All Topics — Electrominds Blog

Advanced 2 articles

Real-Time Systems

When request/response is not enough — WebSockets, Server-Sent Events, long-polling, the cost of holding connections open, and when not to build real-time at all.

11 min read Backend · 26

Full-Text Search

Inverted indexes, BM25, Elasticsearch — why LIKE queries don't scale.

12 min read

AI Security 9 articles

Security · 55

Why AI Systems Break Differently

An AI-powered application is still software — and everything you learned in Phases 0–5 still applies to it. But AI introduces something genuinely new: the…

14 min read Security · 56

The OWASP Top 10 for LLM Applications

When the AI security field was new, every team faced LLM risks alone, with no shared vocabulary. Just as the classic OWASP Top 10 (2.3) gave web security a…

12 min read Security · 57

Prompt Injection and Jailbreaking

Prompt injection is the defining vulnerability of the LLM era — and it is, at its heart, the exact same flaw as the SQL injection you learned in 2.4…

13 min read Security · 58

Data Poisoning, Model Theft, and Training-Time Attacks

Prompt injection (6.3) attacks an AI system through its running input. But an AI system has two more things that traditional software does not — the data it…

13 min read Security · 59

Securing LLM Applications and AI Agents

This is the defensive heart of Phase 6 — the page that answers “so how do I actually build an AI feature safely?” The honest situation: most teams shipping…

14 min read Security · 60

Sensitive Data, Privacy, and the AI Supply Chain

AI systems have a complicated relationship with data — they are trained on it, they process it, they hold it in context, and they can leak it in ways…

15 min read Security · 61

AI as a Security Tool

Part A treated AI as something to secure. This page treats AI as something to use — a tool in a security practitioner’s hands. AI genuinely helps with real…

14 min read Security · 62

The AI-Augmented Security Workflow

Page 6.7 established the principle: AI is a useful tool that must be verified. This page is the practice — how to actually integrate AI into real security…

15 min read Security · 63

The Threat Landscape of AI-Powered Attacks

Every tool that helps defenders helps attackers. You have learned to use AI for security work (6.7, 6.8) — and attackers are using it too. AI does not, for…

14 min read

Architecture 18 articles

Backend · 07

Middleware

The code that runs around every request. The onion model, why order is everything, short-circuiting, and the error-handling middleware everyone forgets.

9 min read Backend · 08

Request Context

How to share request-scoped data down the call tree without threading it through every function signature — and how not to make a mess of it.

9 min read Backend · 09

Handlers, Controllers & Services

The layered architecture every backend converges on — what belongs in each layer, why the separation pays off, and when the layers are overkill.

11 min read Backend · 11

RESTful API Design

Where REST came from. Idempotency. Pagination. Response shape standards. HATEOAS.

15 min read Backend · 28

Monolith vs Microservices

When to split a system, the modular monolith middle ground, and the distributed monolith trap.

13 min read Backend · 33

API Gateway, Reverse Proxy & BFF

What sits in front of your services. Nginx, load balancers, the BFF pattern — the edge of your system.

12 min read Backend · 34

Beyond REST — gRPC & GraphQL

Two alternatives to REST and when each one earns its place. Same problem, different trade-offs.

13 min read Backend · 38

Multi-Tenancy

Building SaaS that serves many customers from one system — without leaking their data into each other.

12 min read Java · 05

Classes and Objects

The blueprint and the thing built from it. Constructors, fields, methods, the static keyword, and what `new` actually does at the JVM level.

14 min read Java · 06

The Four Pillars of OOP

Encapsulation, inheritance, polymorphism, abstraction — but with real examples, not the textbook version everyone has to memorise then forget.

15 min read Java · 07

Abstract Classes vs Interfaces

The most-asked Java interview question. The real differences, when to pick each, and how default methods in Java 8+ blurred the lines.

14 min read Java · 09

Access Modifiers and Packages

public, protected, private, and the package-private one nobody knows the name of. What each does, when to use them, and how packages organise the chaos.

10 min read Java · 11

Generics and Type Erasure

How generics actually work — at compile time, anyway. Type erasure, bounded types, wildcards, and the weird things they enable and forbid.

