Infrastructure
Incidents and performance issues in Kubernetes, Docker, cloud, and databases — with temporary mitigations separated from lasting fixes.
Kafka vs RabbitMQ vs NATS vs Redis Streams: A 6-Question Decision Guide
Compare Kafka, RabbitMQ, NATS JetStream and Redis Streams by delivery model, replay, ordering and ops burden. A 6-question decision table, how to size retention correctly, and first-week metrics.
Fixing no pg_hba.conf entry and password authentication failed by Root Cause
How to map six PostgreSQL connection errors onto the network, pg_hba, and authentication layers and diagnose them in 30 seconds. Covers an error-text lookup table, ss and pg_hba_file_rules diagnostics, first-match rules, PG14 scram-sha-256
Diagnosing Kubernetes MTU Issues — When ping Works but Large Responses Hang
If ping is fine but curl hangs only on large responses and the TLS handshake goes silent, you have an MTU problem. This post covers DF-bit ping binary search, the VXLAN 1450 / GCP 1410 calculation table, where to set Flannel, Calico, and Ci
Diagnosing 504 Gateway Time-out: An nginx · ALB · gunicorn Timeout Alignment Runbook
A procedure for pinpointing which of CloudFront, ALB, nginx, or gunicorn hung up first when a 504 Gateway Time-out appears, using only curl instrumentation and response headers. Covers per-layer timeout tables, alignment principles, and how
Ingress 404 default backend · 503 no healthy upstream: a 30-second diagnostic chart
A decision table that maps Kubernetes Ingress 404 default backend, 503 no healthy upstream, and 502 too big header to the causal layer from the response string alone — plus a 6-step 30-second confirmation, copy-pasteable fix YAML, and contr
Endpoints <none> · no endpoints available: 7 Causes and a 30-Second Diagnosis
When a Kubernetes Service dies with Endpoints <none>, isolate the cause among selector mismatch, a wrong targetPort, Readiness failure, and four other cases using a 30-second diagnostic sequence and a decision table—plus one-line recovery c
Fix Temporary failure in name resolution: a host, Docker, and K8s DNS diagnostic runbook
A table that maps Temporary failure in name resolution, Could not resolve host, SERVFAIL, and NXDOMAIN to the failing layer from the error text alone, plus five 30-second diagnostic commands. Copy-paste fixes for resolv.conf, Docker daemon.
No space left on device: a 30-second triage runbook — when df shows space but writes still fail
Service down with ENOSPC (errno 28)? A field runbook that pinpoints the cause in 30 seconds with five commands, covering both df showing free space while writes fail (inodes, a different mount, the inotify limit) and df full while du finds
PostgreSQL too many clients already: 30-second triage recovery runbook
Use a 30-second triage table to classify PostgreSQL FATAL: sorry, too many clients already as a spike, leak, or misconfig, then recover immediately with copy-paste SQL—terminate idle in transaction, tune max_connections, and decide on pgbou
Fixing ERROR 1040 Too many connections: A MySQL Connection Exhaustion Diagnosis and Recovery Runbook
A runbook to diagnose MySQL ERROR 1040 Too many connections in 30 seconds and recover immediately. Copy-paste guide covering SHOW PROCESSLIST and kill, through max_connections and wait_timeout, to HikariCP, Django, and Laravel pool settings
Docker 'port is already allocated': a 30-second diagnosis and recovery runbook
A practical runbook to diagnose Docker's 'Bind for 0.0.0.0:XXXX failed: port is already allocated' error in 30 seconds and recover with copy-paste commands. Precisely fixes zombie docker-proxy processes and leftover container port occupancy
apt Could not get lock /var/lib/dpkg/lock-frontend: a 30-second diagnosis and recovery runbook
Diagnose the 'Could not get lock /var/lib/dpkg/lock-frontend' error in 30 seconds—pin it to a competing apt process, unattended-upgrades, cloud-init, or a stale lock. An on-call runbook covering whether to rm lock files, three copy-paste re
kubectl localhost:8080 refused: a 30-second diagnosis and recovery runbook
Fix kubectl's "connection to localhost:8080 was refused" error with a 30-second diagnostic table and copy-paste commands. Covers five cause families: kubeconfig path, KUBECONFIG, context, the sudo trap, and EKS/GKE locations.
