Loading…
Latest reads
Every post, summarised
Grounded summaries of engineering blogs, newest first. Each links to the original.
- 4,535 posts
- 20 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Latest posts
Spin Infrastructure Adventures: Containers, Systemd, and CGroups
Spin’s infrastructure team investigated instance instability after Kubernetes nodes experienced frequent failures, including roughly five nodes per day, and instances showed memory use that could exceed their assigned limits. Spin runs instances as Kubernetes pods, with systemd inside each container managing initialization and processes, and the team compared resource behavior across kubectl exec and Spin shell sessions. Stress tests showed that processes started through kubectl exec entered the kubepods cgroup hierarchy, while processes launched through Spin shell entered a hierarchy with an effectively unlimited memory limit, causing usage to appear on the node rather than the pod. Experiments comparing containerd, Docker, and Podman identified systemd cgroup delegation as the relevant difference: Podman isolated systemd and its child processes correctly, while the production setup used cgroupfs. The team identified switching COS to the systemd cgroup driver as the forthcoming fix, while noting that the bind-mounted cgroup filesystem enabled the escape.
Revamped Auth Helpers for Supabase (with SvelteKit support)
Supabase has released an updated version of its framework-specific Auth Helpers libraries, introducing official support for SvelteKit alongside existing React and Next.js tooling to simplify server-side rendering authentication. The updated libraries transition from the @supabase/supabase-auth-helpers namespace to @supabase/auth-helpers within a dedicated monorepo managed by Turborepo. Structuring the codebase with Turborepo and changesets enables publishing isolated packages per framework through GitHub Actions, ensuring each helper contains only its own relevant dependencies. Versioning has also been reset to sub-0.x to reflect early framework lifecycles like pre-1.0 SvelteKit and manage expectations for future breaking changes. Meanwhile, the team has documented migration steps from previous packages and announced that Remix Auth Helpers are currently in active development.
How we automated FAQ responses at Grab
Internal engineering on-call engineers at Grab spent substantial working hours handling repetitive questions in Slack channels, such as how-to inquiries and access permission requests. To resolve this without building an in-house tool, the team conducted an anonymized vendor comparison and selected OneBar through an employee voting process and a phased proof-of-concept. Initial rollouts were restricted by contract to 20 channels, leading the team to prioritize deployment based on Slack message volume and member counts. Populating the knowledge base required roughly a quarter of consistent updates alongside tech talks, while a targeted crowdsourcing campaign among new onboarders expanded the glossary and grew usage to approximately 3,000 users.
SOC2: The Screenshots Will Continue Until Security Improves
Fly.io’s SOC2 certification prompts an explanation of what the audit measures, when companies should pursue it, and what security value customers should assign to it. The post characterizes SOC2 as an accounting-style audit of documented company security processes, centered on an auditor-customized Document Request List (DRL) and screenshots, rather than adversarial product testing. It distinguishes Type I’s point-in-time snapshot from Type II’s multi-month confirmation and recommends doing the engineering work early, while delaying certification until customer demand justifies it. Fly.io prepared for more than a year and describes controls including Google SSO, certificate-based SSH access through Teleport, VPN gating, GitHub SSO, and session audit logs. The resulting certification improved processes but remains a weak positive security signal: SOC2 can miss much of a company’s technical security model, so penetration tests and clear security reporting still matter.
Shopify’s Technical Interview Process: What to Expect and How to Prepare
Shopify’s guide outlines the interview process for individual-contributor technical roles, while noting that stages can vary by role and team and that leadership hiring may add team-specific interviews. Candidates may have a one-hour recruiter “Life Story” conversation, a 40-minute CoderPad coding exercise, a 75–90-minute remote pair-programming session, and a 60-minute Technical Deep Dive focused on previous projects. The coding exercise assesses algorithmic thinking and problem solving, while pairing emphasizes communication, implementation, edge cases, scalability, limitations, and testability. The deep dive asks candidates to discuss impact, architecture, technical decisions, trade-offs, failures, successes, lessons learned, teamwork, and mentorship; the guide also recommends clarifying questions, running code early, using permitted references, and choosing projects they know well.
Typeahead Search at Nextdoor
Nextdoor built a proximity-based autocomplete service to power typeahead search and mention features across its hyperlocal platform for hundreds of millions of entities, including users and businesses. The system shards geographic data using Uber's open-source H3 geohashing library and stores prefix indexes in memory using Redis sorted sets. By adopting a Command Query Responsibility Segregation architecture, ingestion writes are processed on Redis primary nodes and replicated to read-only search nodes with under 10 milliseconds of replication lag. Dedicated APIs handle indexing, typeahead lookups, and ranking before returning hydrated results. Operating since August 2021, the service processes hundreds of millions of monthly typeahead queries while maintaining a P95 search latency below 30 milliseconds.
