from your cellphone to server how network works

When I type "google.com", first my browser checks its DNS cache, then the OS cache, and if it still doesn't find the IP, it queries the configured DNS server. Once it gets the IP address, it reaches the Load Balancer, performs the TCP three-way handshake, and then establishes a TLS connection.

Once the secure connection is established, the browser sends an encrypted HTTP request to the Load Balancer. The Load Balancer forwards the request to a suitable backend server based on its routing rules.

Now let's talk about what happens within the server. The request is processed, the service does whatever work is required, maybe querying a database, calling another service, or executing some business logic, and then sends the response back.

But how did the browser send the request in the first place?

Your home router uses DHCP to assign your device a private IP address from its pool. Your ISP provides your router with a public IP address. When your browser opens a connection, the operating system assigns it a random ephemeral source port. The router then performs NAT, more specifically PAT, by mapping your device's private IP and source port to its public IP and another source port. It keeps this mapping in its NAT table so that when the response comes back from the server, it knows exactly which device and which browser connection the data belongs to.

Once the response reaches your browser, the browser decrypts the HTTPS data using the established TLS session and renders the webpage. HTTPS works over TLS, so both the request and the response are encrypted while in transit. When the connection is no longer needed, the TCP connection is closed, which also ends the TLS session, although modern browsers often keep the connection alive for a while so they can reuse it for subsequent requests.

https://redd.it/1veoivy
@r_devops

Book recommendations for on premises deployment

So I am new to the DevOps field and my job is to deploy an app on premises. Now the problem is that the material I have read, such as:

"Fundamentals of DevOps and Software Delivery" by Yevgeniy Brikman

"Road to Kubernetes" by Justin Mitchel

focuses mainly on cloud based deployment, which I do not want to use. To clarify, I already have the necessary servers, but for privacy reasons, I would prefer not to disclose too much about the setup. Does anyone have a beginner friendly book recommendation that explains how to deploy an application on premises?

I also need to use Kubernetes and Docker, and I already have learning material for both, so the recommended books do not need to explain them in great depth. Thank you for you time!

https://redd.it/1veqes4
@r_devops

If I cannot start a devops job as a fresher, what can I start to learn to get job?

Hey all,

I read and heard that devops is not a starter job that I can learn number of skills and start job searching. There is no junior or entry level devops jobs.

I can understand it. If it is true, what can I learn and search for jobs? Shall I go for AWS? Linux? The only one skill will get me a job?

I am sorry I am very new to IT. I want to change my career.

https://redd.it/1veo5ve
@r_devops

Genuinely asking: is "move fast and break things" dead, or did it just get rebranded?

Every team I talk to these days will tell you, unprompted, that they've moved past that mentality. More deliberate now, more careful, more "quality-first." Nobody wants to be associated with the phrase anymore, it's become a bit of a punchline.

But when I look at what actually happens day to day, ship first, find out what broke from a user report or a support ticket, patch it after, it looks pretty similar to what it always looked like. The vocabulary changed. The retros got more polished. There's a Slack channel for "learnings" now instead of just quietly fixing it and moving on. The underlying loop, though, ship, discover, patch, doesn't look that different from five years ago on most teams I've seen.

Maybe that's fine. Maybe the loop was never really the problem, and the actual improvement is somewhere else, better rollback speed, better observability so the discover step is faster, smaller blast radius when something does break. That would be real progress even if the core behavior looks the same from a distance.

Or maybe I'm just seeing survivorship bias, the teams that talk publicly about being careful and deliberate are a specific, vocal subset, and they're not representative of what's actually happening at most places.

Genuinely asking, not trying to make a point here: what's concretely different about how your team ships now versus a few years ago? Not how you'd describe the philosophy, what's actually different in practice, deploy frequency, review process, what happens in the fifteen minutes after something goes wrong.

https://redd.it/1ves8iv
@r_devops

Interview tips and suggestions for platform engineer

hey everyone,

I have an upcoming interview for a Platform Engineer role. I’ve been grinding scenarios around IaC (Terraform/Terragrunt), CI/CD pipelines, Kubernetes, and SRE concepts (SLIs/SLOs, Error Budgets) .

i need tips and guidance from senior engineer . it will be a quick chat

https://redd.it/1vf5auy
@r_devops

I keep seeing the same issues on WAF configs in my audits

Been doing security audits for a while (I’m a secops engineer) and the same patterns keep showing up. Regardless of the vendor, so these are the same whether it’s Akamai, Cloudflare, AWS WAF.

