Build once, promote forever
Why rebuilding an image per environment is how config leaks into binaries — and how promotion replaces it.
Writing
Field notes.
Essays on Go, delivery pipelines, security, and the operational details most tutorials skip. RSS feed available.
The CSP nonce that bit back
A field report on strict CSP with htmx: what broke, what the spec actually says, and the one line that fixes it.
Graceful shutdown is a product feature
What a 15-second drain window buys you, and why SIGKILL defaults are a tax on every deploy.
Rate limiting you can actually reason about
Token buckets per IP, why the reaper matters, and how to pick a burst that doesn't punish real humans.
Reading the Go memory model so you don't have to
The five happens-before edges that cover 95% of real concurrent code.