Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News
Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News

Ship It Weekly - DevOps, SRE, Platform and Cloud Engineering News

Teller's Tech - DevOps, SRE and Cloud Podcast

Overview
Episodes

Details

Ship It Weekly is a short, practical recap of what actually matters in DevOps, SRE, cloud infrastructure, and platform engineering.Each episode, your host Brian Teller walks through the latest outages, releases, tools, and incident writeups, then translates them into “here’s what this means for your systems” instead of just reading headlines. Expect a couple of main stories with context, a quick hit of tools or releases worth bookmarking, and the occasional segment on on-call, burnout, or team culture.This isn’t a certification prep show or a lab walkthrough. It’s aimed at people who are already working in the space and want to stay sharp without scrolling status pages, cloud updates, and blogs all week. You’ll hear about things like cloud provider incidents, Kubernetes and platform trends, Terraform and infrastructure changes, and real postmortems that are actually worth your time.Most episodes are 10–25 minutes, so you can catch up on the way to work or between meetings. Every now and then there will be a “special” focused on a big outage or a specific theme, but the default format is simple: what happened, why it matters, and what you might want to do about it in your own environment.If you’re the person people DM when something is broken in prod, or you’re building the cloud and platform everyone else ships on top of, Ship It Weekly is meant to be in your rotation.

Recent Episodes

Hackerbot-Claw Grows, Xygeni Tag Poisoning, GitHub Search HA, Windows SID Failures, and AI Skills Supply Chain
MAR 27, 2026
Hackerbot-Claw Grows, Xygeni Tag Poisoning, GitHub Search HA, Windows SID Failures, and AI Skills Supply Chain
<p>This episode of <strong>Ship It Weekly </strong>is about the places where convenience quietly turns into trust.</p><p>Brian revisits the Trivy story by zooming out to the bigger hackerbot-claw GitHub Actions campaign, then gets into the Xygeni tag-poisoning compromise, GitHub’s search high availability rebuild for GitHub Enterprise Server, Windows Server 2025 surfacing duplicate SID problems in cloned images, and the agent-skills ecosystem replaying package supply chain history. Plus: a quick lightning round on GitHub pausing self-hosted runner minimum-version enforcement and March secret scanning updates.</p><p><strong>Links</strong></p><p>OpenSSF advisory on active GitHub Actions exploitation <a target="_blank" rel="noopener noreferrer nofollow" href="https://seclists.org/oss-sec/2026/q1/246">https://seclists.org/oss-sec/2026/q1/246</a></p><p>Xygeni action compromise via tag poisoning <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.stepsecurity.io/blog/xygeni-action-compromised-c2-reverse-shell-backdoor-injected-via-tag-poisoning">https://www.stepsecurity.io/blog/xygeni-action-compromised-c2-reverse-shell-backdoor-injected-via-tag-poisoning</a></p><p>GitHub Enterprise Server search high availability rebuild <a target="_blank" rel="noopener noreferrer nofollow" href="https://github.blog/engineering/architecture-optimization/how-we-rebuilt-the-search-architecture-for-high-availability-in-github-enterprise-server/">https://github.blog/engineering/architecture-optimization/how-we-rebuilt-the-search-architecture-for-high-availability-in-github-enterprise-server/</a></p><p>Microsoft on duplicate SIDs and nongeneralized Windows Server 2025 images <a target="_blank" rel="noopener noreferrer nofollow" href="https://learn.microsoft.com/en-us/troubleshoot/exchange/administration/exchange-server-issues-on-incorrect-windows-server-image">https://learn.microsoft.com/en-us/troubleshoot/exchange/administration/exchange-server-issues-on-incorrect-windows-server-image</a></p><p>Socket on supply chain security for <a target="_blank" rel="noopener noreferrer nofollow" href="http://skills.sh">skills.sh</a> <a