Redis MISCONF unable to persist on disk: a 5-minute recovery runbook
A 5-minute recovery runbook for when Redis refuses all writes with "MISCONF unable to persist on disk." Pin down the three usual causes—disk full, overcommit_memory, and dir permissions—with diagnostic commands, then copy-paste from tempora
K8s Liveness/Readiness Probe Failed · Connection Refused: Fixes by Cause
Match the exact Liveness/Readiness probe failed, connection refused, and context deadline exceeded strings from kubectl Events to find the root cause in 30 seconds — plus a decision tree, copy-paste YAML, and recommended thresholds.
Pod Pending FailedScheduling 0/3 nodes: A 30-Second Diagnosis and Recovery Runbook
Is your Pod stuck in Pending with FailedScheduling 0/3 nodes (insufficient cpu/memory, taint, or node selector)? This practical runbook branches on a single Events line and recovers immediately via a decision tree: shrink requests, add a to
Fixing OOMKilled Exit Code 137: A kubectl 30-Second Diagnosis and 5-Minute Recovery Runbook
Did your Pod die with OOMKilled exit code 137? In 30 seconds, use kubectl describe, jsonpath, and dmesg to tell whether it exceeded the container limit or the node was under memory pressure—then recover in 5 minutes with copy-paste commands
fork: retry: Resource temporarily unavailable — 30-Second Diagnostic Runbook
fork: retry, pthread_create failed, and unable to create new native thread almost always mean nproc limit exhaustion or memory shortage. A copy-paste runbook to diagnose in 30 seconds with ulimit, ps, free, and dmesg, then permanently fix v
connection refused / ECONNREFUSED 127.0.0.1: a 30-second diagnostic runbook
A 4-step runbook that triages connection refused and ECONNREFUSED 127.0.0.1 in 30 seconds. Diagnose a downed server, port mismatch, firewall, or bind address (127.0.0.1 vs 0.0.0.0) with copy-paste commands, including curl, Node, Go, and psq
Fixing address already in use: Find and kill the process occupying the port (EADDRINUSE)
When bind: address already in use or EADDRINUSE leaves you stuck, this guide walks through finding the occupying process with lsof and netstat, terminating it safely, and stopping TIME_WAIT and duplicate startups with copy-paste commands fo
Fix ImagePullBackOff · ErrImagePull: Diagnose the Cause from Events and Finish with Copy-Paste
Pinpoint kubectl ImagePullBackOff and ErrImagePull in five minutes with an Events-message diagnosis table. A hands-on guide that fixes imagePullSecrets namespace issues, private registry auth, Docker Hub rate limits, and ECR token expiry wi
Fix Docker "permission denied /var/run/docker.sock" in 5 Minutes
Diagnose and fix the Docker permission denied /var/run/docker.sock error with a cause-by-cause table and copy-paste commands. Covers session refresh after usermod, plus CI, rootless, and security caveats in one place.
SSH Permission denied (publickey): 5-Minute Cause-and-Fix Diagnosis (EC2)
Diagnose SSH Permission denied (publickey) by splitting client vs. server with ssh -vvv logs. Recover in five minutes with step-by-step commands covering key permissions, authorized_keys, sshd_config, and EC2 usernames.
Istio/Ingress Networking Failures: Finding the Root Cause in Traffic-Split and Path-Matching YAML
A practical guide to solving complex networking problems—traffic routing errors, path matching failures, and more—when using Istio and Ingress in a microservices environment. Lock in operational stability with essential YAML examples and an