270
Reddit DevOps. #devops Thanks @reddit2telegram and @r_channels
Thinking about learning DevOps
Hey,
So I self-studied full stack dev, created a shift management app for my manager (I work as a guard) and I can't find a job in my country.
I was thinking, maybe I should go with DevOps and I have this question:
If a person studied full stack for 1 year, and other person studied DevOps for 1 year, then they both would look for a job, who would probably find a job faster?
Also, I would be really glad to get insights from you guys, since you know much more than I do!
https://redd.it/1xt9xum
@r_devops
How to learn while also completing tasks?
I got hired as a junior devops engineer and I want to learn more about the tools we're using to get a better understanding of them but I also need to complete tasks that I'm assigned. It just feels like there's a lot I have to learn since I haven't done most of the things I'm currently doing before.
How do you recommend balancing learning and working?
https://redd.it/1xt9f2g
@r_devops
What’s the one tool in your stack you wish you could throw in the bin?
Not necessarily because it's completely useless, but because of the friction, overhead, or constant maintenance it causes your team.
Mine is Helm. What’s yours?
https://redd.it/1xsvrsd
@r_devops
Running additional checks after automated code review
Can somebody give me some guidance please. After you've run code review, what's the easiest/fastest/best way to check the changes against information outside the repo? Say, whether a connection-pool change will fit within the production database 's connection limit across all replicas.
Where does the check happen in your workflow? CI, a deployment gate, or someone checking it manually? Have you found a useful way to automate it?
https://redd.it/1xsr3pd
@r_devops
I made a free CLI that tells you which Dependabot alerts actually need fixing
Got tired of digging through lockfiles to figure out which Dependabot alerts mattered, so I built fixornix ("fix or nix").
Run npx fixornix in your repo and it sorts every open alert into:
Fix now, with the exact command or upgrade that unlocks it
Blocked, showing which package is holding it back
No fix yet
Not in your build: safe to dismiss (e.g. Linux-only crates when you ship Windows)
Works with npm, yarn, pnpm and Cargo. Zero dependencies, MIT.
https://github.com/munitkala/fixornix
https://redd.it/1xsbl3j
@r_devops
Do I need release branches in this workflow, or another long lived branch?
Developing a new workflow for my team but i am new to a lot of these concepts.
Current approach is generally:
1. Devs cut from main
2. Make changes & PR back to main. Automated tests run
3. At end of sprint, release branch is created, cut from main. Full integration test is run on this along with some manual checks. This technically runs every evening on main as well (minus the manual checks)
4. Github Release is created from release branch.
5. Hotfix - changes are PR into main same as any other change and cherry picked onto latest release branch. New release created.
Does this sound reasonable?
Another solution might be to have another long lived branch called prod. Hotfixes are PRs to both main & prod. Every sprint we merge main into prod, then Release from prod. This seems simpler, but maybe I’m missing something.
We are a data team using Dataform and really need to maintain multiple release versions like a software app, if that makes a difference
https://redd.it/1xsacej
@r_devops
Sys admin to devops
I have been in IT industry for 2 years and really want to get into cloud engineering, cloud support, platform support roles or DevOps but have been struggling my cv is mostly as below can you give some experience and guidance? I generate a quick summary using AI as would like to avoid putting too much personal information. I would really appreciate advice on what would make you as hiring manager hire me for devops.
SYSTEMS ENGINEER
2024 – Present
• Administer and optimise on-premises and cloud infrastructure across Microsoft 365 and Azure environments.
• Design and maintain Azure resources
• Implement identity and access management
• Utilise Azure Monitor, Log Analytics, Microsoft Defender for Cloud, Defender for Identity and Defender EDR.
• Successfully delivered cloud projects including Microsoft 365 tenant migration, cloud transition initiatives and Defender XDR implementation.
• Support cloud infrastructure availability, disaster recovery, performance and security initiatives.
CERTIFICATIONS
• AWS Certified Solutions Architect – Associate
• Microsoft Certified: Azure Administrator Associate (AZ-104)
• Microsoft Certified: Identity and Access Administrator Associate (SC-300)
• Microsoft Certified: Azure Fundamentals (AZ-900)
PROJECTS
LARGE MICROSOFT 365 TENANT MIGRATION
• Participated in a large Microsoft 365 tenant-to-tenant migration project.