target="_blank" rel="noopener noreferrer nofollow" href="https://socket.dev/blog/socket-brings-supply-chain-security-to-skills">https://socket.dev/blog/socket-brings-supply-chain-security-to-skills</a></p><p>Snyk ToxicSkills research <a target="_blank" rel="noopener noreferrer nofollow" href="https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/">https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/</a></p><p>GitHub self-hosted runner minimum version enforcement paused <a target="_blank" rel="noopener noreferrer nofollow" href="https://github.blog/changelog/2026-03-13-self-hosted-runner-minimum-version-enforcement-paused/">https://github.blog/changelog/2026-03-13-self-hosted-runner-minimum-version-enforcement-paused/</a></p><p>GitHub secret scanning pattern updates, March 2026 <a target="_blank" rel="noopener noreferrer nofollow" href="https://github.blog/changelog/2026-03-10-secret-scanning-pattern-updates-march-2026/">https://github.blog/changelog/2026-03-10-secret-scanning-pattern-updates-march-2026/</a></p><p>More episodes and show notes at <a target="_blank" rel="noopener noreferrer nofollow" href="https://shipitweekly.fm">https://shipitweekly.fm</a></p><p>On Call Briefs at <a target="_blank" rel="noopener noreferrer nofollow" href="https://oncallbrief.com">https://oncallbrief.com</a></p>
play-circle icon
15 MIN
Ship It Conversations: Ang Chen on Project Vera, AI Cloud Emulation, and Safer Infrastructure Testing
MAR 23, 2026
Ship It Conversations: Ang Chen on Project Vera, AI Cloud Emulation, and Safer Infrastructure Testing
<p>This is a guest conversation episode of <strong>Ship It Weekly</strong>, separate from the weekly news recaps.</p><p>In this Ship It: Conversations episode, I talk with <strong>Ang Chen</strong> from the University of Michigan about Project Vera, a cloud emulator built to help teams test infrastructure changes more safely before they touch real cloud.</p><p>We talk about why testing against real cloud APIs is slow, expensive, and risky, how Vera works under tools like Terraform and CloudFormation, what “high fidelity” actually means, and where a tool like this could fit in local dev and CI/CD.</p><p>The bigger theme is one I think matters a lot: if AI is going to play a real role in cloud operations, it probably needs a sandbox first, not direct access to production.</p><p><strong>Note</strong></p><p>This interview was recorded on February 13, 2026. Since then, Vera’s public project materials have expanded the framing a bit further around multi-cloud support and safe environments for agent learning, so keep that in mind while listening.</p><p><strong>Highlights</strong></p><p>• Why real cloud testing still creates cost, delay, and risk </p><p>• How Vera emulates cloud behavior at the API layer </p><p>• Where this could help with Terraform, CloudFormation, and CI/CD workflows </p><p>• Why “useful enough to catch real mistakes” may matter more than perfect emulation </p><p>• The limits, tradeoffs, and fidelity questions that still need to be solved </p><p>• Why safe training grounds may matter before AI agents touch real infrastructure</p><p><strong>Ang’s links</strong></p><p>• LinkedIn: <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.linkedin.com/in/ang-chen-8b877a17/">https://www.linkedin.com/in/ang-chen-8b877a17/</a> </p><p>• University of Michigan profile: <a target="_blank" rel="noopener noreferrer nofollow" href="https://eecs.engin.umich.edu/people/chen-ang/">https://eecs.engin.umich.edu/people/chen-ang/</a> </p><p>• Publications: <a target="_blank" rel="noopener noreferrer nofollow" href="https://web.eecs.umich.edu/~chenang/pubs.html">https://web.eecs.umich.edu/~chenang/pubs.html</a></p><p><strong>Project Vera</strong></p><p>• Project site: <a target="_blank" rel="noopener noreferrer nofollow" href="https://project-vera.github.io/">https://project-vera.github.io/</a> </p><p>• GitHub: <a target="_blank" rel="noopener noreferrer nofollow" href="https://github.com/project-vera/vera">https://github.com/project-vera/vera</a> </p><p>• The