Writing / notes / ideas
Make sense of
what’s next.
Notes on building professional identity, applying AI thoughtfully, and leading teams through the hard parts of making technology matter.
Browse published work and field notes on Docker, Intel, Microsoft, Java, GitHub, and Oracle.
Guest writing / product & AI
AI teammates. Human accountability.
Guest perspectives on AI-native teams, product development, and human accountability.
Docker / field notes
Operating containers,
with fewer surprises.
A fifteen-part series on practical Docker operations, repeatable builds, secure images, production readiness, and dependable services.
Running Is Not Ready: Operating Containerized Services
Separate startup, readiness, and liveness—and make rollouts reversible under real failure modes.
8 MIN READ ↗Same Dockerfile, Different Build: Reproducible Container Builds
Pin dependencies, lock the full graph, refresh base images deliberately, and inspect the artifact you ship.
7 MIN READ ↗Smaller, Quieter, Safer: A Production Image Checklist
A practical checklist for multi-stage builds, least privilege, small contexts, and clean runtime behavior.
7 MIN READ ↗Don’t Ship What You Haven’t Scanned: Gating Images Before Production
Build an SBOM, scan every image, gate on actionable severity, and keep exceptions narrow and owned.
8 MIN READ ↗Docker in CI: The Real Cost of Docker-in-Docker
Make daemon access explicit, fail closed when container tests can’t run, and reduce the blast radius.
8 MIN READ ↗Starting a Local Data Pipeline in the Right Order
How I use Compose profiles, health-gated startup and hard resource caps so a multi-service stack boots predictably and does not eat my machine.
4 MIN READ ↗Faster Docker Builds for Java Services
Most of the speed-up comes from three boring changes: a smaller build context, a sensible layer order and a BuildKit cache mount for Gradle.
4 MIN READ ↗Building Multi-Architecture Images for Mixed Systems
How I publish one image tag that runs on Apple Silicon and on x86 hosts, and why I avoid emulation for anything that matters.
4 MIN READ ↗Container limits and the JVM: why your heap is not your memory limit
A practical look at memory and CPU limits for Java services: sizing the heap, surviving back-pressure and recognising an out-of-memory kill.
5 MIN READ ↗Logs, metrics and trace correlation for a Java service in a container
A small set of habits that make a containerised Java service observable without drowning in log volume or metric cost.
4 MIN READ ↗Keeping secrets out of container images, builds and logs
A practical playbook for build-time tokens, runtime credentials and log redaction in a Java service, using BuildKit secrets and mounted files.
5 MIN READ ↗Tags, Digests, and Promotion
Stop deploying latest. Tag by commit, deploy by digest, and promote the exact artifact that passed your tests.
4 MIN READ ↗Debugging Minimal Containers: Exit Codes and Thread Dumps
How I diagnose a failing Java container without baking a shell and a toolbox into the production image.
5 MIN READ ↗From Compose to a Public URL: Ports, Health, and Scale-to-Zero
What changes when a local demo needs a real address, and how to keep it close to free when nobody is looking at it.
4 MIN READ ↗Restart-Safe Stream Jobs: Checkpoints and Idempotent Writes
How to make a containerised stream-processing job survive restarts without duplicates or lost work, with a runnable Java sketch.
5 MIN READ ↗Intel / edge AI notes
Inference you can
measure and trust.
A 15-article Intel series on model optimization, conversion, benchmarking, edge deployment, and OpenVINO runtime operations.
Variable-Length Prompts on an NPU: Designing the Test
How to design a fair experiment for first-token latency on an NPU across prompt lengths: length buckets, padding and chunking strategies, and what to record.
4 MIN READ ↗Vision-Language Models: Memory and Latency Testing
Why image and video inputs change serving cost, what to vary and record, and how to find the limits of your own deployment before users do.
3 MIN READ ↗NPU Readiness: A Pre-Ship Checklist for Intel Core Ultra
A checklist built from the OpenVINO NPU documentation and plugin README: platform and driver, static shapes, compiled-model caching, and how to list the properties your driver exposes.
4 MIN READ ↗A Playbook for GenAI Latency on Intel Hardware
A decision framework for latency and memory budgets and for defaults on caching, device selection, and KV-cache limits, with the evidence recorded for each default.
4 MIN READ ↗Compiled-Model Caching in OpenVINO
How compiled-model caching works, how to confirm a device supports it, how it interacts with AUTO and the NPU, and how to measure cold start against cache import honestly.
