Writing / notes / ideas
Make sense of
what’s next.
Notes on building professional identity, applying AI thoughtfully, and leading teams through the hard parts of making technology matter.
Browse the published Docker, Intel, Microsoft, Java, and GitHub article series below.
Docker / field notes
Operating containers,
with fewer surprises.
A five-part series on the practical work behind reliable containerized services: health signals, reproducible builds, production images, vulnerability gates, and Docker in CI.
Running Is Not Ready: Operating Containerized Services
Separate startup, readiness, and liveness—and make rollouts reversible under real failure modes.
8 MIN READ ↗Same Dockerfile, Different Build: Reproducible Container Builds
Pin dependencies, lock the full graph, refresh base images deliberately, and inspect the artifact you ship.
7 MIN READ ↗Smaller, Quieter, Safer: A Production Image Checklist
A practical checklist for multi-stage builds, least privilege, small contexts, and clean runtime behavior.
7 MIN READ ↗Don’t Ship What You Haven’t Scanned: Gating Images Before Production
Build an SBOM, scan every image, gate on actionable severity, and keep exceptions narrow and owned.
8 MIN READ ↗Docker in CI: The Real Cost of Docker-in-Docker
Make daemon access explicit, fail closed when container tests can’t run, and reduce the blast radius.
8 MIN READ ↗Intel / edge AI notes
Inference you can
measure and trust.
A five-part series on quantization trade-offs, model conversion, honest benchmarking, CPU-first deployment, and packaging inference for production.
Faster Isn’t Free: The Real Trade-offs of Quantizing a Model from FP32 to INT8
Measure latency and output fidelity together—and know when INT8 is not worth shipping.
9 MIN READ ↗The Conversion Gap: From ONNX Export to an Optimized Runtime Format
Audit operators, plan fallbacks, script conversion, and validate parity before launch.
8 MIN READ ↗Benchmarking Honestly: Building a Repeatable, Trustworthy Inference Benchmark
Warm up, control variance, report percentiles, and compare output deltas—not just averages.
9 MIN READ ↗CPU-Only, By Design: Building an Edge-AI Service Without Assuming Accelerators
Make hardware assumptions explicit and provide fallbacks that fail clearly and gracefully.
8 MIN READ ↗Packaging Inference for Production: A Checklist for Shipping an Optimized-Model Service
Make model conversion reproducible, artifacts traceable, precision visible, and fallbacks testable.
9 MIN READ ↗Microsoft Entra / field notes
Identity deserves
more than a signature.
A five-part series on credential trust, fair verification states, warm identity services, signing-key hygiene, and privacy-conscious revocation.
Verifiable Doesn’t Mean Verified: Getting Issuer, Holder, and Verifier Right
A practical walk through verifiable credentials where “well-formed JSON” and “cryptographically signed” still aren’t the same as “true.”
READ ARTICLE ↗Null Isn’t False: Building Fair Credential Verifiers
Why missing evidence should be “unverifiable,” not “invalid,” and how collapsing those states leads to unfair outcomes.
READ ARTICLE ↗Deploying Identity Services Without a Server to Babysit
Lessons from scale-to-zero containers: cold starts, idle billing, and when latency-sensitive verifiers should stay “warm.”
READ ARTICLE ↗Keys Don’t Belong in the Image: Secret Management for Credential Signing
Managed secret stores, rotation, and guarding against the “oops, we baked a key” failure mode.
READ ARTICLE ↗Revocation Is the Hard Part
Issuing is easy; keeping credentials current without leaking who asked is the challenge.
READ ARTICLE ↗Java / field notes
Model the hard parts.
Let Java help.
A five-part series on modern Java modeling, virtual threads, reliable parallel tests, repeatable builds, and preserving partial data.
Records Aren’t Just Less Typing: Modeling Ambiguity Without Nulls
Using records, sealed interfaces, and pattern matching to model “present,” “missing,” and “unverifiable” — and force callers to handle every case.
READ ARTICLE ↗Virtual Threads Changed My Mental Model: Practical Lessons From I/O Fan-Out
Practical lessons from I/O fan-out with virtual threads: what became simpler and where limits still matter.
READ ARTICLE ↗Flaky Tests Are a Concurrency Bug: Fixing Shared State Under Parallel Execution
Trace intermittent failures to shared mutable fixtures, then fix the design instead of blaming the runner.
READ ARTICLE ↗Reproducible Java Builds: Pinning, Locking, and Clean-Room Verification
“It built on my machine” still happens. Pin versions, lock dependencies, and verify reproducibility in CI.
READ ARTICLE ↗Designing for Partial Data: Distinguishing “We Don’t Know” From “False”
Sealed types and exhaustive pattern matching keep “unknown” distinct from “zero” throughout a service.
READ ARTICLE ↗GitHub / field notes
Make open source
easier to join.
A five-part series on contributor onboarding, extension contracts, versioning, sustainable triage, and welcoming plugin design.
Contribution Guidelines Nobody Reads: Designing Onboarding That Actually Works
Practical contributor onboarding that turns “I tried” into a working PR: quickstarts, guardrails, and code paths that are hard to misuse.
READ ARTICLE ↗A Breaking Change in Someone Else’s PR: Guarding Extension Points Without Blocking Contributions
When a plugin interface change passes CI and breaks downstream work, you need versioning, deprecation windows, and contract tests.
READ ARTICLE ↗Semantic Versioning Is a Promise, Not a Formality
For small projects, getting “breaking” right matters. When you change behavior, communicate clearly and follow your own rules.
READ ARTICLE ↗Triage Without Burning Out: Sustainable Patterns for Issues and PRs
Labeling, response-time expectations, and healthy “no” decisions for a maintainer with finite time.
READ ARTICLE ↗Designing for Other People’s Code: A Plugin API That Welcomes Contributions
Make extensions safe and approachable with narrow interfaces, complete examples, and isolated execution for untrusted code.
READ ARTICLE ↗