No Manual Data Copy-Pasting:** The MCP server handles fetching real-time data securely.
* **Repeatable Process:** Standardized subagent prompts mean complex triage takes seconds instead of 20 minutes.

If your company already pays for enterprise CLI access and you're only using it to rewrite functions or explain error messages, **hook it up to your tools via MCPs**.

Curious if anyone else is running similar subagent setups in their terminal for operational work? What tools/MCPs are you chaining together?

https://redd.it/1v8bm5l
@r_devops

What is the change frequency rate for your org? How many deployments do you do on a daily, weekly, or monthly basis?

I have been bit hard in the past when joining an org that moved too slowly for my tastes. Took two weeks to get anything deployed, and if a deployment screwed up it was a rollback and two more weeks of waiting for a change request. I am very fond of this OG article about how quickly Etsy moved back in the day, and likely still to this day though I am sure the technology stack has shifted for them directly. Not sure if they ever did a followup on that post so wondering what change frequency looks for you all with modern tooling like Kubernetes and Docker in place?

https://redd.it/1v8bfpd
@r_devops

Expectations from devops engineer with 3 YOE in USA

Working as devops engineer from last 3 years in states, mostly work on windows stack, azure devops, yaml pipeline. Recently worked with setting up sonarqube & snyk for all teams & product across firm. Currently working in git migration and github actions. Planning to move back to india, what are the expectations for any senior roles as devops, cloud or platform engineer ? I know linux, kubernets and docker but they are more like tools.

https://redd.it/1v8boe6
@r_devops

Would you push back on this architecture decision?🤔

One of our clients wants to build a commercial web application on Red Hat JBoss and isn’t interested in moving to microservices or Kubernetes. We explained the potential benefits of modern architectures, but based on their previous experience, they still prefer a traditional JBoss-based approach.

The application is expected to handle a large number of users on a daily basis.
For those with experience running JBoss in production, how would you approach this? Is JBoss alone still a solid choice for a high-traffic system, and what challenges should be considered?

https://redd.it/1v8lrdh
@r_devops

What are your best tips for keeping AWS costs under control?

I’ve noticed that many AWS environments become increasingly expensive over time, and I’ve seen this firsthand as well.
One thing that helped was implementing cost allocation tags to better understand where the spending was coming from.
What other practices, tools, or strategies have worked well for keeping AWS costs under control?

https://redd.it/1v8lf4z
@r_devops

github actions central repo

Hi I am in a new role where they use Github for all their repos. I have been using Gitlab exlusively the past 5 years.


For CI/CD in my previous role we had a central 'pipelines' repo that was reference in the gitlab-ci file of each project to save teams/projects from repeating work.

I want to know if it's possible to do something similar in Github? I'm still learning how it maps to my existing Gitlab knowledge.

https://redd.it/1v8wshu
@r_devops

Need help regarding nfs-server service

So let me tell the context first, I have an kubernetes environment for production, and for like shared storage solution, I have installed nfs-utils and use the nfs-server service. In my scenario I cannot use cloud as an option. And for long I have been using the nfs-server but I have been facing alot of issues with it.
1. On multiple occasions I found dead or queued nfs processes in worker nodes which made the worker node totally unresponsive sys load was very high but low cpu and ram usage.
2. Something with the nfs4+ client where it uses session. On of the worker node again stopped responding, df -h was not responding rebooted the node still the same issue. And while viewing logs in the nfs node it stated nfsd was blocked and looking it up stated the thread on that worker node was locked due to unknown reason and all the requests from the worker node had just queued up. Restarting the service also hanged and needed to reboot the node itself to resolve the issue.

These are some major events there are also other small issues I have faced. I wanted to understand am I the only one facing these issues or this happens with others too, and what resolutions did you used to fix it? Like any alternative utilities and stuff

https://redd.it/1v8y29y
@r_devops

API returns 504 when I emulate phone in Firefox

I have a frontend/backend working fine when I use any browser.
When I emulate a phone in Chrome, it all works.
But any request to the backend as phone in Firefox returns 504 gateway timeout (instant response). The same request works fine in another tab.
Any idea what could it be?
I use istio for networking (virtual service + gateway). No special config, just routing to the k8s service.

https://redd.it/1v8vdq7
@r_devops

Need advice: Did I mess up my architecture? Also, Dokploy vs Coolify vs Komodo?

Hi everyone,

I'm looking for some honest feedback on my current self-hosted architecture. I have a feeling I may have made some poor design decisions, so I'd really appreciate suggestions on how to improve it.

Here's my current setup on AWS:

Frontend EC2: Two React applications (Admin & Tenant) deployed using a single Docker Compose file.

Backend EC2: Two Go API applications (Admin & Tenant) deployed using another Docker Compose file.

Core Services EC2: MySQL, Redis, Vault, Keycloak, and MinIO are all running on the same EC2 using a single Docker Compose file.

