aws
PrivateLink vs NAT Gateway: Finding the Real Break-Even
Calculate when a VPC Interface Endpoint beats NAT Gateway traffic costs, then configure SQS, S3, and DynamoDB with CDK and restrictive policies.
// Knowledge.index — 知識庫
Knowledge
in production.
Technical articles, executable examples, and decisions without hype. Written for people who ship software.
23
published articles
EN · OPEN ACCESS
// Latest.entries — 最新記事
Latest articles
ai-agents
Versioned Prompts for Coding Agents: Trace Every PR Review
Version prompts and tools, record their hashes in usage.json, and compare coding agent revisions against stable golden fixtures in CI.
java
Graceful Drain in Spring Boot 4.1: HTTP and Workers
Configure and verify HTTP and worker drain in Spring Boot 4.1.1 with SIGTERM, SmartLifecycle, and Kubernetes without cutting in-flight work.
aws
Human Access Across AWS Accounts with Permission Sets
Replace human access keys with temporary cross-account sessions using IAM Identity Center, Permission Sets, and AWS CLI v2.
ai-agents
Project Memory for Coding Agents Starts with Context Packing
Build task-specific context for coding agents with byte and token budgets, auditable discards, and fail-closed handling for required files.
aws
ECS Fargate vs EKS for Java/Spring apps: when the Kubernetes cluster isn't worth the cost
Compare cost, operations, and IAM in ECS Fargate and EKS Auto Mode to decide where to run a Spring Boot application on AWS.
ai-agents
MCP Server with Execute-Verify-Stop and Tool Gating: What the Model Must Not Decide Alone
Reject tools/call on the MCP server before side effects, with versioned policy, auditing, and crash-safe idempotency. Spec 2026-07-28 + Python SDK 2.1.1.
aws
GitHub Actions with AWS OIDC: No More Long-Lived Keys
Replace static GitHub Actions keys with OIDC, a restricted IAM role, a permissions boundary, and verifiable failure tests.
ai-agents
Coding agent with a cost cap: token budget and circuit breaker per task
Set a monthly cap, stop long tasks, and bring tokens and cost per PR into CI without exposing prompts or waiting for the bill.
aws
CloudFront after deployment: cache and invalidation without surprises
Configure CloudFront caching, invalidation, and OAC with private S3, predictable headers, and verifiable post-deployment commands.
java
External configuration in Spring Boot 4.1: which value won
See why an environment variable, YAML, or CLI value won in Spring Boot 4.1, and find the value's origin with a minimal application.
java
AssertJ in Spring Boot 4.1: Failures on the Right Field
Use AssertJ with ProblemDetail and MockMvcTester to pinpoint mismatched fields in Spring Boot 4.1 tests without adding redundant dependencies.
java
Idempotency and outbox in Spring Boot 4.1 without duplicate charges
Implement Idempotency-Key and outbox in one JDBC transaction with Spring Boot 4.1, Postgres, and a real Testcontainers test.
career
Technical career in 2026: the next step is not another framework
Trade framework chasing for verifiable seniority in systems, people, and communication, with a 30-minute diagnosis.
java
StructuredTaskScope in Java 25: fan-out in Spring Boot
Organize per-request fan-out with StructuredTaskScope in Java 25, including cancellation, timeouts, tests, and a comparison with CompletableFuture.
ai-agents
Coding agent in the repository: gates before the first PR
Configure AGENTS.md, CODEOWNERS, CI, and auditing before allowing a coding agent to open pull requests in your repository.
java
OpenShift 4.22 with Java 25: Containerfile and probes on restricted-v3
Package Spring Boot 4.1.1 with Java 25 on UBI 9, pin the image, configure probes, and validate deployment under the restricted-v3 SCC.
java
Spring Boot Actuator in production: what is worth exposing
Configure Spring Boot Actuator endpoints, health checks, readiness, security, and metrics without exposing sensitive production data.
architecture
Bounded Contexts in Practice: Stop Calling Everything a Microservice
Use domain rules, transactions, and data ownership to define boundaries before extracting services from a Spring monolith.
java
Contract Testing with Pact in Spring Boot: Stop Finding Incompatibilities in Production
Create consumer-provider contracts with Pact, verify them in Spring Boot, and block incompatible deployments through Pact Broker.
java
Reactor and Virtual Threads: When to Parallelize in Spring Boot
Learn when parallel and runOn help in Reactor, why subscribeOn does not split items, and how to measure CPU, queues, and latency in Spring Boot.
personal-growth
Why you reread the same code three times and miss the bug: the cost of forced familiarity
Learn to tell visual fatigue from familiarity and try a short routine for reviewing your own code with more attention.
java
Spring Boot 3 and virtual threads: what really changes in APIs with blocking I/O
See when virtual threads help Spring MVC APIs with blocking I/O, with a benchmark, pinning diagnostics, and the path from Java 21 to 25.