5 MIN READ ↗Faster Isn’t Free: Quantizing FP32 to INT8
Measure latency and output fidelity together—and know when INT8 is not worth shipping.
9 MIN READ ↗The Conversion Gap: From ONNX Export to an Optimized Runtime Format
Audit operators, plan fallbacks, script conversion, and validate parity before launch.
8 MIN READ ↗Benchmarking Inference Honestly
Warm up, control variance, report percentiles, and compare output deltas—not just averages.
9 MIN READ ↗Cache Correctness: Verifying Warm Starts
What reusing a compiled-model cache assumes, how to check that a cache exists and results match, and how to make a service fail closed on a bad warm start.
4 MIN READ ↗AUTO vs Explicit Devices vs HETERO in OpenVINO
A practical comparison of three ways to choose where OpenVINO runs a model, what AUTO actually does at startup, and a test that shows which strategy holds up on your machine.
4 MIN READ ↗Continuous Batching and KV Cache Sizing in OpenVINO Model Server
The Model Server options that control prompt reuse and KV-cache memory, example commands from its documentation, and a measurement plan for choosing values you can defend.
4 MIN READ ↗CPU-Only Edge AI, By Design
Make hardware assumptions explicit and provide fallbacks that fail clearly and gracefully.
8 MIN READ ↗Device Settings Through Wrappers: ONNX Runtime and OpenVINO
How the OpenVINO execution provider for ONNX Runtime selects devices, how provider options pass per-device properties and a cache directory, and a probe that records what your installed versions accept.
4 MIN READ ↗Packaging Inference for Production
Make model conversion reproducible, artifacts traceable, precision visible, and fallbacks testable.
9 MIN READ ↗KV Cache Governance: Bound LLM Memory in OpenVINO Model Server
A procedure for choosing a KV-cache size for Model Server, observing real memory use with ordinary tools, and writing the limit and its evidence into a runbook.
4 MIN READ ↗Microsoft Entra / field notes
Identity deserves
more than a signature.
A 15-article series on identity, cloud platform operations, AI safety, and secure workload integration.
Azure OpenAI authentication patterns without API keys
How to authenticate services and agents to Azure OpenAI using Entra ID, managed identity, and AKS Workload ID.
10–12 MINUTES ↗Serving ONNX models on AKS GPU without surprises
A hands-on path to deploy ONNX models with Triton or ORT, readiness checks, and GPU node pools.
10–12 MINUTES ↗GHAS + Azure runners without ops debt
When GitHub Advanced Security delivers value on hosted runners, and how to host ephemeral self-hosted runners on Azure when you really need them.
9–11 MINUTES ↗Graph + Event Grid for lifecycle events
Receiving tenant-wide identity change notifications at scale with Microsoft Graph and Event Grid partner topics, including the renewal events that people forget.
9–11 MINUTES ↗Content filters for prompts and outputs
Prompt Shields, groundedness, protected material, and blocklists for enterprise moderation.
8–10 MINUTES ↗Foundry RBAC that prevents over-privilege
Mapping Microsoft Foundry roles to tasks for projects, models and agent endpoints, so developers get what they need and nothing more.
10–12 MINUTES ↗Programmatic rollout of Workload Identity
Scope, phasing and incident readiness when moving AKS workloads from AAD Pod Identity or static secrets to Workload Identity.
9–11 MINUTES ↗Verifiable Doesn’t Mean Verified
A practical walk through verifiable credentials where “well-formed JSON” and “cryptographically signed” still aren’t the same as “true.”
READ ARTICLE ↗Null Isn’t False: Building Fair Credential Verifiers
Why missing evidence should be “unverifiable,” not “invalid,” and how collapsing those states leads to unfair outcomes.
READ ARTICLE ↗Deploying Identity Services Without a Server to Babysit
Lessons from scale-to-zero containers: cold starts, idle billing, and when latency-sensitive verifiers should stay “warm.”
READ ARTICLE ↗Keys Don’t Belong in the Image
Managed secret stores, rotation, and guarding against the “oops, we baked a key” failure mode.
READ ARTICLE ↗Revocation Is the Hard Part
Issuing is easy; keeping credentials current without leaking who asked is the challenge.
READ ARTICLE ↗API gateway enforcement for LLM APIs
Putting Azure API Management in front of Azure OpenAI: managed identity to the backend, token validation at the edge, and rate limits per caller.
