Ship It Weekly Host Commentaries

Episode 7 is the first Ship It conversation episode, and it’s also a good time to explain what Ship It Weekly is turning into.

Most weeks, Ship It Weekly is a short news show. I skim the DevOps/SRE/platform headlines, pull out the stuff that actually matters, and give you the “ok cool… what does this mean for people running infra and owning reliability” version. It’s meant to be quick, useful, and easy to listen to while you’re doing something else.

But I also want to mix in conversations with engineers who are actually building and operating this stuff. The news format is great for breadth. Interviews are better for depth. You get the war stories, the why behind decisions, and the stuff that doesn’t fit into a 10–20 minute rundown.

So going forward you’ll see two types of episodes:

Ship It Weekly: the news recap and takeaways.
Ship It Interviews: longer, conversation-style episodes with guests.

Loose cadence wise, the idea is interviews earlier in the week and the news recap later in the week, but I’m not treating that as a hard rule. Some weeks will be all news, some weeks will be an interview plus a news episode, and sometimes we’ll do specials when something big happens. The goal is consistency and usefulness, not sticking to a rigid calendar.

For this first interview, I’m joined by Maz Islam. We talk about the real reason DevOps exists in the first place, what “upskilling” looks like when you’re already busy and tired, and how to think about agentic AI without getting lost in hype.

We also get into the practical side: where automation actually pays off, what habits and mental models help you level up faster, and how to avoid the trap of collecting tools without building real capability. It’s less “top 10 tools” and more “how do you actually get better and build leverage over time.”

If you’re early in your journey, this episode should give you direction and some momentum. If you’re already deep in the weeds, it’ll probably feel like a useful reset and a reminder of what’s worth focusing on when everything is changing at once.

Links and notes from the episode are below.

Episode 6 is a “platform tax” week.

Not because anything is fun and shiny, but because a bunch of the stuff that keeps your org shipping quietly changed shape at the same time: CI economics, IaC platform limits, and new security boundaries thanks to AI agents.

We start with GitHub Actions. GitHub floated a new charge for self-hosted runners, got immediate pushback, and then paused the change while they re-evaluate. The important part isn’t the drama. It’s the signal: Actions is a control plane, and GitHub is clearly thinking hard about how it gets priced. We also got the perfect timing joke with a GitHub incident the same week, which is a reminder that CI isn’t just “dev convenience.” For a lot of teams it’s the delivery pipeline, the GitOps loop, and the break-glass path… until it isn’t.

Then we shift to HashiCorp and Terraform Cloud. Legacy Free orgs are heading toward end-of-life in 2026, with transitions to the newer Free tier capped at 500 managed resources. That number is either totally fine or instantly painful depending on how real your infrastructure is. The practical takeaway is simple: know your resource count, clean up zombie stacks, and decide early whether you’re paying, consolidating, or migrating. Don’t make it a March 2026 emergency.

After that, we talk about PromptPwnd and the broader “AI in CI” problem. Teams are wiring agents into pipelines that read PRs and issues, and if you feed untrusted text into prompts while the agent has tools and tokens, you’ve created a new kind of supply chain risk. The fix is the same boring security posture we always preach: sanitize inputs, minimize permissions, and don’t let an agent auto-execute anything just because it sounds confident.

We also touch a classic security hygiene story around long-lived access exposure as a reminder that secrets, blast radius, and detection still matter more than whatever new automation you just bolted on.

Lightning round hits CDKTF being sunset/archived, Bitbucket cleaning up free unused workspaces, and SourceHut’s proposed pricing changes as more evidence that tooling economics are shifting everywhere.

This episode is basically a reminder that platform engineering isn’t only Kubernetes and Terraform. It’s also vendor models, dependency planning, and making sure your pipelines don’t turn into single points of failure.

Show notes below have the links if you want to dig into the announcements and write-ups.

Episode 5 is one of those weeks where the headlines hit three totally different layers of the stack… but they all land on the same people: the folks responsible for keeping systems safe, stable, and shippable.

We start with IBM buying Confluent. Coming right after the HashiCorp deal, it’s a pretty loud signal about where IBM is going: control plane plus data plane, all aimed at enterprise AI and “smart infrastructure.” If you’re on Confluent Cloud or evaluating it, the real question isn’t “is Confluent good.” It’s “what’s our vendor concentration story, and do we have a plan B if packaging, pricing, or priorities shift post-acquisition.”

Then we move to React2Shell, a critical RCE in React Server Components that’s already being exploited in the wild. Even if you’ve never written a line of React, this matters if you run Kubernetes or platforms for teams building modern web apps. It’s server-side code execution. That means patch windows, WAF/rule coverage, and making sure the blast radius of a compromised app pod isn’t “cool, now they own the cluster.”