14 min read Java · 15

Inner Classes and Anonymous Classes

Classes inside classes. Static nested, inner, local, anonymous, lambdas — the spectrum from explicit to invisible, and when each is the right tool.

11 min read HLD · 04

Load Balancers, CDNs & API Gateways

Load balancing, DNS and CDNs, API gateways, HTTP/1.1/2/3, WebSockets, service discovery, service mesh — the plumbing that connects every service.

22 min read HLD · 06

Microservices, Circuit Breakers & Rate Limiting

Microservices vs monolith, circuit breaker, rate limiting, retry and backoff, saga, API patterns, bulkhead and timeout — the named patterns that recur in every real system.

24 min read HLD · 08

Design a URL Shortener, Newsfeed & Chat

URL shortener, rate limiter, newsfeed, chat, file upload, ride-sharing, video streaming, payments, distributed ID generator — the canonical interview designs done seriously.

28 min read HLD · 09

Design a Web Crawler, Autocomplete & Task Queue

Task queues, idempotency in depth, web crawler, search autocomplete, hotel/seat reservation, top-K — the topics that didn't fit cleanly into the main modules.

22 min read

Async 3 articles

Backend · 13

Task Queues & Background Jobs

Why some work doesn't belong in the request cycle. Retries, DLQs, idempotency.

11 min read Backend · 29

Event-Driven Architecture

Events vs commands, pub/sub patterns, Kafka, event sourcing — decoupling services with messages.

14 min read HLD · 05

Message Queues, Kafka & Event-Driven Design

Message queues, Kafka, pub/sub, notification design, stream processing, event sourcing and CQRS — the asynchronous backbone of large systems.

23 min read

Career 5 articles

Security · 64

Building a Security Portfolio

Nobody can see the knowledge in your head. Employers and clients do not hire claims — they hire proof. A security portfolio is that proof: a visible…

13 min read Security · 65

Certifications: Which Ones, and When

Certifications are doors, not destinations. They can get your résumé past automated filters, satisfy hard requirements, and signal validated knowledge to…

13 min read Security · 66

Breaking Into a Security Job

Switching careers into security is not done by sending out applications and hoping — it is done with a deliberate strategy. And the centerpiece of that…

13 min read Security · 67

Freelancing: Bug Bounty and Independent Security Work

Security work can be done independently, not only as an employee — and freelance security income is real. But it is also uneven, widely misunderstood, and…

15 min read Security · 68

Staying Current and Going Further

Security is not a body of knowledge you finish — it is a field that never stops moving. Threats evolve, technologies change, new vulnerability classes…

14 min read

CI/CD 4 articles

DevOps · 06

Continuous Integration

Automated testing on every change. The shortest feedback loop in software engineering.

12 min read DevOps · 07

Continuous Delivery & Deployment

From green build to running in production. Pipelines, environments, and the difference between delivery and deployment.

13 min read DevOps · 08

GitHub Actions in Depth

Workflows, matrix builds, reusable actions, OIDC, and the patterns that scale to large orgs.

14 min read DevOps · 09

Build Optimization

Caching, parallelism, monorepo strategies. How to keep CI under 5 minutes as your codebase grows.

11 min read

Cloud 10 articles

DevOps · 16

Cloud Computing Models

IaaS, PaaS, SaaS, serverless. Why the cloud changed everything and what it actually offers.

11 min read DevOps · 17

AWS Core Services

EC2, S3, RDS, Lambda, IAM — the building blocks behind most modern infrastructure.

17 min read DevOps · 18

GCP Core Services

Compute Engine, GCS, Cloud SQL, Cloud Run, IAM — Google Cloud essentials and how it differs from AWS.

14 min read DevOps · 19

Cloud Networking

VPCs, peering, transit gateways, private connectivity — the network plumbing that ties cloud workloads together.