• Migrated Exchange Online, SharePoint Online, Teams and OneDrive workloads.
• Assisted with migration of more than 30TB of organisational data.
• Worked within a five-person migration team on planning, issue resolution and deployment activities.
AWS CLOUD RELIABILITY & OBSERVABILITY PROJECT
• Designed and deployed a serverless AWS solution using AWS Lambda, Terraform, Docker, React and LocalStack.
• Implemented Infrastructure as Code (IaC) concepts for cloud resource provisioning.
• Designed CI/CD workflow concepts for automated deployment and testing.
• Evaluated Amazon CloudWatch, AWS X-Ray and CloudTrail Insights for monitoring
• Implemented reliability patterns including retry mechanisms and failure testing.
https://redd.it/1xrxrpz
@r_devops
Go vs Python for DevOps: which one is more worth learning?
Besides Bash, which language is more worth learning for devops: Go or Python? Which one would you recommend focusing on?
https://redd.it/1xrryhc
@r_devops
Weekly Self Promotion Thread
Hey r/devops, welcome to our weekly self-promotion thread!
Feel free to use this thread to promote any projects, ideas, or any repos you're wanting to share. Please keep in mind that we ask you to stay friendly, civil, and adhere to the subreddit rules!
https://redd.it/1xrlgil
@r_devops
DB based app for pics
I'm thinking about writing an app in C# (for desktop) to store all my photos in. Before I start thinking about actually starting work on it, I need to decide what DB or other storage mechanism to use. The idea is to make the pics more accessible by storing some info about content in a field in the DB. That field needs to be "text searchable". I have 10 years experience working with Oracle Text Search engine but I'm not a millionaire; more an impoverished pensioner, so I need to implement this system using one of the free DBs like MySQL.
I thought I'd ask the hive mind what it thinks would be the best DB for my purposes.
https://redd.it/1xr1vh7
@r_devops
bootstrap K3s over SSH in < 27s 🚀
everyone!
I've been working on an open-source project called k3sctl, written in Go.
k3sctl currently supports:
\- High Availability (HA) cluster setup.
\- Air-gapped installations (partially supported; improvements are ongoing).
\- Single-node cluster deployment.
\- Multi-node cluster deployment.
I've tried to keep the tool as simple as possible, with a straightforward YAML configuration and CLI workflow, while making K3s cluster provisioning and management easier.
I started building this tool because I wanted a simpler way to bootstrap and manage K3s clusters, especially across multiple remote Linux machines.
My goal is to make cluster provisioning and lifecycle management easier through a declarative YAML configuration and a single CLI workflow.
I'm continuously working on improving it and adding more capabilities.
I'd really appreciate it if you could take a look at the project, try it out, and share your thoughts or feedback.
Whether it's suggestions, bugs, improvements, or even criticism, everything is welcome. It would be very helpful in making this project better.
⭐ GitHub:
https://github.com/nirantarasi/k3sctl
Thanks for taking the time to check it out! 🙌
\#Kubernetes #K3s #Golang #OpenSource #DevOps
https://redd.it/1xr2jp8
@r_devops
Is committing config-only .env files (no secrets) to a private repo really a security sin?
I'm working on a project split across several private GitHub repos. The ones that matter here are the Docker repo, the backend and an indexer. Each has its own .env files, and what's in them falls into three groups:
\- Secrets like DB passwords, API keys and tokens
\- Infra config such as private IPs of our fixed servers
\- Backend tuning parameters we adjust depending on VPS size and load
Some fine gentleman on X posted this. "Not pushing .env files even to a private repo is like locking your front door but still keeping your valuables in a safe." I fully agree with that for secrets. They stay out of git, no debate there.
This is only about the config part. Having it in the repo would make DevOps work a lot easier. We'd get change history and PR review when someone tweaks a value, and no more copying files around by hand when setting up a server or onboarding someone.
My main concern is whether committing config-only .env files to a private repo is an actual security problem, or if "never commit .env" is really just about secrets. Also, is it a "security sin" to push a .env with private IPs? And how do you split secrets from config in practice, especially across multiple repos?