Third, Netflix’s Aurora write-up. They consolidated a chunk of their relational database fleet onto Aurora PostgreSQL and reported big performance improvements plus meaningful cost savings. The interesting part isn’t “Aurora is magic.” It’s the reminder that self-managed database fleets quietly become an ops tax over time, and sometimes the grown-up move is standardizing on a managed path so you can spend your energy on the parts that actually differentiate your product.

Lightning round is a mix of tools and ecosystem signals: OpenTofu 1.11 shipping new language features, a practical Terraform “tips from the trenches” post, Ghostty moving under a non-profit model, and a quick look at spec-driven development with AI (Spec Kit and OpenSpec) as a saner alternative to free-form “let the agent do whatever.”

We close with a human note: incidents, vendor changes, and security fire drills all land on the same small set of people. The tech is one thing, but the mental load is real, and platform work increasingly includes managing that constant drip of surprise.

Show notes below have all the links if you want to go deeper on the acquisition, the vuln details, and the Netflix architecture story.

Episode 4 is my “big platforms week” episode.

We start with AWS re:Invent, but not in the usual hypey way. I’m looking at it like a platform team would: what changes the paved roads, what changes the reliability story, and what’s going to show up as a ticket in your queue three months from now.

That includes stuff like regional NAT Gateway availability and Route 53 resolver updates on the networking side, plus new opinionated paths like ECS Express Mode and the “EKS capabilities” direction AWS keeps leaning into. There’s also a clear AI and data signal with things like S3 Vectors and the bigger S3 object support. Even if you don’t care about the buzzwords, you should care about what this does to patterns teams will try to roll into your clusters and accounts.

Then we step out of AWS for a minute and talk about Google’s 130,000-node GKE cluster. It’s obviously an extreme case, but those write-ups are still useful because they show what breaks first: control plane pressure, scheduling behavior, networking limits, and how much operational discipline you need when “it scales” stops being a marketing phrase and becomes a daily reality.

And then we hit the spicy one: “kill staging.”

The argument isn’t “YOLO production.” It’s that staging is often a false sense of safety. The more your staging environment diverges from prod, the more it becomes a place where bugs hide, not where bugs get caught. The real conversation is how you test in production responsibly: feature flags, progressive rollouts, canaries, solid observability, and a rollback path that doesn’t rely on heroics.

The thread tying all of this together is pretty simple: the big cloud providers are making it easier to ship faster, but the only way that’s a win is if your platform has guardrails. Otherwise you just move faster into the wall.

Show notes below have all the links if you want to dig into the re:Invent announcements, the GKE story, and the staging debate.

Episode 3 is a “boring on purpose” platform episode, and I mean that as a compliment.

This one is about the stuff that quietly causes most real incidents: configuration drift, control plane bottlenecks, and CI/CD guardrails that are either too loose or too painful.

We start with Kubernetes’ new “Configuration Good Practices” guidance. It reads like a reality check for anyone who’s ever had a tiny YAML change turn into a day-long outage. The themes are simple but painfully true: stop treating config like an afterthought, standardize how you template and overlay manifests, avoid magic defaults, and validate early so you don’t discover problems at apply-time. If you’ve got a mix of Helm, Kustomize, raw YAML, and “hotfix manifests from someone’s laptop,” this is a good week to use the Kubernetes post as a neutral checklist and start converging on a sane pattern.

Then we move into AWS and EKS. The interesting shift here is AWS acknowledging the two areas that bite teams at scale: control plane capacity and networking visibility. Provisioned Control Plane is basically “stop guessing and reserve control plane headroom,” which matters a lot in multi-tenant clusters and during noisy deploy windows. And the container network observability updates are really about answering the question we all get: “who is talking to what, and why is it slow?” Without having to duct-tape five separate tools together to prove it.

After that, we hit GitHub. There are small changes that matter if you’re running CI as a platform. Actions OIDC tokens now include a check_run_id, which makes it easier to do tighter least-privilege policies and better audit trails. On the AI side, GitHub is pushing harder on “instructions files” and custom Copilot agents, which is basically the early version of “your platform has to work for humans and AI helpers at the same time.” That’s cool, but it also raises the bar for guardrails. The whole point is: we want automation, but we still want safety.

Lightning round is a mix of security and economics: Terrascan getting archived, Azure absorbing a massive DDoS, and AWS testing flat-rate CDN pricing. And we close with a human angle that I really like: if we wrote incident reports as if a future AI (and your future teammates) will rely on them to debug the next outage, we’d probably write better postmortems today too.

If you run clusters, own reliability, or you’re the person everybody pings when “the pipeline is weird” or “Kubernetes is sad,” this episode should feel very familiar. Show notes below have the source links if you want to go deeper.