12 min read DevOps · 37

On-Prem vs Cloud: What Self-Managed Infrastructure Actually Demands

On-prem is not "cloud, but in my room". A long list of things a provider used to handle silently becomes your job the moment you own the hardware…

5 min read Security · 50

Cloud Security Fundamentals

The cloud did not just move servers somewhere else — it changed the fundamental rules of how systems are built, accessed, and secured. Concepts from earlier…

11 min read Security · 51

Common Cloud Misconfigurations

Cloud breaches are rarely the result of a clever attack on the cloud provider’s infrastructure. Overwhelmingly, they are the result of the customer…

12 min read Security · 52

Container and Kubernetes Security

Modern cloud applications are overwhelmingly packaged in containers and run at scale by orchestration platforms like Kubernetes. This is the technology of…

11 min read Security · 53

Infrastructure as Code Security

Because cloud infrastructure is software-defined, it can be defined as code — written, reviewed, versioned, and deployed like any other code. This is one of…

11 min read Security · 54

DevSecOps Pipelines

Modern software is built and shipped through automated pipelines — a continuous flow from code change to deployed application. DevSecOps means weaving…

14 min read

Containers 4 articles

DevOps · 10

Docker — Containers from First Principles

Images, layers, networking, multi-stage builds. The technology that made 'works on my machine' obsolete.

15 min read DevOps · 11

Container Image Security

Vulnerabilities, supply chain attacks, image signing — keeping your containers from becoming the entry point.

11 min read DevOps · 12

Docker Compose for Local Development

Define your whole stack in one file. The fastest way to onboard new engineers.

9 min read DevOps · 41

Running a Private Docker Registry On-Prem

A self-managed system that pulls every image from someone else's registry is not self-managed. The registry is the last external dependency in the…

6 min read

Data 9 articles

Backend · 04

Serialization & Deserialization

JSON vs Protobuf. Schema validation. The gotchas that bite in production.

11 min read Backend · 06

Validation & Transformation

Type, semantic, and syntactic validation. Actionable error messages. Trust nothing.

8 min read Backend · 10

Databases

ACID, B-trees, MVCC, query execution stages. NoSQL families. The database fundamentals.

22 min read Backend · 30

File Uploads & Object Storage

S3, presigned URLs, multipart uploads — handling files without your server becoming the bottleneck.

12 min read Backend · 35

Database Replication & Sharding

How databases scale beyond one machine. Read replicas, leader/follower, sharding, and the trade-offs.

13 min read Java · 04

Strings Deep Dive

Why == lies. The String Pool. StringBuilder vs StringBuffer vs string concatenation in a loop. The 1000-object trap.

13 min read Java · 12

Collections Framework

List, Set, Map, Queue — the interfaces and the implementations. When to pick which. How HashMap actually works inside.

18 min read Java · 14

Enums

Type-safe constants. Methods on enum values. The trick of using an enum as a singleton. Java's enum is more powerful than most people realise.

10 min read HLD · 02

SQL vs NoSQL, Sharding & Replication

SQL vs NoSQL, indexing, sharding, replication, object storage, NewSQL — picking the right storage for each part of a real system.

24 min read

Defensive Security 14 articles

Security · 31

Secure Coding I: Defending Against Injection and XSS

You learned to exploit injection and XSS in Phases 2.4 and 2.5. Now you become the person who makes them impossible. Here is the most important realization…

9 min read Security · 32

Secure Coding II: Authentication, Access Control, and Secrets

The bugs in 2.6, 2.7, and 2.8 — broken authentication, broken access control, request forgery — are different in nature from injection. They are not “data…

9 min read Security · 33

Secure Design and Defense in Depth

Secure coding (4.1, 4.2) fixes how individual pieces are built. But a system can be made of perfectly secure pieces and still be insecure as a whole …

8 min read Security · 34

Hardening Systems and Networks

Secure design (4.3) decided the architecture; hardening is the hands-on work of making real systems resistant to attack. It is the direct, practical answer…

9 min read Security · 35

Blue Team Operations and the SOC

Building secure systems (4.1–4.4) is essential, but not the whole of defense. Because no defense is perfect and breach must be assumed, someone has to watch…

8 min read Security · 36

Logging, Monitoring, and Detection

An attack you cannot see is an attack you cannot stop. Page 4.5 established that defenders must watch continuously; this page is the how. Detection rests on…

9 min read Security · 37

Incident Response and Digital Forensics Basics

Detection (4.6) tells you an attack is underway. What happens next — in the minutes and hours after — often determines whether it is a minor event or a…

