infrastructure
38 posts found
Cache Invalidation via Surrogate Keys: Edge Architecture and Purge Mechanics
Decouple cache invalidation from URL paths using Surrogate-Key headers for targeted CDN purging.
Why MoE Models Stream From NVMe: Kernel Prefetch, Read-Ahead, and Async I/O
Frontier MoE models run on consumer hardware by streaming expert weights from disk. Not compression—kernel I/O prefetching overlapped with GPU compute. Here's h…
SSH Certificates vs. Key Files: Why Production Ops Teams Are Finally Moving
Key files don't scale. SSH certificates solve revocation, audit trails, and onboarding at production scale—here's why adoption is accelerating.
Kernel Socket Tuning for High-Concurrency Load Balancers: TCP_NODELAY, TCP_FASTOPEN, and Listen Backlog
Disable Nagle, enable TCP Fast Open, tune listen backlog. Three socket parameters cut tail latencies 40–60% on modern load balancers.
How to Tunnel Datagrams with MASQUE CONNECT-UDP Over HTTP/3
Configure RFC 9298 MASQUE CONNECT-UDP over HTTP/3 to tunnel datagrams without head-of-line blocking.
Streaming Mixture-of-Experts Weight Tensors Directly from NVMe Storage
Sparse Mixture-of-Experts models waste massive RAM holding idle expert weights. By combining zero-copy kernel memory mapping, io_uring transfers, and predictive…
Defensive Sysctl Parameters for Production IP Stacks
Default Linux kernel settings leave servers exposed to route hijacking, spoofed packets, and connection floods. Here are ten sysctl directives to secure the net…
The Evolution of Telemetry: From Syslog Scrapers to eBPF and ClickHouse
A technical timeline tracing how telemetry evolved from isolated Prometheus scrapers in 2018 to OpenTelemetry standards, eBPF in-kernel probing, and ClickHouse …
TCP Keepalive Does Not Keep Your Connection Alive
Linux defaults to a 2-hour keepalive time. Dead connections sit in your process table for hours before the kernel notices. Here is how to fix that and why appli…
Linux Systemd Sandboxing: Ten Security Directives for Production Daemons
Harden production Linux services using native systemd security directives including namespaces, seccomp syscall filters, and memory protection.