Peter WiggersNotes on cloud, platform engineering, security and AI.https://p10s.cloud/Stop rebuilding your CI runner on every pushhttps://p10s.cloud/posts/warm-ci-runners/https://p10s.cloud/posts/warm-ci-runners/Stateless CI runners made builds clean, and then made us write caching logic into every workflow. Warm microVM snapshots give you a disposable runner that already remembers everything.Sat, 03 Oct 2026 00:00:00 GMTSovereignty needs an exit, not just an addresshttps://p10s.cloud/posts/sovereignty-is-an-exit/https://p10s.cloud/posts/sovereignty-is-an-exit/Hosting with a European company is necessary, but it doesn't make you sovereign on its own. Being able to move between European providers whenever you want does.Tue, 15 Sep 2026 00:00:00 GMTOne private network for my clusters, my colleagues and my living roomhttps://p10s.cloud/posts/tailscale-everywhere/https://p10s.cloud/posts/tailscale-everywhere/Why I love Tailscale, and how I use it to reach Kubernetes APIs, Postgres, colleagues' machines and my Home Assistant setup without opening a single port.Tue, 21 Apr 2026 00:00:00 GMTWhat two SOC 2 cycles taught me about security engineeringhttps://p10s.cloud/posts/soc2-two-years-in/https://p10s.cloud/posts/soc2-two-years-in/Compliance frameworks are mostly about proving you do what you say. Here's how to make that cheap.Tue, 03 Mar 2026 00:00:00 GMTUse the cloud, just don't let your code know which onehttps://p10s.cloud/posts/managed-open-source/https://p10s.cloud/posts/managed-open-source/My one rule against vendor lock-in. Only use managed open source, so your application talks PostgreSQL, RabbitMQ and Kubernetes, and never a cloud SDK.Tue, 13 Jan 2026 00:00:00 GMTMaking Flux fast with 1,200 tenants in one repositoryhttps://p10s.cloud/posts/flux-performance/https://p10s.cloud/posts/flux-performance/What I learned tuning Flux's kustomize-controller for a monorepo with 1,200 tenants, including a /tmp trick that made it into the official Flux docs.Tue, 11 Nov 2025 00:00:00 GMTYour DNS ad blocker is a man in the middle you invitedhttps://p10s.cloud/posts/dns-blocklists-trust/https://p10s.cloud/posts/dns-blocklists-trust/DNS-level ad blocking with public blocklists is great, until you realise you've given strangers the power to rewrite where your traffic goes.Tue, 23 Sep 2025 00:00:00 GMTPick an LLM provider you can walk away fromhttps://p10s.cloud/posts/provider-agnostic-llms/https://p10s.cloud/posts/provider-agnostic-llms/Notes on designing AI features for a regulated SaaS where auditability matters more than the leaderboard.Tue, 05 Aug 2025 00:00:00 GMTWarm standby beat multi-cloud, and it wasn't closehttps://p10s.cloud/posts/warm-standby-over-multi-cloud/https://p10s.cloud/posts/warm-standby-over-multi-cloud/A regulated customer asked for multi-cloud resilience. What they actually needed was a second region and a rehearsed failover.Tue, 17 Jun 2025 00:00:00 GMTInternal apps deserve real certificates toohttps://p10s.cloud/posts/internal-apps-real-certificates/https://p10s.cloud/posts/internal-apps-real-certificates/Stop installing private root CAs on every device. With Let's Encrypt DNS validation, internal apps get publicly trusted certificates without ever being reachable from the internet.Tue, 29 Apr 2025 00:00:00 GMTYour requests and limits are where the cloud bill hideshttps://p10s.cloud/posts/requests-and-limits/https://p10s.cloud/posts/requests-and-limits/How right-sizing Kubernetes workloads cut public cloud spend by roughly 40% across thirty-odd clusters.Tue, 11 Mar 2025 00:00:00 GMTDatabase migrations in GitOps need a Job, not a pipelinehttps://p10s.cloud/posts/flux-database-migrations/https://p10s.cloud/posts/flux-database-migrations/With Flux there's no deploy pipeline to run migrations in. A Kubernetes Job in its own Kustomization, plus one dependsOn, gets you migrations that run once and before your app.Tue, 21 Jan 2025 00:00:00 GMT