A beautiful narrative written over an elegant publishing platform. The story begins here...
Platform Engineering. Securing and running production systems across banking, gaming and e-commerce since 2011 — secure CI/CD, Kubernetes, MLOps, Observability. I write up the failures in detail: what broke, what the graphs showed, and what actually fixed it.
Home Labber — Notes from the Trenches
The Journey Begins here…
Systems kept alive, and the ones that broke first. Every figure below is from the resume or from a post on this site.
Sysadmin team at India's largest fashion e-commerce platform — on-call rotation, revenue-impact metrics and PCI audit.
Six nines · hybrid infrastructure
Memory pressure starved the NFS daemon the node itself depended on — a self-referencing deadlock that looked like a network fault.
1,172 zombie processes · load average 10× cores
Billing analysis over AWS and Azure ETL, built in Python and Flask, surfacing overprovisioned and idle services.
25% reduction
VAPT remediation and multi-AZ disaster recovery driven by Ansible. The certification unlocked further client contracts.
ISO 27001 · audited
OSA, SAST, DAST and a container trust registry, with policy as code catching issues before release rather than after.
Banking · current role
Instrumented the tool loop, found the gap where enforcement was never reached, and closed it with a pre-tool hook.
406M wasted tokens recovered
How we built auto-push for container CVE remediation: a staged agent where a local LLM audits but never decides, seven hard guardrails, and a first live push that caught a real bug. Plus wiring a crash-prone Mac LLM host into opencode and the agent. Measured end to end, October 2026.
writing Five expert sources, six rules: what Baymard, Smashing Magazine, Google's docs guide, NN/g, and the W3C agree on about readable technical writing — applied to this very blog, with the numbers.
omlx Merging 542 upstream omlx commits (0.7.0.dev4 → 0.7.1.dev2): 933 files, +147k/−36k lines. New serving endpoints, speculative decoding, MoE offload, and the kernel work behind them.
docker Same image, four different answers: Quay/Clair says 18 Low where Trivy says 68 findings, and Trivy says 0 where Quay says 2 High. How Clair, Trivy, Prisma Cloud and Grype actually scan container images, the 7 reasons their findings differ, and the discipline that makes scanner output trustworthy.
java Step-wise fix of CVE-2025-69644 (binutils objdump DoS), CVE-2026-46675 (libpng) and CVE-2026-85091 (zlib) in the eclipse-temurin JDK Alpine base image. Trivy 0.70.0 scans before and after, with digests. Result: 0 findings at a cost of 0.2 MB.
mlx A component-by-component trace of how LLM monitoring works in ../mlx-oc: what is measured, which macOS tool or Python library produces each metric, how it travels, and where it lands.
mlx Keeping mlx_lm.server alive on a headless FileVault Mac mini: LaunchAgent configs, HTTP watchdog that catches the wedge PID monitors miss, cron, caffeinate.
opensre How to add an OpenSRE vendor integration the agent can actually call: the eight-layer anatomy, the build order, credential tiers, tool discovery, and the rules that make it reviewable. Worked example: NATS.
docker Eight images published to one registry, re-pulled by digest, re-scanned with Trivy 0.70.0: zero OS and zero application findings on every tag.
sre Decision record: 20x Mac Mini M4 agentic LLM fleet for Open SRE — models, LiteLLM gateway, Opik tracing and hallucination control, monitoring.
docker Google Distroless has no shell, no apt and no dpkg. A full Debian 13 upgrade changes nothing and exactly one of its 64 OS findings has a fix published anywhere. This is the write-up of a remediation that cleared two findings for 0.1 MB, and of why that is the correct answer rather than a
docker Chainguard Hummingbird scans at zero findings in both layers. It was asked to be fixed anyway, so it was re-verified from its digest instead: 0 OS, 0 app, still booting in 8s, still non-root. The interesting part is why rebuilding a clean image would have been the wrong move.