Category
Technology with judgment: what actually moves the needle, no passing fads.
Chainguard Images are minimal Docker containers from the company behind Sigstore, with zero known CVEs, Cosign-signed SBOMs and daily rebuilds on top of Wolfi, its own glibc-based distribution. They pay off over official images when strict compliance, supply chain audits or sensitive production workloads are at stake.
In 2024 sustainable data centers move beyond PUE: liquid cooling becomes standard in AI GPU racks, carbon-aware workload scheduling is already practical with tools like the Carbon Aware SDK, and waste-heat reuse has real cases in Stockholm and Helsinki. The EU-wide energy efficiency directive already requires honest metrics instead of greenwashing.
Sigstore has become the standard signing layer for OCI artefacts. GHCR is the best-integrated registry; Harbor 2.5+ and Quay offer native support; AWS ECR pushes its own KMS scheme. Verification earns its keep at three points: the cluster admission controller, the GitOps layer, and the CI/CD pipeline. The public Rekor has rate limits that force self-hosting past a certain build volume.
A model trained in PyTorch or TensorFlow, running the same way on a server, a phone, a browser tab, or an ARM gateway on the factory floor: that is what ONNX Runtime solves. It turns the ONNX format into a genuinely portable artifact, exported once, at the cost of some peak performance versus a platform-native runtime.
Deno Deploy is the serverless-edge platform from the team that built Deno: native TypeScript without a transpile step, standard Web APIs, and global deployment to ~35 regions. Cold start runs ~50ms vs Cloudflare Workers (~5ms). Best for lightweight APIs and Fresh/Astro SSR; less ideal when your project needs the full Cloudflare infrastructure stack.
Loki indexes only labels, not log content, which cuts storage costs dramatically compared to Elasticsearch. The main production risk is cardinality explosion each unique label-value combination generates a stream that inflates the index and slows queries. Separating read and write paths ensures a heavy query cannot saturate ingestion.
Fastly Compute runs WebAssembly code on its ~70 global PoPs with a 35-microsecond cold start. Supports Rust, Go, and JavaScript compiled via Javy. Competes directly with Cloudflare Workers, with advantages for compute-intensive workloads and teams already on Fastly CDN, but at a higher entry cost.
Falco is a graduated CNCF project that hooks the Linux kernel via eBPF and detects syscall anomalies in real time without instrumenting applications. Deployed as a DaemonSet on Kubernetes, it emits JSON events and requires a triage process to deliver value. In production, alert fatigue is the most common operational pitfall.
Signing images and artifacts with Sigstore has stopped being a rare experiment: projects like Kubernetes already use it. The keyless model in cosign, Fulcio, and Rekor removes private-key management, but it only protects you if deployment verifies who signed, not just whether a signature exists.
Installing Docker on Debian 12 means replacing the Debian docker.io package with the official repository: import the GPG key into /etc/apt/keyrings, install the five packages docker-ce, docker-ce-cli, containerd.io, docker-buildx-plugin and docker-compose-plugin, then set log rotation and live-restore in daemon.json before exposing the server to production.
Cloudflare Workers ejecutan JavaScript y WebAssembly en más de 300 ciudades sin gestionar servidores. Dónde brilla el modelo y dónde no llega.
Zero Trust is not a product but a security architecture. It discards the assumption that the internal network is trusted and verifies every access explicitly, with least privilege, assuming breach is already active. The five principles: verify explicitly, least privilege, assume compromise, validate the device, and continuous visibility.
WASI Preview 2 redefines how WebAssembly interacts with the operating system. It introduces the Component Model with typed WIT interfaces and granular capabilities, enabling modules written in different languages to compose without manual serialisation. The full standard arrives in 2024 with direct impact on edge functions, plugins, and serverless.
eBPF is a Linux kernel technology that lets you load and run verified, high-performance programs without recompiling the kernel or rebooting the system. It runs safely inside a virtual machine in the kernel and underpins tools such as Cilium, Pixie, Falco, and Tetragon for real-time tracing, networking, and security.
A digital twin is a software replica of a physical asset (machine, production line, or whole plant) synchronised in real time with IoT sensors. It enables failure prediction, energy optimisation, and operator training without risk. It returns real value when the asset is critical, the data is reliable, and the team can maintain the model long-term.
PostgreSQL 16, released in September 2023, adds logical replication from a standby, the pg_stat_io view for breaking down I/O by operation type and context, and parallel FULL OUTER JOIN support. Upgrading from 15 is straightforward; 13 loses support in November 2025, so plan the update soon.