1. Origin is directly reachable! Traffic bypasses the CDN/WAF (check cert transparency logs for leaked origin hostnames)

2. They've got bypass rules that were meant to be temporary but never got removed

3. Cache key too broad (cache poisoning risk) or too narrow (kills hit ratio, looks like a DDoS)

4. WAF rule sets are treated as “once and done”. Rules deployed once and never tuned, so there are a lot of silent false positives on real traffic.

5. TLS/cert management with no clear owner, resulting in expired certs, weak ciphers left on etc.



Wrote up a longer breakdown with a checklist if anyone wants to run through their own setup, happy to share.



https://redd.it/1vf70m0
@r_devops

found out my LLM feature's cost problem from an invoice, not a dashboard, and that felt very wrong

shipped an LLM feature, felt fine at launch, moved on to other work. a while later the bill showed up noticeably higher than expected and that was the first real signal anything had changed. no alert, no dashboard flag, just a number at the end of the month that made me go "wait, what happened."

went back and actually set up proper tracing and token/cost monitoring per request instead of just trusting it'd be fine, and found a specific workflow was making way more calls than i thought due to a retry loop that wasn't being logged anywhere visible. it had been quietly running up cost for weeks with zero visibility until the invoice.

also added latency budgets and caching for repeated queries after this, which cut cost noticeably on top of the retry fix.

feels like a pretty basic devops instinct (you monitor what you ship, you don't wait for the bill) that somehow gets skipped constantly once "AI feature" is involved, like people ship LLM stuff with less observability discipline than they'd ever accept for a normal service. anyone else's team caught something similar the hard way before actually building proper monitoring in from the start

https://redd.it/1vfa6tu
@r_devops

Question about trader status under the EU Digital Services Act

Hello,
I’m trying to understand whether I should classify myself as a trader under the EU Digital Services Act, and I would really appreciate input from developers who have dealt with this. I’ve received conflicting answers from AI tools, so I’m not confident relying on those alone.
Apple requires developers to choose one of the following:

“I’m a trader under the DSA”

“I’m not a trader under the DSA or I don’t plan to distribute in the EU”

I haven’t published any apps yet, but I’m preparing to release my first independently developed apps on the App Store and Google Play.
App development is currently a hobby alongside my main job, and I’m not operating through a registered company.
The apps will be free to download but include ads. One app will also offer a paid option to remove ads, and I may add in-app purchases in the future.
I’ve noticed that some similar apps with ads and in-app purchases are published by developers who don’t appear to be marked as traders, though I understand that may not reflect their actual status.
Given this, would you consider someone in my situation to be a trader under the DSA, or could it reasonably be treated as non-trader activity since it’s currently a hobby?
I also have a few related questions:
Does the same approach apply when selecting trader status on Google Play?
What typically happens if you declare yourself a non-trader but the platform later disagrees? Are you usually allowed to update your status, or could your account be affected?
Is it true that apps from non-trader accounts may be removed in the EU if the classification is later found to be incorrect?
Is trader status set per app or per developer account on Apple and Google?
I understand this isn’t legal advice. I’m mainly interested in how other independent developers have interpreted and handled this in practice.
Thank you very much for your help.

https://redd.it/1vfbzdw
@r_devops

Question about trader status under the EU Digital Services Act

Hello,
I’m trying to understand whether I should classify myself as a trader under the EU Digital Services Act, and I would really appreciate input from developers who have dealt with this. I’ve received conflicting answers from AI tools, so I’m not confident relying on those alone.
Apple requires developers to choose one of the following:
“I’m a trader under the DSA”
“I’m not a trader under the DSA or I don’t plan to distribute in the EU”
I haven’t published any apps yet, but I’m preparing to release my first independently developed apps on the App Store and Google Play.
App development is currently a hobby alongside my main job, and I’m not operating through a registered company.
The apps will be free to download but include ads. One app will also offer a paid option to remove ads, and I may add in-app purchases in the future.
I’ve noticed that some similar apps with ads and in-app purchases are published by developers who don’t appear to be marked as traders, though I understand that may not reflect their actual status.
Given this, would you consider someone in my situation to be a trader under the DSA, or could it reasonably be treated as non-trader activity since it’s currently a hobby?
I also have a few related questions:
Does the same approach apply when selecting trader status on Google Play?
What typically happens if you declare yourself a non-trader but the platform later disagrees? Are you usually allowed to update your status, or could your account be affected?
Is it true that apps from non-trader accounts may be removed in the EU if the classification is later found to be incorrect?
Is trader status set per app or per developer account on Apple and Google?
I understand this isn’t legal advice. I’m mainly interested in how other independent developers have interpreted and handled this in practice.
Thank you very much for your help.

https://redd.it/1vfc04y
@r_devops

What's the most time you've lost to a bug that wasn't actually a bug?