Supabase Beta June 2022
Supabase released its Beta June 2022 updates covering developer tooling, authentication, and infrastructure changes. The team decoupled Supabase Auth Helpers into dedicated packages for Next.js and React, while introducing project pause and restore features to enable unlimited free projects. Developers can now initiate project creation directly through the Supabase CLI and toggle realtime updates from the table editor side panel. Authentication updates include exposing client IP addresses in audit logs, introducing an auth.jwt function, bubbling PostgreSQL errors from GoTrue, and deprecating older authentication functions. Additionally, infrastructure migrations are underway to support multiplayer features, accompanied by community-led tutorials, sponsorships, and platform growth reaching fifty thousand GitHub stars.
Shopify and Open Source: A Mutually Beneficial Relationship
Shopify describes its relationship with Ruby, Rails, and the open-source community as mutually beneficial, linking the company’s success to its Rails foundation and its engineering culture to the Rails Doctrine. It frames a 100-year company ambition around making Ruby and Rails viable for large teams, mature codebases, millions of lines of code, and billions of web requests through production performance, architecture guidance, upgrades, tooling, and selective typing. To support that goal, Shopify contributes projects and initiatives spanning developer tooling, gradual typing, VS Code support, automated upgrades, YJIT, Ruby performance work, TruffleRuby collaboration, $500,000 in research funding, Bundler and RubyGems, and RubyGems.org security. The post argues that company participation improves engineering skills, application longevity, and influence over foundational software, while describing contributors who range from occasional participants to full-time maintainers.
The Story Behind Shopify’s Isospin Tooling
Shopify’s Isospin is the systemd-based core of Spin, its in-house cloud development platform, designed to run multiple applications inside a single Linux VM. The earlier implementation relied on shell scripts, but growing application counts made it difficult to split applications into components, express dependencies, schedule jobs, and isolate processes. Isospin uses systemd unit graphs, targets, template units, and generators to create service configurations dynamically, including per-application copies of dependencies such as MySQL and Elasticsearch. Additional tooling assigns semi-stable ports by hashing service names and uses systemd readiness notifications, including a notify-port wrapper that checks HTTP availability; the resulting system reuses systemd’s dependency and health mechanisms, with more complex cross-application relationships under investigation.
Flutter Tutorial: building a Flutter chat app
Developers can construct cross-platform real-time chat applications for iOS, Android, and web by pairing Flutter with Supabase. The architecture relies on Supabase to manage authentication and provide direct SDK access to a Postgres database without requiring custom backend server code. The database schema defines profiles with regex validation constraints and a messages table configured for live subscriptions through Postgres publication settings. Flutter clients capture user input, insert new records into the messages table, handle database exceptions, and format chat bubbles with dynamic timestamps. While this initial setup implements user registration and message broadcasting in a shared room, securing chat rooms requires subsequent row-level security configuration.
Graph Networks - 10X investigation with Graph Visualisations
Fraud detection traditionally required investigators to manually combine large datasets from disparate anti-fraud systems using statistical methods, which proved slow and inefficient. Grab built an interactive Graph Visualisation platform to transform raw records into connected visual maps without requiring manual queries or switching tools. The platform manages over three billion nodes and edges, allowing investigators to selectively expand data points and replay chronological events using temporal filters. Visual relationship mapping helps teams verify account appeals, uncover device-sharing rings, and spot anti-money laundering behavior through transaction density patterns.
The Serverless Server
The post explains what “serverless” means by reconstructing the machinery beneath a Lambda-like platform. It starts with bare-metal x86 servers, a Type 1 hypervisor, and services for placement, VM management, request forwarding, and function execution; dedicated customer workers, shared warm pools, rate limits, and container-style isolation address multitenancy, cold starts, and bursty demand. The runtime design uses object storage for function code, chroot, privilege dropping, namespaces, seccomp, cgroups, and freezing to constrain idle instances and workloads. Its limits on initialization, invocation duration, and idle lifecycles support migration away from unhealthy instances but disadvantage applications with expensive startup, dynamic local caches, or uncertain response times.
How to Build Trust as a New Manager in a Fully Remote Team
The post explains why building trust as a new manager in a fully remote organization differs from joining a team with established relationships: passive cues and casual interactions are harder to observe, so remote work requires intentionality. The proposed 90-day plan focuses on the environment during the first 30 days, the team during the next 60, and the manager thereafter. Early actions include pairing sessions, one-on-ones, peer-group sessions, understanding the wider organization, setting up remote tools, and building cross-company relationships. Team leadership emphasizes spending time with members, using asynchronous communication for productivity and synchronous meetings for connection, and creating psychological safety through open communication and transparent discussion of failures. The final phase addresses FOMO, workday design, and experimentation through feedback and reflection.