Rust has been in the Linux kernel since version 6.1, though adoption is measured and deliberate. The Apple AGX GPU driver for Asahi Linux is the most prominent real upstream example. The goal is to eliminate an entire class of memory-safety bugs in new drivers without rewriting existing C code.
On 10 August 2023, HashiCorp changed Terraform from MPL 2.0 to Business Source License v1.1, which prohibits building competing products. For 95% of teams using Terraform internally, the practical impact is nil. Teams building SaaS products on top of Terraform need to review their situation or consider OpenTofu.
OpenTofu is the community fork of Terraform, born in 2023 after HashiCorp switched to the Business Source License. With full file compatibility and Linux Foundation governance, it is the legally safe alternative for organisations with strict open-source policies or for those building products on Terraform.
Trivy and Grype are the two leading open-source tools for container image scanning in CI/CD pipelines. Both detect CVEs in OS packages and language dependencies with less than 5% coverage difference. Trivy stands out for IaC scanning; Grype natively integrates the SBOM workflow with Syft.
Kubernetes 1.27 ("Chill Vibes"), released in April 2023, makes SeccompDefault stable so pods get safer syscall defaults automatically, moves KMS v2 to beta with rotatable encryption keys for etcd secrets, and stabilises scheduling gates. It also removes PodSecurityPolicy for good: without migrating to Pod Security Admission first, the upgrade is blocked entirely.
In 2023, software supply chains became attackers' favourite target: MOVEit exposed data from hundreds of organisations through a zero-day flaw, 3CX shipped a trojanised installer to millions of users, and npm and PyPI kept receiving malicious typosquatted packages. The practical defence combines SBOM, artefact signing with Sigstore, SLSA maturity levels, and continuous dependency scanning.
The Grafana stack combines three open source projects: Loki for logs, Tempo for traces, and Mimir for metrics. All three keep data in object storage (S3/GCS) with a minimal index instead of indexing everything like Elasticsearch, which cuts cost sharply at high volume and lets you correlate metric, log, and trace from a single Grafana panel.
OpenTelemetry is the CNCF project, graduated in May 2026, that unifies logs, metrics, and traces under one SDK and the OTLP protocol, without locking you into a single backend. Traces have been stable since 2021 and metrics since 2023; logs are still maturing, but already worth adopting on new projects.
WebAssembly is moving beyond the browser through WASI, the standard system interface, and the component model, which defines declarative WIT interfaces so modules written in different languages can compose with each other. Cold start lands around 1 ms versus roughly 500 ms for a container, a key difference for serverless and edge computing teams.
Vault centraliza secretos con rotación, auditoría y políticas granulares. Guía práctica para equipos que pasan de .env a gestión seria.
Cilium replaces iptables with eBPF programs loaded directly into the Linux kernel, substituting O(n) linear chains with O(1) hash lookups. Documented benchmarks show up to 50% lower p95 latency, 2-3x more throughput, and 70% less kernel CPU in large Kubernetes clusters.
Five months after launch, GPT-4 excels at chained reasoning, technical writing, and medium-complexity code, but still fails at arithmetic, post-cutoff information, and cross-conversation consistency. Claude 2 wins on long context; LLaMA 2 wins on cost and privacy.
Meta released LLaMA 2 on July 18, 2023 with a royalty-free commercial licence, in three sizes (7B, 13B, 70B parameters). The 70B model matches or beats GPT-3.5 on standard benchmarks. For 99.9% of organisations the licence allows download, modification, and production use with full data privacy and no fine-tuning restrictions.
nerdctl is a Docker-compatible CLI that talks directly to containerd, the standard Kubernetes runtime since dockershim was removed in 2022. It adds rootless support by default, encrypted images with ocicrypt, lazy-pulling, and native CNI. It fits best where containerd already runs, though Docker Engine still wins on advanced Compose and Swarm.
Google's SRE book (2016) is canonical reading, but it is written for thousands of engineers and in-house datacenters: applying it literally on a small team creates friction. Five principles do travel (SLOs, error budgets, blameless postmortems, toil management, humane on-call); what does not scale is Google's infrastructure and dedicated roles.
Kafka gets the headlines as the byword for modern messaging, but RabbitMQ remains the better choice for task queues with retries, asynchronous RPC, and pub/sub with complex routing. This guide compares both against NATS, walks through classic patterns and production mistakes, and helps you decide based on the actual use case rather than the trend.