quest for AI Agents as DevOps: <a target="_blank" rel="noopener noreferrer nofollow" href="https://project-vera.github.io/blogs/cloudagent/cloudagent/">https://project-vera.github.io/blogs/cloudagent/cloudagent/</a> </p><p>• No More Manual Mocks: <a target="_blank" rel="noopener noreferrer nofollow" href="https://project-vera.github.io/blogs/cloudemu/cloudemu/">https://project-vera.github.io/blogs/cloudemu/cloudemu/</a></p><p><strong>Stuff mentioned</strong></p><p>• A Case for Learned Cloud Emulators: <a target="_blank" rel="noopener noreferrer nofollow" href="https://dl.acm.org/doi/10.1145/3718958.3754799">https://dl.acm.org/doi/10.1145/3718958.3754799</a> </p><p>• Cloud Infrastructure Management in the Age of AI Agents: <a target="_blank" rel="noopener noreferrer nofollow" href="https://dl.acm.org/doi/abs/10.1145/3759441.3759443">https://dl.acm.org/doi/abs/10.1145/3759441.3759443</a> </p><p>• LocalStack: <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.localstack.cloud/">https://www.localstack.cloud/</a></p><p><strong>Our links</strong></p><p>More episodes + show notes + links: <a target="_blank" rel="noopener noreferrer nofollow" href="https://shipitweekly.fm">https://shipitweekly.fm</a></p><p>On Call Brief: <a target="_blank" rel="noopener noreferrer nofollow" href="https://oncallbrief.com">https://oncallbrief.com</a></p>
play-circle icon
24 MIN
McKinsey AI Flaw, Kafka Goes Diskless, Google Buys Wiz, AWS Copilot Ends, and AI Gateway on Kubernetes
MAR 20, 2026
McKinsey AI Flaw, Kafka Goes Diskless, Google Buys Wiz, AWS Copilot Ends, and AI Gateway on Kubernetes
<p>This week on <strong>Ship It Weekly</strong>, Brian looks at what happens when new interfaces create old responsibilities.</p><p>McKinsey patched a vulnerability in its internal AI tool Lilli, Kafka contributors are pushing a diskless-topics model that rethinks durability and replication in cloud environments, and Google officially closed Wiz acquisition in one of the biggest cloud-security moves. Plus: AWS is sunsetting Copilot CLI, Kubernetes launches an AI Gateway Working Group.</p><p><strong>Links</strong></p><p>McKinsey statement on Lilli</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.mckinsey.com/about-us/media/statement-on-strengthening-safeguards-within-the-lilli-tool">https://www.mckinsey.com/about-us/media/statement-on-strengthening-safeguards-within-the-lilli-tool</a></p><p>Kafka diskless topics proposal</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://cwiki.apache.org/confluence/display/KAFKA/The%2BPath%2BForward%2Bfor%2BSaving%2BCross-AZ%2BReplication%2BCosts%2BKIPs">https://cwiki.apache.org/confluence/display/KAFKA/The%2BPath%2BForward%2Bfor%2BSaving%2BCross-AZ%2BReplication%2BCosts%2BKIPs</a></p><p>Google completes acquisition of Wiz</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://blog.google/innovation-and-ai/infrastructure-and-cloud/google-cloud/wiz-acquisition/">https://blog.google/innovation-and-ai/infrastructure-and-cloud/google-cloud/wiz-acquisition/</a></p><p>AWS Copilot CLI end-of-support</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://aws.amazon.com/blogs/containers/announcing-the-end-of-support-for-the-aws-copilot-cli/">https://aws.amazon.com/blogs/containers/announcing-the-end-of-support-for-the-aws-copilot-cli/</a></p><p>Kubernetes AI Gateway Working Group</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://kubernetes.io/blog/2026/03/09/announcing-ai-gateway-wg/">https://kubernetes.io/blog/2026/03/09/announcing-ai-gateway-wg/</a></p><p>Amazon Bedrock observability for first-token latency and quota consumption</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-bedrock-observability-ttft-quota/">https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-bedrock-observability-ttft-quota/</a></p><p>Cloudflare JSON responses and RFC 9457 support for 1xxx errors</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://developers.cloudflare.com/changelog/post/2026-03-11-json-rfc9457-responses-for-1xxx-errors/">https://developers.cloudflare.com/changelog/post/2026-03-11-json-rfc9457-responses-for-1xxx-errors/</a></p><p>Amazon