Thanks in advance!
https://redd.it/1xq4acv
@r_devops
how much money are you wasting on gpus doing nothing?
instead of talking about idle hardware in theory, let me give you a specific headache we just hit. we have a local server with four 24gb cards.
two of those cards are locked up hosting two different low frequency models. one runs a fine tuned llama 3 8b for a background data extraction job. the other runs a qwen model for an internal bot. they get maybe fifty requests an hour combined. but because the weights just sit there taking up vram, two entire cards are held hostage doing almost nothing all day.
now we need to spin up a heavier 70b model for a new coding workflow, and suddenly we have no free cards. i look at the vram occupation in gpustack and see those two low traffic models just wasting dedicated space. so now i have to reallocate resources. i can either ask for budget to buy more hardware, or i try to pack both of those low frequency models onto a single card so i can free one up for the 70b.
what do you all do when you hit this wall? do you just keep dedicating specific cards to specific models to avoid the headache, or do you actively co-locate low traffic models onto the same gpu? when do you stop throwing money at new hardware and start packing your models tighter?
https://redd.it/1xq3vkb
@r_devops
How do you piece together events across services when correlation IDs are missing or inconsistent?
Hey all, been thinkin about this while looking at log aggregation in environments with a mix of older and newer services.
Some services have request IDs or trace IDs in their logs, while others only include timestamps, hostnames, and application specific fields. When an issue spans multiple services, connecting the events can turn into quite a bit of manual digging.
Do you rely on distributed tracing, build correlation rules around the fields available in your logs, or use a combination of both?
I'm especially interested in what you guys do with older services that don't support consistent request IDs.
https://redd.it/1xpese4
@r_devops
Grafana: Our latest adventure with canary tokens
https://medium.com/grafana-labs/how-weve-evolved-our-use-of-canary-tokens-for-greater-coverage-and-less-overhead-b3b4f91edfae
https://redd.it/1xpdbnl
@r_devops
What are DevOps Interviews like?
Hi guys!
For background im 19 from England working as a junior devops engineer, 1 year 3 months experience, looking around at hopping to other company's at the moment.
On a day to day I work with Prometheus, Grafana, an aiops system self service automstions (less so kubernetes and infra but more like just automating access to stuff), cloud (on a low level, i only manage around 20 ec2 instances and 2 ecs clusters) and front end dev for the self service
When interviewing initially I was simply asked knowledge questions like what is docker used for how is a docker file composed what is prometheus used for how would i begin debugging etc.
I know interviews arent standard from company to company but what do they tend to be like for DevOps engineers? Would it be a focus on like actually demonstrating with them watching similar to leetcode but for devops tooling or is it similar to my initial interview? Or a mix im not sure of!
Along with that, any advice on things I should be brushing up on as a junior?
Thanks!
https://redd.it/1xta5ra
@r_devops
Need Guidance..
I'm a Devops engineer with 1.5 yoe. Currently working in a service based company I mostly work on tools like argocd, Githubactions, AWS. kubernetes, Openshift, Nginx, HAproxy, Terraform and Linux these are my major working techs. What more I can learn in Devops or I should learn AI development and move to AI engineering field?
https://redd.it/1xszn5r
@r_devops
llx: a fast, lightweight coding agent in Rust: one 2.8 MB binary, any model, built for the terminal and CI
I've been building llx, an agent runtime that is a single static binary (2.8 MB, macOS and Linux, MIT). The video is a real session on Claude Haiku 5.5, with long model waits trimmed:
1. /model lists every model from the providers you're signed in to, and you pick one
2. it fixes a failing test in a sandbox: 5 s, $0.0007
3. two agents work in parallel (one adds mode() with a test, one writes a README), and the main agent checks their work
4. git diff | llx decide … answers a question about the diff in \~0.4 s
5. llx exec --schema checks the change as CI would and prints JSON
What it is
Five tools and nothing else: `bash`, `apply_patch`, `ask`, `agents`, `jobs`. No plugins, no MCP servers, no skills inside the agent.
Any provider: a ChatGPT sign-in, OpenRouter, or your own key for 200+ providers via the models.dev catalog. Switch models mid-session.
Sandboxed by default: commands run in the OS sandbox (Seatbelt on macOS, Landlock + seccomp on Linux). They write only inside the workspace (never `.git`), with no network; anything beyond that is asked. Rules come from your command line and settings, never from the repo.