I spent way too long trying to fix something recently before realizing nothing was actually wrong.

It turned out to be a configuration mistake that I had made myself.

It got me wondering how much time people in ML and software spend debugging their own setups rather than actual code.

What's the dumbest "bug" you've ever chased?

https://redd.it/1vf8x4l
@r_devops

Does anyone have information on hardening publically exposed k8s LB nodes? Loadbalancers in AWS are really expensive.

Just exploring the space and price comparisons

ALBs and NLBs are expensive. especially in AW

So some ingress only nodes with proper hardening seems cheaper, but curious about battle scars and stories people wanna share.

My idea is simply that, hardening a fleet of ingress only nodes in a public subnet, pointing all queries at these nodes and letting the proxy and ingress rules handle the traffic from there

https://redd.it/1vfi0gg
@r_devops

How much attention is harness engineering getting?

AI model quality is converging, or at least changing often enough that chasing the newest thing doesn't seem like a good strategy. How much emphasis are teams putting on building a solid harness into which new models can fit?

Our clients are generally in high compliance industries, so there is thought put into the harness, but what about smaller teams or ones that aren't required into a compliance framework?

https://redd.it/1vfkoi4
@r_devops

Hetzner Cloud vs Turkish VPS for a production mobile backend?

Hi everyone,



I'm building a mobile application primarily for users in Turkey.



My stack:

\- NestJS

\- PostgreSQL

\- Redis

\- Docker

\- Coolify



The app is still in development and I'm planning the production infrastructure.



I'm considering two options:



1. Hetzner Cloud (Germany)

2. A VPS/Dedicated server located in Turkey



The backend is a standard REST API (no gaming or real-time voice/video). Most requests are authentication, CRUD operations, QR code lookups, notifications, and media metadata.



Latency from Turkey to Germany seems to be around 25-40 ms.



Would you prioritize:

\- Better hardware and infrastructure (Hetzner)

\- Lower latency with a Turkish provider



Has anyone run production applications for Turkish users from Hetzner? I'd love to hear real-world experiences.

https://redd.it/1vfkjvd
@r_devops

KodeKloud Challenges are worth it?

I am thinking on start the 100 days of DevOps challenge in KodeKloud just to improve my devops skills and fill in some gaps that I might have.

Does this challenge worth it? Specially for the time that needs to be invested.

https://redd.it/1vfqoqe
@r_devops

Self-hosted enterprise app builders with strong RBAC and compliance features

We’ve been evaluating self-hosted low-code and internal application builder platforms mainly for compliance-heavy requirements like fine-grained RBAC, audit logging, and enterprise access control, and while tools like Retool and ToolJet are still commonly used in this space, they now feel more oriented toward managed or hybrid deployments rather than purely self-hosted governance-first setups, and Appian is still an option but feels closer to a full enterprise BPM suite than a lightweight internal tool builder, so we’re now looking for more modern self-hosted alternatives that can be deployed via Docker or Kubernetes, support strong role-based permissioning, integrate with SSO/SAML or LDAP, provide detailed audit trails, and avoid heavy vendor lock-in since we’re planning to migrate around 300 applications, so it would be useful to hear what stacks are actually working reliably in production environments today.

https://redd.it/1vfxku2
@r_devops

Are you team A or team B?
https://redd.it/1vg0i1u
@r_devops

Uni vs non Uni degree

For context, I'm a DevOps engineer who never went to uni, started in SysAdmin, have bit more of an old-school philosophy and my first hiring manager was a CCIE who went to trade school like me and accidentally fell into I.T (like me).

I thought a discussion might be worthwhile, as people always ask about getting into a non entry lvl DevOps position. And I guess people don't see most of us are I.t guys who have seen prod burn from the sidelines before we ended up here.

I managed to get here through some pretty hard work and solving irl problems, and made my promotions into DevOps by recognition of my work and the fact it probably already was DevOps before I wore the hat.

I never chose the DevOps life to be honest, it chose me. I was a happy SysAdmin, I am a very disgruntled DevOps engineer but I make more money and deal with more interesting problems.

What's everyone's thoughts, you think uni is required or not?

(If your a manager, would you hire someone like me, who had years of SysAdmin but no official DevOps title/experience, or are you choosing the CS grad?)