S3 source-region information in server access logs</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://aws.amazon.com/about-aws/whats-new/2026/02/amazon-s3-source-region-information/">https://aws.amazon.com/about-aws/whats-new/2026/02/amazon-s3-source-region-information/</a></p><p>AWS Config adds 30 new resource types</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://aws.amazon.com/about-aws/whats-new/2026/03/aws-config-new-resource-types/">https://aws.amazon.com/about-aws/whats-new/2026/03/aws-config-new-resource-types/</a></p><p>Amazon Bedrock AgentCore Runtime stateful MCP server features</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-bedrock-agentcore-runtime-stateful-mcp/">https://aws.amazon.com/about-aws/whats-new/2026/03/amazon-bedrock-agentcore-runtime-stateful-mcp/</a></p><p></p><p>More episodes and show notes at</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://shipitweekly.fm">https://shipitweekly.fm</a></p><p></p><p>On Call Briefs at</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://oncallbrief.com">https://oncallbrief.com</a></p>
play-circle icon
14 MIN
Meta Buys Moltbook, Block AI Layoffs Get Messier, Atlassian Cuts Jobs, and GitHub Explains the Outages
MAR 13, 2026
Meta Buys Moltbook, Block AI Layoffs Get Messier, Atlassian Cuts Jobs, and GitHub Explains the Outages
<p>This week on <strong>Ship It Weekly</strong>, Brian covers five “AI meets reality” stories that every DevOps, SRE, security, and platform team can learn from.</p><p>Block’s AI layoff story is getting messier as follow-up reporting pushes back on the original framing, Meta bought Moltbook and brought more attention to the trust and security problems already showing up around AI-agent platforms, and Atlassian cut about 10% of its workforce while saying AI is changing the skills and roles it needs. Plus: GitHub gives one of the more honest outage breakdowns we’ve seen lately, Anthropic and Mozilla show a more grounded AI use case with Claude finding real Firefox bugs, and there’s a quick lightning round on Bedrock AgentCore policy, Dependabot for pre-commit hooks, and Cloudflare’s latest threat report.</p><p><strong>Links</strong></p><p>Block layoffs follow-up</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.theguardian.com/technology/2026/mar/08/block-ai-layoffs-jack-dorsey">https://www.theguardian.com/technology/2026/mar/08/block-ai-layoffs-jack-dorsey</a></p><p>Meta acquires Moltbook</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.theguardian.com/technology/2026/mar/10/meta-acquires-moltbook-ai-agent-social-network">https://www.theguardian.com/technology/2026/mar/10/meta-acquires-moltbook-ai-agent-social-network</a></p><p>Wiz on Moltbook exposure</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys">https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keys</a></p><p>Atlassian team update</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.atlassian.com/blog/announcements/atlassian-team-update-march-2026">https://www.atlassian.com/blog/announcements/atlassian-team-update-march-2026</a></p><p>GitHub availability issues write-up</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://github.blog/news-insights/company-news/addressing-githubs-recent-availability-issues-2/">https://github.blog/news-insights/company-news/addressing-githubs-recent-availability-issues-2/</a></p><p>Anthropic + Mozilla Firefox security</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.anthropic.com/news/mozilla-firefox-security">https://www.anthropic.com/news/mozilla-firefox-security</a></p><p>Anthropic labor market report</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.anthropic.com/research/labor-market-impacts">https://www.anthropic.com/research/labor-market-impacts</a></p><p>AWS Bedrock AgentCore Policy GA</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://aws.amazon.com/about-aws/whats-new/2026/03/policy-amazon-bedrock-agentcore-generally-available/">https://aws.amazon.com/about-aws/whats-new/2026/03/policy-amazon-bedrock-agentcore-generally-available/</a></p><p>GitHub