9 min read Security · 38

Vulnerability Management and Security Operations

Across Phases 2 and 3 you saw that attackers overwhelmingly exploit known weaknesses — known vulnerabilities, known misconfigurations, missing patches. The…

9 min read Security · 39

Defensive Walkthrough: Securing an Application End to End

Defense, like offense, must be practiced as a complete exercise — not a checklist of separate techniques. Page 2.11 had you run a full attack on an…

11 min read Security · 45

The Secure Development Lifecycle

Security cannot be a final inspection bolted onto finished software — by then, flaws are baked into the design and expensive (or impossible) to remove…

11 min read Security · 46

Code Review for Security

A penetration tester (Phases 2–3) attacks software from the outside, seeing only its behavior. A security code reviewer reads the source itself — and sees…

12 min read Security · 47

Security Testing Automation

Manual security work — code review, pentesting, threat modeling — is essential but does not scale: it cannot run on every code change, every day, across a…

12 min read Security · 48

Threat Modeling in Practice

You learned threat modeling back in Phase 1.2 as a way of thinking like an attacker. This page takes it from a personal skill to a practiced, repeatable team…

11 min read Security · 49

Working with Developers

Every technical practice in Track B — secure coding standards, code review, automated testing, threat modeling — succeeds or fails on one thing: whether…

14 min read

Foundation 23 articles

Backend · 01

What is a Backend?

The mental model. HTTP request loop. Why first principles beat framework knowledge.

10 min read Backend · 02

HTTP Protocol

Anatomy of requests, methods, status codes, and the headers you must know.

12 min read Backend · 03

Routing

How a URL becomes a function call. Path matching, parameters, route ordering, and the bugs that come from getting the order wrong.

8 min read Backend · 25

How a Request Travels the Network

DNS, packets, TCP handshake — what actually happens between typing a URL and seeing a response.

11 min read Backend · 27

Distributed Systems & CAP

The 8 fallacies, CAP theorem, eventual consistency — what changes when you add a second computer.

14 min read Backend · 32

Money, Time & Identity

Cents, UTC, UUIDs — the three things that bite every backend engineer eventually.

10 min read Backend · 39

Internationalization (i18n) & Localization

Building software that works in every language, region, and writing system — from day one.

11 min read DevOps · 01

What is DevOps, Really?

Beyond the buzzwords. The cultural shift that turned operations from a separate team into shared responsibility.

12 min read DevOps · 02

Linux Fundamentals for DevOps

The terminal, processes, permissions, and signals — every cloud server you'll ever touch runs on this.

16 min read DevOps · 03

Networking Essentials

IPs, ports, DNS, VPCs, firewalls — the network primitives every cloud engineer needs in their bones.

15 min read DevOps · 04

Shell Scripting & Automation

Bash scripting from variables to traps. The glue that holds DevOps automation together.

14 min read Java · 01

What Java Actually Is (And Why It Survived)

Origin, evolution, and the real reason Java is still everywhere in 2026 — even after every other language tried to kill it.

11 min read Java · 02

The JVM, JRE, JDK — What's Actually Happening

From .java to running bytes. Class loaders, runtime memory areas, JIT, and the garbage collector — the whole machine demystified.

18 min read Java · 03

Variables, Primitives, and the Memory Model

Stack vs heap. Primitives vs references. Autoboxing traps. The memory model that shapes every line of Java you'll write.

14 min read Java · 08

The Object Class — equals, hashCode, toString

Every Java class secretly inherits from Object. These three methods determine whether your objects work correctly in collections, comparisons, and logs.

15 min read Java · 13

Control Flow and Operators

if, while, for, switch — plus the modern switch expression and pattern matching. Operators and the precedence rules nobody memorises.

9 min read HLD · 01

System Design Foundations

CAP, ACID vs BASE, latency numbers, back-of-envelope estimation, single points of failure — the vocabulary every system designer thinks in.