Policy Gradient with PyTorch
Policy gradient algorithms optimize reinforcement learning policies directly without learning intermediate action-value functions. Instead of assigning discrete Q-values to actions, these methods parameterize a stochastic policy and apply gradient ascent on an objective score function. This setup eliminates manual exploration tuning, resolves perceptual aliasing in identical states, and naturally accommodates continuous or high-dimensional action spaces. The Reinforce Monte Carlo policy gradient algorithm operationalizes this approach by collecting full episodic trajectories and adjusting parameters along the gradient of the log-action probabilities scaled by return. Practitioners implement this algorithm using PyTorch to evaluate agent robustness across environments like CartPole-v1, PixelCopter, and Pong.
Visualizing Supabase Data using Metabase
Organizations seeking to analyze database records can bypass code-heavy Python visualization libraries by connecting a Supabase backend directly to Metabase. Deploying the open-source Metabase Docker container exposes an initial setup interface on default port 3000, allowing administrators to input PostgreSQL connection credentials retrieved from Supabase database settings. Once connected, Metabase automatically surfaces table insights and automated x-rays across the public schema, exposing metrics such as inventory count ranges, price distributions, and column-specific statistics without requiring manual queries. For specialized analytics, users can execute custom SQL joins across relational tables like Product and Vendor to render tailored visual dashboard formats, including configurable bar charts mapped to designated axis fields.
Navigating Recurring Payments in India: A Backend Perspective
India’s October 2021 Reserve Bank of India (RBI) directive required recurring payments to use payer-authorized e-mandates, Additional Factor of Authentication (AFA), and pre-debit notifications at least 24 hours before charges. Shopify’s billing platform therefore had to model e-mandates, support recurring and one-time payments across cards and Unified Payments Interface (UPI), and integrate a local payment provider. The payment service reused its source object for the e-mandate token, recorded the temporary authorization as a charge for auditability, and refunded it asynchronously. To avoid two consecutive card authentication flows, the team used recurring-payment tokenization for both payment paths, accepting an atypical notification experience as a short-term trade-off; UPI required asynchronous webhook-driven handling and a hard mandate limit. After the beta launch, billing-payment success rates in India increased from pre-project levels, and the team said it would soon make UPI generally available to Indian merchants.
Liftoff! How to get started with your first ML project 🚀
Beginners in machine learning frequently face difficulties when selecting a framework and defining the scope of their initial hands-on project. Sentence Transformers provides an accessible starting point by computing dense vector representations for sentences, paragraphs, and images, enabling semantic search through cosine similarity. A structured four-step strategy guides practitioners through listing library capabilities, identifying compelling datasets, selecting a familiar secondary tool, and brainstorming project concepts. Applying this framework, a song lyrics dataset was paired with Gradio Blocks to build a prompt-based playlist generator. Developing this application required evaluating pre-trained models, hosting generated embeddings on Hugging Face Spaces, and utilizing multi-processor support to accelerate embedding generation.
Partial data dumps using Postgres Row Level Security
Dumping full production databases onto local development machines creates severe security issues once applications hold real user data. To safely generate local seed data, developers can leverage PostgreSQL Row Level Security to restrict data access. The process involves provisioning a dedicated database user with select privileges on the target schema and tables. Next, administrators enable row-level security policies on those tables to filter records using criteria such as specific primary keys, email domain patterns, date intervals, or boolean flags. Finally, running pg_dump with the restricted user credentials and the --enable-row-security flag produces a sanitized seed.sql file containing only approved records.
Accelerate Large Model Training using DeepSpeed
Training large models on hardware with limited GPU memory frequently causes out-of-memory errors when using standard Distributed Data Parallel. To solve this bottleneck, Hugging Face Accelerate integrates DeepSpeed ZeRO data parallelism to shard optimizer states, gradients, and model parameters across workers. For a 900-million-parameter DeBERTa model, ZeRO Stage 2 increased the maximum per-device batch size from eight to forty while achieving a 3.5-fold training speedup over DDP without degrading accuracy or F1 score. Advanced configurations allow sequence-to-sequence chatbot finetuning and full ZeRO Stage 3 CPU offloading for models like the 1.5-billion-parameter GPT-XL, enabling batch size 16 training where DDP fails. Accelerate enables these memory optimizations through simple configuration files and the accelerate launch command with minimal or zero code modifications.
Announcing Evaluation on the Hub
Hugging Face introduced Evaluation on the Hub, a no-code tool designed to streamline the evaluation of machine learning models across diverse datasets. Traditional evaluation approaches often suffer from reproducibility issues, implementation inconsistencies, and cumbersome workflows across varied metrics and datasets. Powered by AutoTrain and Hugging Face Spaces, the service allows users to configure tasks, map dataset columns, select evaluation metrics, and run tests directly from dataset pages. Completed evaluations automatically open pull requests on the respective model cards to encode standardized verification metadata and update public dataset leaderboards. This system establishes consistent benchmarking pipelines across tasks like image classification, text summarization, and named entity recognition without requiring local code execution.
Top topics
- Architecture830
- Performance812
- LLMs648
- Machine Learning617
- Open Source561
- AI Agents542
- AI454
- Developer Experience446
Weekly digest
The best engineering reads, once a week.