Kubernetes 1.28 introduces native sidecar containers in alpha via KEP-753: adding restartPolicy Always to initContainers ensures correct startup and shutdown ordering. It fixes Jobs that never terminate. Istio, Linkerd, and observability agents like Fluent Bit are the primary beneficiaries.
Google launched Bard in February 2023 with PaLM 2 as its answer to ChatGPT, unveiling the model in May the same year in four sizes: Gecko, Otter, Bison, and Unicorn. PaLM 2 competes with GPT-3.5 and GPT-4 on benchmarks like MMLU and BIG-bench, but Google's real edge is Workspace integration, not the model itself.
The NIS2 Directive expands European cybersecurity from 7 to 18 sectors, mandates 10 minimum technical measures and 24-hour incident notification, and imposes fines of up to 10 million euros or 2% of global turnover, with personal liability for management bodies that fail to comply.
To write Prometheus alerts that won't get ignored, alert on customer-observable symptoms (latency, error rate, saturation) instead of internal causes like CPU or memory, define SLOs with multi-window burn rate to scale severity, add a watchdog alert that confirms the system is still alive, and review the signal-to-noise ratio every quarter.
Pixie uses eBPF to automatically instrument Kubernetes clusters without modifying application code. A per-node agent captures HTTP, gRPC, SQL, and Redis traffic at the kernel level, exposing service maps, CPU profiles, and SQL traces within minutes. It complements Prometheus for reactive diagnosis with no sidecars or redeploys.
eBPF (Extended Berkeley Packet Filter) is a Linux kernel technology that runs verified programs directly inside the kernel, with no modules and no source-code changes. The kernel verifier rejects any unsafe program before it runs, letting teams monitor system calls, network traffic, and I/O at a much lower CPU cost than traditional external probes.
Migrating from monolith to microservices means splitting a single system into independent services that deploy and scale on their own. It gains granular scalability and team autonomy, but adds real operational complexity: stable interfaces, Kubernetes orchestration, and a mature DevOps culture are conditions, not optional extras, for the migration to pay off.
The customer digital twin is a dynamic virtual representation of a real user, built from behavioural data, preferences, and interactions and updated in real time. Unlike a static CRM profile, it anticipates needs, personalises experiences at scale, and supports proactive decisions about each customer relationship.
The CIO role has been under growing pressure for years. Automation cuts the operational load, merging with the CDO and CTO creates ambiguity over who leads what, and digital transformation demands skills that were not previously required. The CIO who evolves remains indispensable; the one who does not gets left behind.
The best RPA tools on the market are UiPath, Automation Anywhere, and Blue Prism, the three share leaders, followed by WorkFusion, Kofax, NICE RPA, Pegasystems, EdgeVerve AssistEdge, Redwood Software, and Microsoft Power Automate. The right platform depends on organisation size, the AI capabilities needed, and two-year total cost of ownership.
The financial sector is undergoing a deep transformation: blockchain, artificial intelligence, mobile payments, open banking, and big data are redefining who provides financial services and how. The World Bank estimates 76% of adults worldwide now hold a bank or mobile-money account, up from 51% in 2011, and these five technologies explain much of that progress.
3D printing, or additive manufacturing, has moved beyond the lab to become a real production technology: it builds medical prostheses, aircraft parts and entire houses layer by layer from a digital file. This guide explains FDM, SLA and SLS technologies, which industries already use them, and today's limits on speed and material certification.
Augmented reality (AR) overlays digital information onto the physical world in real time, anchors virtual objects in space using computer vision and position sensors, and is already used in industrial maintenance, guided surgery, educational labs and e-commerce product try-on, with battery life and glasses field of view as the main open challenges.
Big Data lets companies analyse huge volumes of data to make faster, better-informed decisions. Tools such as Apache Hadoop, Spark, and Kafka process information in near real time, though the real value depends on data quality, governance, and the questions teams choose to ask.
Renewable energy is now the cheapest source of electricity in much of the world. Battery storage costs have fallen 89% since 2010, commercial solar panels now exceed 22% efficiency, and onshore wind costs dropped 70% in a decade, according to IRENA and BloombergNEF data.
The Internet of Things (IoT) is a network of sensors, actuators, and internet-connected devices that collect data from the physical world, transmit it through protocols like MQTT or Zigbee, and trigger automatic actions. It already transforms industrial maintenance, precision irrigation, and the smart home.