Analytics EC2: Apache Superset deployed using Docker Compose.

ETL EC2: Airbyte running via abctl (Kind/Kubernetes).

Everything is currently self-hosted on AWS EC2 instances.

I have a few questions:

Is this architecture reasonable, or did I mess it up?

What would you change or redesign if this were your production environment?

Should I split any of these services onto separate servers or use managed AWS services (such as RDS or ElastiCache)?

Would you recommend staying with Docker Compose, or is it worth moving to Kubernetes at this stage?

For managing deployments across these servers, which would you recommend: Dokploy, Coolify, or Komodo?

What I'm looking for in a deployment platform:

*Multi-server management

*Excellent Docker Compose support

*GitHub integration with automatic deployments

*Rollbacks, logs, and environment variable management

*Lightweight and stable

*Preferably fully open source

*Easy to maintain for a small DevOps team

If you've run a similar setup in production, I'd love to hear what worked well and what you'd do differently.

Thanks!

https://redd.it/1v97rw1
@r_devops

How your company handle AI data leaks ?

Hi everyone,

I was wondering : In the company where you're currently working, how does the IT guys (or you) manage the potential data leaks between employees and AI online agent like chatGTP, Claude or Gemini I mean, I live in Europe and we recently adopted some very restrictive laws regarding this topic and companies that are using AI,

was wondering how it was working and what are the solutions adopted in other companies ?

https://redd.it/1u91hc9
@r_devops

What do you do with CVEs you can't fix? Auditor wants proof they're 'not exploitable'

One-person security/platform team at a small fintech, going through SOC 2.

Patching what has a fix is fine. The problem is the stuff I can't fix, because there's no patched version, or the fix breaks something. Inspector/Trivy keeps flagging it, Vanta keeps showing it red, and technically every one needs a documented risk acceptance.

Most of these aren't even exploitable in our setup, sometimes it's a vulnerable function never called, transitive dep we don't use, requires network access that doesn't exist. But "trust me it's fine" doesn't fly, and writing a proper exception per CVE takes forever.

So, people who've been through this what do you actually show the auditor for "not exploitable"?

Is there a way to automate this discovery/evidence gathering?

Or does everyone just eat the busywork / quietly ignore them and pray?

https://redd.it/1v996vb
@r_devops

What makes test automation CI results trustworthy for devs

Setting up test automation in CI is easy, making devs look at and trust the results is the hard part
Coverage numbers that look great on paper but the team treats the test step like a formality because false positives trained them to ignore failures, its pavlovian at this point, test fails and everyone just hits retry without checking

https://redd.it/1v90nxe
@r_devops

Automated remediation through runbooks in prod does it actually work?

Curious how many of you have actually deployed automated runbooks for incident remediation — not just detection and alerting, but the full loop through to fix and close.

I've been building something in this space and want to understand how well it actually works for teams in practice. Do automated runbooks hold up in production, or do they break down on anything non-trivial?

What's your experience?

https://redd.it/1v9i52j
@r_devops

Should an AI security scanner be allowed to block CI, or only write a report?

I’m trying to draw a line around automated security scans in CI.

A read-only scan feels fine. If it finds a suspicious dependency, a broad permission, or a weird auth path, I want the report. I might even want it to draft a small PR.

The part that makes me nervous is when the same worker can change CI rules, mark a PR as failing, or "fix" security-sensitive code without a separate approval step. In one small project, I asked an agent to scan a dependency and config change. The report was useful, but I still did not want it editing the CI rule or auth code without me reading the diff first.

Maybe this is just normal branch protection with a new actor, but I’m curious how people handle it.

For security automation, do you separate "scan/report" from "block merge/change config"? And if you do, what evidence has to be attached to the approval?

https://redd.it/1v9hryk
@r_devops

Changing one thing about AI

I am "required" to use AI for coding, testing, debugging, terraform....and all the whole nine yards. Not too bad but too good either. Management is shoveling AI down our throats, so we have to use AI. If you can change one thing about AI to make your job easier, what would that be?

https://redd.it/1v9hpn3
@r_devops

is any one else bored of the various cloud providers. old man yells at clouds.

Am I just an old man yelling at clouds, or has DevOps become incredibly boring?

I know building technical solutions is not supposed to exist purely for my entertainment, but I do actually want to enjoy my job.

I am not currently working as a DevOps engineer, and one of the reasons I moved toward development was that I became completely bored with modern cloud infrastructure.

When I started, we still racked physical servers and automated the entire bare-metal imaging process. The underlying operating system mattered. We built systems by combining open-source software, custom code, and whatever hardware we could get our hands on. There was a real sense that we owned the systems we operated and understood how the pieces fit together.

Today, DevOps or platform engineering often, though certainly not always, seems to collapse into being a configuration monkey.

Yes, I still got to write plenty of tools and automation, but eventually I became tired of every architectural discussion turning into: “Should we use this AWS service or that AWS service?”