22 min read Security · 01

How the Internet Moves Data

The internet is not magic and it is not one thing. It is millions of computers passing small envelopes of data to each other, following a few simple rules…

7 min read Security · 02

The Linux Command Line for Security Work

Security work happens in a terminal. Not because terminals are cool, but because security tools need precision, automation, and the ability to be chained…

7 min read Security · 03

HTTP, HTTPS, and How the Web Really Works

A huge share of all security work — employed or freelance — is finding and fixing bugs in web applications. Web apps are everywhere, they’re exposed to the…

7 min read Security · 04

Networking Deeper: Services, Protocols, and the Attack Surface

A computer connected to a network is not one target — it is a collection of doors, each one a service listening on a port. Both attacking and defending begin…

6 min read Security · 05

Setting Up Your Security Lab

You cannot learn to attack systems by attacking real ones — that is a crime, full stop. You also cannot learn by only reading. The answer, used by every…

7 min read Security · 06

Programming for Security: Python & Scripting Basics

Pre-built tools handle the common 80% of security work. The remaining 20% — the custom, the unusual, the specific-to-this-target — is where real skill shows…

7 min read

IaC 3 articles

DevOps · 20

Terraform — Infrastructure as Code

Declarative infrastructure. Providers, state, modules — and why your cloud should be defined by code review.

16 min read DevOps · 21

Pulumi & CDK — Code-First IaC

When real programming languages beat Terraform's HCL. Tradeoffs, when to use each.

9 min read DevOps · 22

Configuration Management — Ansible

Configuring servers idempotently. When and why you still need this in a containerized world.

9 min read

Integration 3 articles

Backend · 24

Webhooks & OpenAPI

Two halves of integration done right — webhooks for letting your API push events to others, and OpenAPI for describing your API so others can consume it without guesswork.

12 min read Backend · 36

Notifications — Email, SMS & Push

Sending messages reliably at scale. Provider patterns, deliverability, unsubscribes, async always.

11 min read Backend · 37

Payments & Financial Systems

Stripe-style integrations done safely. Webhooks, idempotency, reconciliation — and never storing card numbers.

13 min read

Modern Practices 6 articles

DevOps · 34

GitOps with ArgoCD & Flux

Git as the source of truth for infrastructure. Continuous reconciliation, audit trails, declarative everything.

10 min read DevOps · 35

Platform Engineering

Building internal developer platforms — golden paths, self-service, and the team that scales engineering.

11 min read DevOps · 36

Edge Computing & CDNs

Cloudflare, edge functions, and pushing compute close to users. The new layer in the stack.

9 min read Java · 16

Lambdas and Functional Interfaces

The Java 8 feature that changed everything. Method references, the standard functional interfaces, and the patterns that replaced 80% of inner-class boilerplate.

12 min read Java · 17

Streams API

Filter, map, reduce — Java's functional pipeline for collections. When streams are clearer than loops, and when they aren't.

14 min read Java · 20

Modern Java: Records, Sealed Classes, Pattern Matching

What's new in Java 16-21. The features that made the language feel current again. Records, sealed types, pattern matching, var, text blocks.

12 min read

Observability 5 articles

DevOps · 23

Monitoring with Prometheus & Grafana

Metrics that matter, dashboards that don't lie, and alerts that fire when (and only when) things break.

13 min read DevOps · 24

Logging at Scale

Structured logs, ELK, Loki, and the discipline of logging things you'll actually want at 3 AM.

11 min read DevOps · 25

Distributed Tracing

OpenTelemetry, Jaeger, Tempo — seeing how a single request flows across many services.

11 min read DevOps · 26

SRE Principles

SLIs, SLOs, error budgets — Google's framework for reliability without sacrificing velocity.

12 min read HLD · 10

SLOs, Observability & API Security

SLOs and error budgets, the three pillars of observability, chaos engineering, disaster recovery, AuthN/AuthZ, API security — the operational concerns every system must address.