9–11 MINUTES ↗AKS confidential containers for model isolation
What kata-cc isolates, how attestation ties to key release, and operational constraints.
12–14 MINUTES ↗Migrating to Microsoft Entra Verified ID
A neutral playbook for issuing and verifying user-owned credentials with open standards, and wiring the verification step into an existing app.
10–12 MINUTES ↗Java / field notes
Model the hard parts.
Let Java help.
A fifteen-part series on Java modeling, runtime performance, production observability, API evolution, and reliable builds.
Java 8 to 17 in a Multi-Module Build
Using `--release`, Gradle toolchains, and a bytecode gate to upgrade one module at a time
~10 MIN READ ↗G1 vs ZGC at JDK 17+: Choosing a Collector and Sizing the Heap
When G1 still wins, what ZGC costs in memory and CPU, and how to measure it yourself
~10 MIN READ ↗JFR as the Default: Enabling Continuous Flight Recording Safely
Bounded, always-on recordings you can dump during an incident, and a parser that turns them into flame graph input
~9 MIN READ ↗Error Modeling in a Java REST Service
Typed vs untyped error details, and why "helpful" mapping can quietly break your clients
~9 MIN READ ↗Java Records and Jackson: Null Safety and Schema Evolution
Designing JSON contracts that survive years of change, with property-based tests
~9 MIN READ ↗Records Aren’t Just Less Typing: Modeling Ambiguity Without Nulls
Using records, sealed interfaces, and pattern matching to model “present,” “missing,” and “unverifiable” — and force callers to handle every case.
READ ARTICLE ↗Contract Testing a Legacy-to-gRPC Bridge in JUnit 5
One contract, two implementations, recorded fixtures, and fewer flaky tests
~9 MIN READ ↗Virtual Threads: Practical Lessons for I/O Fan-Out
Practical lessons from I/O fan-out with virtual threads: what became simpler and where limits still matter.
READ ARTICLE ↗Reproducible Gradle Builds: Why It Passes Locally and Fails in CI
Resource paths, dependency locking, and byte-for-byte reproducible jars
~9 MIN READ ↗Flaky Tests Are a Concurrency Bug
Trace intermittent failures to shared mutable fixtures, then fix the design instead of blaming the runner.
READ ARTICLE ↗Allocation Hotspot Hunting with JFR and async-profiler
Why collection-heavy code hurts your tail latency, and how to measure before optimizing
~9 MIN READ ↗Reproducible Java Builds
“It built on my machine” still happens. Pin versions, lock dependencies, and verify reproducibility in CI.
READ ARTICLE ↗The Hidden Price of "One More Log": Observability Costs on the JVM
Logging, tracing, and sampling choices that protect your p99
~9 MIN READ ↗Designing for Partial Data: Unknown vs False
Sealed types and exhaustive pattern matching keep “unknown” distinct from “zero” throughout a service.
READ ARTICLE ↗API Evolution: Keep Wire Contracts Stable for Java Clients
Tolerant readers, batch error handling, and golden-file tests
~9 MIN READ ↗GitHub / field notes
Make open source
easier to join.
A 15-article series on contributor tools, secure releases, code scanning, dependency updates, extension contracts, and plugin design.
Zero-Friction Docs: Deploy Static Sites to GitHub Pages with Actions
How to build and deploy a static documentation site with GitHub's Pages actions, using a short workflow and no manual steps.
3 MINUTES ↗Triage and Ship from the Terminal: gh CLI for Platform Teams
How to use gh CLI to create issues, review and merge pull requests, and rerun workflows, with small scripts that keep the commands consistent.
3 MINUTES ↗Build a Scoped Bot: GitHub Apps and Octokit, the Right Way
How to authenticate a GitHub App as an installation, limit it to specific repositories and permissions, and use short-lived tokens.
3 MINUTES ↗Ship verifiable releases with GitHub artifact attestations
How to add signed build provenance and SBOM attestations to a release, so anyone downstream can check what was built, from which commit, by which workflow.
9–11 MINUTES ↗Code scanning and rulesets: make a green check mean something
How to turn CodeQL from a report you read after the merge into a gate that blocks risky changes, using rulesets, required checks and code owners.