Built for pipelines: llx exec runs one task, prints JSON events and ends with an exit code you can branch on. --schema makes it end with data matching your JSON Schema. --budget, --timeout and --max-turns cap a run. A GitHub Action wraps the same step.
A quick judgment for scripts and other agents: `llx decide "does this diff break the API?" --choices yes,no` prints one option on stdout. Pipe `rg` into it and you get a code search by what code does, not what it's named.
Try it
Site and docs: https://llx.sh
Source: [https://github.com/rsaryev/llx-cli](https://github.com/rsaryev/llx-cli)
Ready-made uses of llx: https://github.com/rsaryev/llx-cli/tree/main/examples
I'd love feedback, especially on the exec/decide workflow in CI, and on what breaks for you.
https://redd.it/1xsubus
@r_devops
Future of Devops engineers with IA
Hello Folks , as a devops engineer, I'm curious about the future of our jobs
Will AI replace DevOps engineers, or will it simply change the way we work? What skills should DevOps engineers focus on to stay relevant in the coming years?
I'd love to hear your thoughts, experiences, and predictions!
https://redd.it/1xsmsbc
@r_devops
I built AgentStory to make Codex and Claude Code sessions easier to find, revisit, and share
https://www.reddit.com/r/devops/comments/1xrlgil/weekly_self_promotion_thread/19sdkizhtlw00/
https://redd.it/1xsc4pp
@r_devops
I want to put secrets and env vars in git, fight me
So at work we have all the Kubernetes manifests in one repo then we have ArgoCD pointed at that repo. Within that repo we use kustomize and have a pretty vanilla kustomize setup:
/services
/my-app
/base
deployment.yaml
...
/overlays
/dev
kustomization.yaml
/prod
kustomization.yaml
So basically I would love to be able to do something like this:
/services
/my-app
/base
deployment.yaml
...
/overlays
/dev
kustomization.yaml
.env <- secrets stored as plain text here
/prod
kustomization.yaml
I understand why you don't want to commit secrets to git. I just wish there was a good way to do it. I have seen things like SOPS but I don't like that the secrets are encrypted. Having to deal with them being encrypted is as much of a headache as just using an external secrets manager. How can we have the convenience of putting the secrets in git in plain text and somehow still make it safe?
Edit: Adding my idea
What if in the repo I have a .env file but it just has placeholders
VERY_SECRET=placeholder
Then I have an ide plugin or something that will fetch the env vars dynamically in my ide.
I can change them as if they are code but when I commit they dont actually get committed, instead they get written to the external secrets manager. Anyone done anything like this?
https://redd.it/1xs6mlv
@r_devops
How do you keep track of tools nobody uses anymore?
Our engineering team uses different tools for monitoring, testing, CI/CD, security, and cloud services. Over time, we end up with multiple subscriptions, and it is hard to tell which ones are still needed. The bigger problem comes when a project ends, someone leaves the team, or we switch to a different tool. Some subscriptions stay active because nobody remembers who signed up for them or when they are supposed to renew. We also do not have one place to check billing dates, costs, and who is responsible for each tool. Going through invoices every month is not exactly practical either.
How do you guys handle this in your teams? Do you keep a shared spreadsheet, review subscriptions every few months, or use something to track everything? And who takes responsibility for cancelling tools that are no longer needed?
https://redd.it/1xrvzy6
@r_devops
New to AWS: Project-based roadmap for production-ready infra? (Course & tutorial recs?)
Hi everyone,
I am completely new to AWS and want to learn through hands-on, project-based learning. My ultimate goal is to understand how to build and deploy production-ready infrastructure.
I'm looking for advice on the best approach:
Courses: Are there specific tutorials or paid Udemy courses you recommend for deep, production-level engineering?
Strategy: Should I follow structured courses first, or jump straight into a project and learn as I go?
If you were starting over today with this goal, what roadmap or courses would you choose?
Thanks for the help!
https://redd.it/1xrt02l
@r_devops
zensteagarden/intention-harness: The Intention Harness by John Patrick Daly: a proposed architecture for intention-guided technical work, verified milestones, and recovery after interruption.
https://github.com/zensteagarden/intention-harness
https://redd.it/1xrgmqd
@r_devops
What is VPS provider for production?
