Overview Kubernetes v1.24 officially removed dockershim, meaning Docker Engine is no longer used as the K8s container runtime. Instead, CRI-compliant (Container Runtime Interface) runtimes are used, with containerd being the de facto standard choice. Many ops teams perceive containerd as merely a “Docker replacement,” but its architecture, image management, and CLI tools differ significantly from Docker. This article provides a deep dive into the CRI specification, containerd architecture, daily operations, and migration from Docker....

Overview Woken up by an alert at 3 AM, facing an unfamiliar service — how fast can you recover? If you need to scroll through chat logs, ask colleagues, and dig through code to figure out what to do, your team is missing one thing — a Runbook. A Runbook is the most fundamental yet most easily overlooked engineering practice in the SRE framework. It bridges the gap between “alert” and “action” — an alert tells you “something is wrong,” and a Runbook tells you “what to do....

Overview In the Prometheus monitoring system, Service Discovery (SD) is the bridge connecting “monitoring targets” to the “scrape engine.” When your infrastructure scales from a few VMs to hundreds of Kubernetes Pods, cross-AZ cloud instances, and Consul-registered nodes, manually maintaining static_configs becomes a nightmare — every scale-up, scale-down, or migration requires config changes and Prometheus restarts, and alerts may misfire due to unreachable targets. Prometheus natively supports over a dozen service discovery mechanisms that can automatically detect target changes without restarts....

Overview Logs are the most authentic record left by a running system. When something goes wrong in production, logs are the first crime scene; when you need insight into system behavior, logs are the richest data source. But log analysis isn’t just about grep-ing a few keywords — facing tens of GB of logs daily, you need efficient parsing, flexible aggregation, intelligent anomaly detection, and clear visualization. This article builds a complete log analysis toolkit from scratch using Python....

Overview The process scheduler is a core component of the operating system kernel — it determines which process runs on which CPU and for how long. Linux has used CFS (Completely Fair Scheduler) as its default scheduler since 2.6.23, and after years of evolution, introduced EEVDF (Earliest Eligible Virtual Deadline First) to replace CFS in the 6.6 kernel. This article provides an in-depth analysis of CFS principles, nice/cgroup CPU control, real-time scheduling, CPU affinity, and other core topics, with production tuning experience....

Overview 3 AM. Your phone buzzes. You get out of bed, open your laptop, SSH in, and find a service with CPU spiking. Kill the process, restart the service, 12 minutes done — but you’re wide awake now. 4:30 AM, another alert: disk usage exceeds 85%. Get up again, du -sh to locate, delete old logs, 15 minutes. This is the daily reality for countless operations engineers. Monitoring is set up, alerts are configured, scripts are written — but the final step still relies on humans....

Overview Incidents are inevitable, but the quality of your incident response determines the impact scope and duration. A mature incident response framework can bring order to chaos — ensuring the right people do the right things, information flows where it needs to go, and recovery happens as fast as possible. The reality many teams face during incidents: alert bombardment, chat channel flooding, unclear ownership, duplicate investigations, inconsistent external messaging, and inability to explain what happened after recovery....

Why Distributed Tracing In a microservices architecture, a single user request often traverses multiple services. When an endpoint’s latency spikes from 200ms to 2s, logs are scattered across N machines, making it difficult to pinpoint the bottleneck — is it slow gateway forwarding, a slow downstream DB query, or queuing in an inter-service call? Distributed tracing solves exactly this problem: it generates a globally unique Trace ID for each request, propagates it across services, and ultimately renders a complete call chain tree in the UI, making the duration of each segment visible at a glance....

Overview Memory is one of the most precious resources in a Linux system. Understanding how the kernel manages memory not only helps you troubleshoot OOM and memory leak issues in production, but also enables better decisions in capacity planning and performance tuning. This article starts from the virtual memory model and covers core topics including Page Cache, Swap policies, OOM Killer principles, cgroup v2 memory limits, slab/shmem tuning, with multiple production case studies....

Overview Among the three pillars of observability (Metrics, Logs, Traces), logs are the data closest to the application layer. When an online service misbehaves, the first instinct is usually “check the logs.” The ELK Stack (Elasticsearch + Logstash + Kibana) is the de facto standard in log analysis, offering powerful capabilities in full-text search, log parsing, and visual analytics. With the rise of “lightweight” log solutions like Loki, ELK faces criticism for “high storage costs and operational complexity....