9–11 MINUTES ↗Dependabot and security advisories: tame the update flood
How to combine grouped Dependabot updates, safe auto-merge, code owners and advisories so dependencies stay current without drowning reviewers or merging risk blindly.
9–11 MINUTES ↗Contribution Guidelines Nobody Reads
Practical contributor onboarding that turns “I tried” into a working PR: quickstarts, guardrails, and code paths that are hard to misuse.
READ ARTICLE ↗A Breaking Change in Someone Else’s PR
When a plugin interface change passes CI and breaks downstream work, you need versioning, deprecation windows, and contract tests.
READ ARTICLE ↗Semantic Versioning Is a Promise, Not a Formality
For small projects, getting “breaking” right matters. When you change behavior, communicate clearly and follow your own rules.
READ ARTICLE ↗Triage Without Burning Out: Sustainable Patterns for Issues and PRs
Labeling, response-time expectations, and healthy “no” decisions for a maintainer with finite time.
READ ARTICLE ↗Copilot That Respects Your Repo: Policies, Credits, and Seat Types
How to match Copilot seat types to roles, limit agent actions on sensitive paths, and keep credit use visible across a platform team's repositories.
3 MINUTES ↗Designing for Other People’s Code
Make extensions safe and approachable with narrow interfaces, complete examples, and isolated execution for untrusted code.
READ ARTICLE ↗Codespaces Without Surprise Bills
How to use devcontainers and prebuilds for fast contributor setup, and how to set machine limits, retention, and spending caps so costs stay predictable.
3 MINUTES ↗Roadmaps Next to Your Code: GitHub Projects for Platform Teams
How to run a roadmap in GitHub Projects using table, board, and roadmap views, custom fields, and built-in automations.
3 MINUTES ↗Discussions as Your Community Front Door
How to enable Discussions, set up categories, pin canonical threads, and convert between issues and discussions as conversations change shape.
3 MINUTES ↗Oracle ACE / field notes
Oracle ACE
writing.
Using OCI Instance Principals without leaking credentials
How I let workloads call OCI APIs with no API keys on disk, and keep the blast radius small.
3 MIN READ ↗Least-privilege IAM policies for workloads (compartment-first)
The policy patterns I reach for to keep OCI access narrow, readable and easy to audit.
3 MIN READ ↗Dynamic groups with tag-based scoping (illustrative patterns)
Using compartment and tag rules so only the instances you intend can assume a group's permissions.
3 MIN READ ↗Identity Domains: SAML/OIDC federation setup notes
What I configure first so an external identity provider works cleanly with OCI.
3 MIN READ ↗Identity Domains: MFA policies and admin-safe rollout
How I turn on MFA without locking the administrators out of their own console.
3 MIN READ ↗Practical secrets with OCI Vault: creation, rotation, and usage
Storing application credentials in Vault and rotating them without writing custom scripts everywhere.
3 MIN READ ↗Vault + DB wallets: secure distribution patterns (illustrative)
Generating an Autonomous Database wallet, keeping it in Vault, and rebuilding it only where it is needed.
3 MIN READ ↗OCIR basics: push/pull, private repos, auth tokens
The registry commands I actually run, and the small details that cause most login failures.
3 MIN READ ↗Minimal Java container on OCI with TLS to DB
A small, locked-down Java service on an Ampere A1 instance, talking to Oracle Database over TLS.
3 MIN READ ↗Oracle DB: invoker's vs definer's rights for least-privilege code
A simple rule of thumb for choosing AUTHID, with two small procedures that show the difference.
3 MIN READ ↗TDE quickstart and keystore hygiene
Turning on Transparent Data Encryption for an Oracle database, and keeping the keystore from becoming an outage.
3 MIN READ ↗Unified Auditing: practical policies and trail hygiene
A small set of audit policies that gives you useful events without drowning in noise.
3 MIN READ ↗JDBC/UCP to Oracle over TLS or mTLS with wallets
My baseline for connecting a Java application to Autonomous Database or another Oracle service securely.
3 MIN READ ↗UCP pool tuning for resilience and validation
The handful of Universal Connection Pool settings I change first, and the arithmetic behind the sizes.
3 MIN READ ↗AI Language and Vision: secure triage pipelines (illustrative)
Wiring OCI Language and Vision into a document triage flow while keeping personal data out of places it should not be.
3 MIN READ ↗Compartment design and movement: policy implications
How I structure compartments so access stays predictable when one has to move.
3 MIN READ ↗