25 min read

Offensive Security 23 articles

Security · 13

Reconnaissance: Information Gathering

Attacks are won or lost before a single exploit is fired. Reconnaissance — methodically learning everything about a target — is what separates someone who…

7 min read Security · 14

Burp Suite and the Web Hacker’s Toolkit

A browser shows you what a web app wants you to see. To attack or test an app you need to see — and change — what’s actually being sent on the wire, before…

8 min read Security · 15

The OWASP Top 10: The Industry’s Shared Map

Web applications fail in patterns. The same categories of vulnerability appear again and again, across companies, languages, and decades. The security…

7 min read Security · 16

Injection: SQL Injection and Command Injection

The deepest flaw in all of software security is the confusion between data and code. When an application takes input that should be plain data and…

9 min read Security · 17

Cross-Site Scripting (XSS)

Cross-Site Scripting is injection again — but the injected code is JavaScript, and the place it runs is not the server but the browser of an innocent victim…

9 min read Security · 18

Broken Authentication and Session Attacks

Authentication is the front door of an application — and session handling is the key you keep using after you’ve walked in. When either is weak, an attacker…

8 min read Security · 19

Broken Access Control and IDOR

Authentication proves who you are; authorization decides what you’re allowed to do. Broken access control is the failure of that second check — the…

9 min read Security · 20

CSRF, SSRF, and Request Forgery

Some attacks don’t break into a system — they trick something trusted into acting on the attacker’s behalf. Request forgery is exactly this: making a request…

9 min read Security · 21

Security Misconfiguration and Exposure

Not every breach is clever. A great many require no exploit at all — just an attacker who found a default password still in place, an admin panel left open…

8 min read Security · 22

Vulnerable Components and the Software Supply Chain

Modern software is not written — it is assembled. Any application is a small amount of original code resting on a vast foundation of third-party libraries…

9 min read Security · 23

Putting It Together: A Full Web App Pentest Walkthrough

Knowing vulnerabilities individually is not the same as assessing an application. A real penetration test is a methodology — a disciplined, repeatable…

10 min read Security · 24

Network Scanning and Enumeration

Before you can attack infrastructure, you must see it — precisely. Phase 2’s recon mapped a web application; network scanning maps the machines and services…

8 min read Security · 25

Common Network Service Attacks

A network service is a program that answers the network — and every one of them is a potential way in. Most service compromises are not the result of…

9 min read Security · 26

Exploitation and Metasploit

An exploit is the bridge between “this system has a weakness” and “I now have access.” Page 2.10 established that vulnerabilities are often publicly…

10 min read Security · 27

Privilege Escalation: Linux and Windows

Getting in is rarely getting control. A foothold almost always lands you as a low-privileged user — able to do little. Privilege escalation is the climb from…

10 min read Security · 28

Active Directory Fundamentals and Attacks

Most organizations don’t run their computers as a loose collection of independent machines. They run them as a managed, interconnected whole — and on Windows…

11 min read Security · 29

Wireless and Other Attack Surfaces

Attacks don’t only travel over cables and through web forms. They travel through the air, through physical doors, and through the growing crowd of connected…

10 min read Security · 30

Capture The Flag: Structured Practice

Security is a skill, and skills are built by doing, repeatedly, against fresh challenges — not by reading. This page is different from every other in Phase…

10 min read Security · 40

How Bug Bounty Actually Works

Bug bounty is the meeting point of three things you already have — offensive skill (Phases 2–3), the discipline of authorization (1.0), and professional…

10 min read Security · 41

Advanced Web Exploitation

Phase 2 gave you the OWASP Top 10 — the most common, most critical web vulnerabilities. On a crowded bug bounty program, those obvious bugs are usually found…

10 min read Security · 42

Recon at Scale

You can only find a vulnerability in something you have discovered. Page 2.1 taught reconnaissance as a methodology; this page scales it for bug bounty…

10 min read Security · 43

Writing Reports That Get Paid

In bug bounty, you are not paid for finding a vulnerability. You are paid for communicating a vulnerability so clearly and convincingly that the company can…

10 min read Security · 44

Building a Bug Bounty Practice

Skill finds bugs; a practice sustains a career. This final page of Track A is about the difference — turning the ability to find and report vulnerabilities…

13 min read

Operations 9 articles

Backend · 15

Logging, Monitoring & Observability

Logs, metrics, traces — the three pillars. Correlation IDs. What to alert on.

16 min read Backend · 22

12-Factor App & Config Management

The methodology behind apps that deploy cleanly and scale predictably — what the twelve factors actually mean, how to manage config and secrets, and where the method stops applying.