I’m looking for a cost-effective VPS provider for one of my systems. I’m currently using GreenCloud, but they’ve had too many outages recently, causing frequent issues in my production environment. Does anyone have recommendations for a more reliable provider?
I’ve checked Vultr and DigitalOcean—they are great providers, but their pricing isn't quite budget-friendly for me.
Thanks a lot for your time!
https://redd.it/1xqs0e8
@r_devops
How to enable SSH clone on self hosted GitLab running in a private subnet behind an AWS ALB?
We have self-hosted GitLab CE on an AWS EC2 instance.
Current setup:
The instance is in a private subnet with no public IP.
Users reach GitLab through an Application Load Balancer on HTTPS, with access restricted to our office IPs.
HTTPS clone with personal access tokens works fine.
The problem:
We're moving our repos from gitlab.com to this server. On gitlab.com, all our Jenkins jobs and developers clone over SSH (git@...). On our server SSH clone doesn't work, because the ALB only supports HTTP/HTTPS, so port 22 has no way in.
Our Jenkins agent runs in the same AWS VPC. Developers connect from the office network or VPN.
What's the best way to enable SSH clone here, keeping it secure and limited to our office and Jenkins? Any suggestions or experience with a similar setup would help.
https://redd.it/1xq5aof
@r_devops
Across the whole DevOps stack (Pipelines, Terraform, K8s, Docker, Ansible), how much do you actually write by hand vs prompting or using templates?
With so many different syntaxes and configs in our daily stack—CI/CD pipelines (GitHub Actions, GitLab), Terraform modules, Kubernetes manifests, Dockerfiles, Ansible playbooks, and Bash scripts—nobody can memorize every block and flag from scratch.
My current workflow is to use AI or existing templates to generate the initial boilerplate for Terraform resources, pipeline YAML, or K8s manifests, and then manually write, wire up, and audit the core architecture, state management, IAM/permissions, networking, and security logic.
For those working in production environments (and those running technical interviews):
1. In your day-to-day work, what parts of the stack do you still write completely by hand vs prompting an LLM or pulling from docs?
2. Where has AI actually helped you across Terraform, CI/CD, and K8s, and where does it consistently break things?
3. What is the realistic expectation in interviews right now regarding writing configs from memory vs understanding the underlying systems and debugging?
https://redd.it/1xq3jjl
@r_devops
Is anyone still using railway after the breach?
I’m just wondering if people still are with them and if they switched. Would love to know where you guys switched if u did
https://redd.it/1xpubc0
@r_devops
Is GHA + ArgoCD still the default CD standard or are you using something else?
Evaluating CD tools to automate our end to end delivery (build, test, packaging, and deployments). Curious if the standard GHA + Argo/Flux combo is still what most teams stick with, or if there are dedicated delivery/orchestration tools actually worth looking at in 2026.
https://redd.it/1xpf9nt
@r_devops
Is this offer a stepping stone or detour toward infrastructure roles?
Hi together,
I have been working in a consulting role for the past 2 years where I build Kubernetes Cluster blueprints that are preconfigured with tooling and best-practices for our customers and they can then spin them up. It is fun but not really challenging and one issue is that we don’t do long term ownership of systems and just build and leave. Also the clusters are never really big (20 nodes maybe) as otherwise the customer would have expertise themselves.
My goal for the past 10 months or so has thus been to get into a Tech company that has massive scale in a role where I build and own infrastructure (cluster, nodes, observability, scaling etc.). I have had a few interviews at such companies in that time but never made it to an offer.
I’ve now received an offer from a fintech for their platform team that serves about 800 developers. The team provides reusable abstractions via Terraform and CI pipelines to developers, but doesn’t own the developers’ infrastructure. They do run their own Kubernetes clusters for security scanning, GitLab runners, etc., which will end up bigger than the clusters I build for customers.
My concern is that this role moves me away from what I actually want to do, which is building and operating Kubernetes infrastructure at scale, and pushes me into DevEx instead, as the core of the job is not building and operating Kubernetes anymore. Do you think I can still move into Kubernetes cluster/infrastructure-focused roles from there, or would this pigeonhole me? For context, I also contribute to Kubernetes, so I’d keep working on that on the side either way.
https://redd.it/1xpbhpv
@r_devops