I became even more frustrated with managers and coworkers who did not really want to own or understand a service. They just wanted to hand as much of it as possible to the cloud provider and call the problem solved.

Do people genuinely enjoy the current state of what we used to call systems administration or systems engineering? Or am I just an old man yelling at clouds?

For what it is worth, I do find some salvation in Kubernetes. Once EKS or GKE is running, there is a huge amount you can build without thinking too deeply about the underlying cloud provider. That separation is reassuring, even if Kubernetes has plenty of complexity of its own.

These days, I mostly choose to work in areas where the managed cloud options are still inadequate, such as real-time media, telephony, high-speed stream processing, and similar systems. At least in those spaces, it still feels like I am engineering something rather than selecting products from a cloud-provider catalog.

I am curious whether other longtime infrastructure engineers feel the same way, or whether people genuinely prefer the managed-service-heavy version of the job.


Edit: I also really miss configuring switches and routers the cloud has made networking far more boring than it used to be though GKE has some interesting SDN features. I probably should have tried harder to get a job at one of the big hyperscalers but again on ownership I never wanted hundreds of co-workers.

https://redd.it/1v9llum
@r_devops

Passed CKA with 88%, sharing my prep notes and exam experience
https://redd.it/1v9n87e
@r_devops

Cloud Native Heidelberg Meetup: Kubernetes Platforms, CNCF Technologies and Kubernetes on Android

Sharing this for anyone interested in platform engineering, Kubernetes and cloud-native technologies.

Cloud Native Heidelberg is hosting a hybrid meetup covering:

Lessons from five years of building and rebuilding Kubernetes platforms
Building production-grade platforms using CNCF technologies
Creating vendor-neutral platforms without hyperscaler lock-in
Running Kubernetes directly on an Android phone

Date: July 30, 2026
Time: 6:30 PM CEST

Event details and registration:
https://ocgroups.dev/cncf/group/cncf-heidelberg/event/9euvqye

https://redd.it/1v9nlev
@r_devops

Thinking of building a tool that fixes vulnerable dependencies for you - want some opinions before I start

I'm a 3rd year CS student and I want to build something real over the next couple of months to learn RAG and agents properly. I've been thinking about one idea for a while and wanted to get opinions before I commit to it.

The problem I noticed is when you install on e package, you end up pulling in a bunch of other dependencies. Then a CVE shows up in one of those, and you're exposed through code. I came across Log4Shell and the Equifax breach and then I got this idea.

Fixing it is the annoying part. You can't just bump the broken package, because versions depend on each other, one thing needs a version below 2.0, another needs above 2.0, so you change one and others start conflicting. Now you have to fix all the issues, run tests, and hope everything works.

So what I want to build is a tool that does that for you and checks the fix actually works. The rough idea is you point it at your project, it reads your dependency tree (there's a free Google API called deps.dev that gives you the whole thing), finds why each vulnerable package is there, and works out the smallest set of version changes that clears all the CVEs without causing conflicts.

Then for the "will this upgrade break my code" question, I want to pull the changelog and release notes for each version jump and check them against the functions my code actually uses, so it can tell you whether the change touches anything you rely on. And the last part, it applies the fix in a Docker container, runs the tests, and only then tells you if it is safe.

The way I'm thinking of stucturing it is most of it is a fixed pipeline (read the tree, solve for the versions, run the tests), but the one part I'd actually let an LLM drive is the retry loop, when the tests fail, it looks at what broke, decides whether to drop that version and re-solve or try something else, and loops until it either works or gives up. That's the part where letting the model make the decision seems worth it. The rest doesn't really need it.

I'm thinking of using Postgres with pgvector, deps.dev and OSV for the data, a SAT solver for the version-conflict part, embeddings plus a reranker for the changelog retrieval, and Docker for running the tests. Later on, the nicest version would be exposing it as an MCP server so something like Claude Code could call it as a tool.

At the end it gives a report, a single Markdown file summarizing every vulnerability it found, why each package was present, the minimal fix it computed, the changelog-based breaking-change assessment, and the test results verifying the fix. Something you can hand to your team or keep as a record.

I know OSV-Scanner already does remediation, but only for npm/Maven, with no changelog check and no test verification, so the gap I'm aiming at is the full combination.

A few questions:

\- Would you use it? Would you actually run this on your own projects? If not, what's missing or in the way?

\- Is it useful? Is this a real problem worth solving, or is it already handled well enough that it doesn't need to exist?

\- Does it already exist? Is there something that already does all of this (minimal fix + breaking-change check + test verification) that I haven't found?

\- Right direction? Is this worth building, or would my time be better spent on a different problem in this space?

\- Do's and don'ts?

TL;DR: An agentic RAG tool that finds vulnerable dependencies, computes the smallest conflict-free fix, uses changelog retrieval to predict whether the upgrade breaks your code, and verifies the fix by running your tests. A verified patch.

https://redd.it/1v9q0oy
@r_devops