I got nothing against CS grads, but damn, they like to ask 50 questions, like to suggest why everything isn't a binary, and have a tendency to think of a rocket ship solution when the daily boat just needs a hole patched to stop it sinking.

My hypothesis comes from maintaining 2 different 20+ year old products for context ha

https://redd.it/1vg0igb
@r_devops

Why is context switching between ide and logs still a problem?

Something that keeps coming up during our incident response is just how much time we lose jumping between the ide and whatever tool holds the relevant logs, traces, or metrics. Typical flow: you are in the ide looking at a failing code path, you hit unexpected behavior and the next 20 minutes is alt-tabbing between your editor, log search, a distributed tracing ui, metrics dashboards, feature flag console and deploy history. You copy a trace id from logs over to the tracing tool then you copy a user id back into a sql query then you try to map all of that back to the exact function and commit you are staring at in the ide. We've got what most people would call a modern observability stack: distributed tracing, structured logs, dashboards, decent tagging and reasonably instrumented services. the problem isn't that the telemetry doesn't exist, it's that none of it really lives where developers spend their time writing and reviewing code. During incidents, people end up doing their own ad‑hoc integration work: copy from log search, paste into the ide, grep locally, jump back to the metrics dashboard, repeat. The pain points i keep seeing during production debugging are pretty consistent. there's no single place that shows this line of code, these commits, these deploys and these recent errors and traces in one view. Most observability tools are optimized for operators staring at dashboards, not developers trying to understand how a specific code path behaves in production. even when telemetry is tagged correctly, you still have to remember which query or dashboard to open and how to line it up with what you're debugging in the ide and during a live incident, that context‑switching overhead turns directly into mttr and oncall fatigue. What's interesting is that we keep buying more observability tooling but the core developer workflow is still: ide here, production reality over there and your brain plus clipboard as the glue connecting the two. How have you cut down on context switching between the ide and your logs, traces and metrics during debugging and incident response, whether that's pulling production context directly into the ide, pushing more code context into your observability tools or standardizing on a single pane for incident work?

https://redd.it/1vg5rfq
@r_devops

How do you prove a deployment wasn't the cause?

Hi all, one thing thats been bugging me lately is how often the most recent deployment becomes the default suspect.

Service starts acting up at 2:15, someone notices there was a deploy at 2:07, and from that point on everyone's looking at the release. Then an hour later it turns out the actual problem was an upstream dependency having a bad few minutes

We've started pulling deployment events into incident reviews because it gives us a better timeline, but its still surprisingly easy to get anchored on something changed instead of what changed first.

For teams with a lot of deployments everyday, how are you separating coincidence from causation? Do you have a workflow that's worked well, or is this just part of the job?

https://redd.it/1vg69zp
@r_devops

How do you manage multiple environments when Dev and Prod use different infrastructure?

I currently manage 2 different environments: a dev server running in ec2 and an EKS environment for production server. Problem is that their setup is different, which adds extra management and makes it harder to test prod changes before deployment.

I can spawn a UAT EKS for load testing and preparing for prod but it would be just too expensive. I already raised the cost concerns with EKS that this would be an expensive and unnecessary setup but the clients wanted it so I did it. Now they're complaining with cost.

I'm just trying to find the best way to manage the current architecture without increasing costs too much.

How would you handle this?

https://redd.it/1vg6nuu
@r_devops

Confused about how different environments factor into building MLOps systems?

Assume you are building an MLOps platform which has pipelines for the entire model lifecycle written with code and storage components. Something I am struggling to understand is how CI/CD factors into the MLOps system itself that brings the model through the entire lifecycle when we have multiple deployment environments.

The MLOps system takes a model through the entire lifecycle (get data, preprocess, train, validate, promote, deploy, monitor) in reproducible and automated workflows, but these workflows in the MLOps system need to be tested and validated with CI/CD in different deployment environments.

Are the pre-production environments (dev, test, uat...) meant only for ensuring that the MLOps system (pipelines, artifact storage, monitoring) works - where finally, and only, in the production environment that has passed all the tests and checks, does the model go through the entire lifecycle from dataset curation to deployment and monitoring, and each environment has isolated model/artifact registries (and feature stores) for testing that the system works.

Or, does the model meant for production go through each step in the model lifecycle together with the MLOps system as it moves through different environments until it finally reached production where both the "MLOps System" and the "Model" are production-ready and deployed to interact with real users.

It's a little confusing for me.

https://redd.it/1vgab26
@r_devops