Engineering posts, architecture writeups, and the occasional hot take.
∅ 339 · 10 min readCLRK pairs gVisor isolation with credential injection - Envoy intercepts every request, so agents never hold your API keys or touch your network directly.
We measured runsc cold boot on a number of hosts across three clouds and one Mac. The fast number isn't the cloud, the slow part isn't the kernel, and most of the obvious fixes do nothing.
Why we built one control plane for HTTPRoute across clusters, and what shipping the managed gateway looks like for self-serve teams and in-VPC deployments.
Forking Julia Evans' Nginx Playground into an Envoy playground in an afternoon - sed, func-e, a CodeMirror fix, and a Fly.io deploy.
Introducing Apoxy: the proxy platform for improving the security, observability, and usability of APIs and services at scale, built on Envoy and WebAssembly.