Digest #212: GitHub Actions Weakest Link, Lambda's Invisible Network, Cloudflare's AI Stack and Terragrunt is Dead
Pulling back the curtain on Lambda's invisible network to GitHub Actions being the biggest CI/CD attack surface. Add Cloudflare sharing the internal AI engineering stack they actually use.
TeamCity 2026.1 introduces a set of focused improvements that make your CI/CD more intuitive, intelligent, and enterprise-ready.
Werner Vogels published a detailed look at the engineering behind Lambda’s network. On the security side, GitHub Actions is identified as the weakest link in your CI/CD chain, with a thorough breakdown of how supply chain attacks can move through workflows. Cloudflare shared the internal AI engineering stack they actually run, including how they’re orchestrating AI code review at scale across their own engineering org. Halodoc documented their migration of AWS MSK from ZooKeeper to KRaft using a canary approach, and one team explains why Dockerfile practices cost you before they ever become a security problem.
On the tutorial side: a $1,432 to $233/month hosting cut by moving from DigitalOcean to Hetzner with zero downtime, Terraform module design via an AI agent skill built around design decisions first and code generation second, a detailed argument that Terragrunt’s run-all is broken beyond repair by multi-state transactions, benchmarking workflow execution scalability on Postgres, building a production MCP server in Go, auto-diagnosing Kubernetes alerts with HolmesGPT, and Cloudflare’s own AI code review pipeline in depth.
For videos this week: a practical terminal setup combining Tmux, btop, and GPU monitoring into a single system monitoring workflow, a real-world look at what a billion database rows actually looks like in production, and an investigation into why companies spend millions buying GitHub stars.
This week’s open source picks include JuiceFS, a Go-based POSIX file system that stores data in S3 and metadata in Redis or MySQL with 10x the sequential throughput of EFS; Gatus, a Go health dashboard that monitors over HTTP, TCP, DNS, gRPC, and 40+ alerting integrations; kured, the CNCF Sandbox Kubernetes daemonset that automates safe node reboots using API server locking; and RedAI, a TypeScript and Python workbench that validates AI-discovered vulnerabilities in live browser and simulator environments before generating reports.
AI, Pipelines, and Enterprise CI/CD
TeamCity 2026.1 introduces a set of focused improvements that make your CI/CD more intuitive, intelligent, and enterprise-ready. Join us on May 12th for a live walkthrough of the latest updates, including the new TeamCity CLI and MCP support!
Newsworthy stories
Tutorials of the week
Migrating from DigitalOcean to Hetzner: from $1,432 to $233/month with zero downtime
Auto-diagnosing Kubernetes alerts with HolmesGPT and CNCF tools
Videos of the week
Projects of the week
JuiceFS is a Go-based POSIX distributed file system that stores data in S3 and metadata in Redis or MySQL, with 10x more throughput than EFS.
Gatus is a Go health dashboard that monitors services over HTTP, TCP, DNS, gRPC, and SSH with 40+ alerting integrations.
winpodx is a Python tool that runs Windows apps as native Linux windows using FreeRDP RemoteApp and a containerized Windows instance.
kured is a Go Kubernetes daemonset that safely reboots nodes one at a time using API server locking. CNCF Sandbox project.
RedAI is a TypeScript/Python workbench that uses AI agents to find and validate vulnerabilities in live browser and simulator environments.
Rocky is a Rust control plane for data warehouse pipelines with column-level lineage, schema drift detection, and compile-time data contracts.
Meme of the week
If you have feedback to share or are interested in sponsoring this newsletter, feel free to reach out via LinkedIn or simply reply to this email.