Dependabot support for pre-commit hooks</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://github.blog/changelog/2026-03-10-dependabot-now-supports-pre-commit-hooks/">https://github.blog/changelog/2026-03-10-dependabot-now-supports-pre-commit-hooks/</a></p><p>Cloudflare 2026 Threat Report</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://blog.cloudflare.com/2026-threat-report/">https://blog.cloudflare.com/2026-threat-report/</a></p><p>More episodes and show notes at</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://shipitweekly.fm">https://shipitweekly.fm</a></p><p>On Call Briefs at:</p><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://oncallbrief.com">https://oncallbrief.com</a></p>
play-circle icon
16 MIN
Ship It Conversations: Yvonne Young on Linux Foundations, Mentorship, and Getting Job Ready in Cloud
MAR 9, 2026
Ship It Conversations: Yvonne Young on Linux Foundations, Mentorship, and Getting Job Ready in Cloud
<p>This is a guest conversation episode of <strong>Ship It Weekly</strong> (separate from the weekly news recaps).</p><p>In this Ship It: Conversations episode I talk with <strong>Yvonne Young</strong>, a cloud and Linux mentor active in the CloudWhistler community. We talk about the real path into cloud and DevOps, why Linux still matters as a foundation, what “job ready” actually means, and why focus, consistency, and business thinking matter more than chasing every new tool.</p><p>Highlights</p><ul><li>Linux fundamentals still matter because so much of cloud and infra work sits on top of Linux</li><li>What “job ready” really means: prepare for both technical and behavioral interviews, know the basics, and show how you learn when you don’t know something</li><li>Why so many juniors stall out by trying to learn everything instead of picking a direction</li><li>Why daily reps beat cramming: short, consistent practice keeps skills fresh better than marathon study sessions</li><li>How Yvonne thinks about certifications, including why hands-on certs like RHCSA stand out</li><li>Hands-on practice ideas: break things on purpose, troubleshoot, fix services, inspect ports, and use the help files</li><li>Why tools matter less than the business problem they solve</li><li>Using Vault as an example of solving real issues like secret sprawl, rotation, and centralized access</li><li>How to think about cloud learning: pick one provider, learn the concepts, and map your path to the kinds of companies you want to work for</li><li>Why mentorship and community matter, especially for juniors trying not to waste time or head in the wrong direction</li><li>What seniors can do better: better onboarding, real availability, and giving juniors an actual lifeline when they get stuck</li></ul><p>Yvonne’s links</p><ul><li>LinkedIn: <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.linkedin.com/in/yvonne-young">https://www.linkedin.com/in/yvonne-young</a></li></ul><p>Stuff mentioned</p><ul><li>Ali Sohail on LinkedIn: <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.linkedin.com/in/alisohailit/">https://www.linkedin.com/in/alisohailit/</a></li><li>Tech With Engineers on LinkedIn: <a target="_blank" rel="noopener noreferrer nofollow" href="https://uk.linkedin.com/company/tech-with-engineers">https://uk.linkedin.com/company/tech-with-engineers</a></li><li>CloudWhistler community / training: <a target="_blank" rel="noopener noreferrer nofollow" href="http://training.cloudwhistler.com">training.cloudwhistler.com</a></li><li>Vault: <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.hashicorp.com/en/products/vault">https://www.hashicorp.com/en/products/vault</a></li><li>OpenBao: <a target="_blank" rel="noopener noreferrer nofollow" href="https://openbao.org/">https://openbao.org/</a></li></ul><p>More episodes + details: <a target="_blank" rel="noopener noreferrer nofollow" href="https://shipitweekly.fm">https://shipitweekly.fm</a></p>
play-circle icon
30 MIN