11 min read Backend · 23

DevOps for Backend Engineers

The slice of DevOps a backend engineer actually needs — containers, orchestration, and CI/CD — explained as the path your code takes from a commit to running in production.

11 min read DevOps · 30

Deployment Strategies in Practice

Blue-green, canary, feature flags — picking the right strategy for the risk and the team.

10 min read DevOps · 31

Incident Response

When things break: how good teams handle the first 60 minutes and the next 60 days.

11 min read DevOps · 32

Disaster Recovery & Backups

RPO, RTO, restore drills — preparing for the day a region disappears.

10 min read DevOps · 33

Cost Optimization (FinOps)

Cloud bills get expensive. The practices and tools to keep spend predictable and right-sized.

10 min read DevOps · 38

Preparing Linux Nodes and Networking for a Bare-Metal Cluster

A Kubernetes node is a real machine with a real operating system underneath it, sitting on a network you designed. Prepare those two layers inconsistently…

6 min read Java · 19

Build Tools and Project Structure

Maven, Gradle, the standard project layout. Dependency management, build lifecycles, and which tool to pick in 2026.

10 min read

Orchestration 5 articles

DevOps · 13

Kubernetes Fundamentals

Pods, Deployments, Services — the mental model for the system that runs most modern infrastructure.

16 min read DevOps · 14

Kubernetes in Practice

Helm, autoscaling, persistent volumes, RBAC — what you actually need to run production K8s.

14 min read DevOps · 15

Service Mesh — When You Need One

Istio, Linkerd, Cilium — what they actually do, and when adding one helps vs hurts.

10 min read DevOps · 39

Building a Multi-Node Kubernetes Cluster with k3s

A cluster stops being an abstraction the moment self-healing means a Pod moving between two machines you can physically touch. k3s is the shortest honest…

6 min read DevOps · 40

On-Prem Kubernetes Storage, MetalLB and Ingress

Two things that "just work" on a managed cluster are the two that do not exist on-prem: something that turns a storage claim into a real disk, and something…

6 min read

Performance 5 articles

Backend · 12

Caching

Cache-aside. TTL vs event invalidation. Stampedes, poisoning, HTTP caching.

13 min read Backend · 18

Scaling & Performance

Vertical vs horizontal. Load balancing. Read replicas. The optimization checklist.

14 min read Backend · 19

Concurrency & Async

Why a server handles thousands of requests at once without thousands of threads — the event loop, the thread-pool model, race conditions, and when plain synchronous code is the right answer.

11 min read Java · 18

Concurrency and Multithreading

Threads, the memory model, synchronization, volatile, atomics, ExecutorService, and why concurrency is the hardest topic in Java.

18 min read HLD · 03

Caching Strategies, Redis & Invalidation

Why caching exists, the strategies (cache-aside, write-through, write-behind), Redis, eviction, invalidation, stampedes, and CDNs.

22 min read

Quality 1 article

Backend · 21

Testing & Code Quality

The testing pyramid. Mocks vs fakes. SOLID, DRY, YAGNI — without dogma.

12 min read

Reliability 5 articles

Backend · 14

Error Handling

Operational vs programmer errors. Retries, circuit breakers, async pitfalls.

14 min read Backend · 17

Graceful Shutdown

Why stopping a server is harder than starting one — the SIGTERM lifecycle, draining in-flight requests, and the deploy-time errors that graceful shutdown removes.

9 min read Backend · 31

Idempotency & Distributed Patterns

Idempotency keys, sagas, the outbox pattern — making distributed work safe.

13 min read Java · 10

Exception Handling

Checked vs unchecked. try/catch/finally. try-with-resources. The dogmatic rules everyone learns and the pragmatic ones senior developers actually follow.

16 min read HLD · 07

Consensus, Quorums & Distributed Locks

Consensus (Raft and Paxos), distributed locks, quorum reads and writes, vector clocks and CRDTs, gossip, clock synchronisation — the primitives that hold distributed systems together.

24 min read

Security 11 articles

Backend · 05

Version Control 1 article

DevOps · 05

Git — Beyond Add, Commit, Push

Branches, rebases, conflict resolution, and the workflows real teams use.

14 min read