01
aws
PrivateLink vs NAT Gateway: Finding the Real Break-Even
Calculate when a VPC Interface Endpoint beats NAT Gateway traffic costs, then configure SQS, S3, and DynamoDB with CDK and restrictive policies.
8m
02
ai-agents
Versioned Prompts for Coding Agents: Trace Every PR Review
Version prompts and tools, record their hashes in usage.json, and compare coding agent revisions against stable golden fixtures in CI.
9m
03
java
Graceful Drain in Spring Boot 4.1: HTTP and Workers
Configure and verify HTTP and worker drain in Spring Boot 4.1.1 with SIGTERM, SmartLifecycle, and Kubernetes without cutting in-flight work.
10m
04
aws
Human Access Across AWS Accounts with Permission Sets
Replace human access keys with temporary cross-account sessions using IAM Identity Center, Permission Sets, and AWS CLI v2.
10m
05
ai-agents
Project Memory for Coding Agents Starts with Context Packing
Build task-specific context for coding agents with byte and token budgets, auditable discards, and fail-closed handling for required files.
12m
06
aws
ECS Fargate vs EKS for Java/Spring apps: when the Kubernetes cluster isn't worth the cost
Compare cost, operations, and IAM in ECS Fargate and EKS Auto Mode to decide where to run a Spring Boot application on AWS.
12m
07
ai-agents
MCP Server with Execute-Verify-Stop and Tool Gating: What the Model Must Not Decide Alone
Reject tools/call on the MCP server before side effects, with versioned policy, auditing, and crash-safe idempotency. Spec 2026-07-28 + Python SDK 2.1.1.
14m
08
aws
GitHub Actions with AWS OIDC: No More Long-Lived Keys
Replace static GitHub Actions keys with OIDC, a restricted IAM role, a permissions boundary, and verifiable failure tests.
10m
09
ai-agents
Coding agent with a cost cap: token budget and circuit breaker per task
Set a monthly cap, stop long tasks, and bring tokens and cost per PR into CI without exposing prompts or waiting for the bill.
8m
10
aws
CloudFront after deployment: cache and invalidation without surprises
Configure CloudFront caching, invalidation, and OAC with private S3, predictable headers, and verifiable post-deployment commands.
8m
11
java
External configuration in Spring Boot 4.1: which value won
See why an environment variable, YAML, or CLI value won in Spring Boot 4.1, and find the value's origin with a minimal application.
9m
12
java
AssertJ in Spring Boot 4.1: Failures on the Right Field
Use AssertJ with ProblemDetail and MockMvcTester to pinpoint mismatched fields in Spring Boot 4.1 tests without adding redundant dependencies.
8m
13
java
Idempotency and outbox in Spring Boot 4.1 without duplicate charges
Implement Idempotency-Key and outbox in one JDBC transaction with Spring Boot 4.1, Postgres, and a real Testcontainers test.
12m
14
career
Technical career in 2026: the next step is not another framework
Trade framework chasing for verifiable seniority in systems, people, and communication, with a 30-minute diagnosis.
7m
15
java
StructuredTaskScope in Java 25: fan-out in Spring Boot
Organize per-request fan-out with StructuredTaskScope in Java 25, including cancellation, timeouts, tests, and a comparison with CompletableFuture.
8m
16
ai-agents
Coding agent in the repository: gates before the first PR
Configure AGENTS.md, CODEOWNERS, CI, and auditing before allowing a coding agent to open pull requests in your repository.
9m
17
java
OpenShift 4.22 with Java 25: Containerfile and probes on restricted-v3
Package Spring Boot 4.1.1 with Java 25 on UBI 9, pin the image, configure probes, and validate deployment under the restricted-v3 SCC.
9m
18
java
Spring Boot Actuator in production: what is worth exposing
Configure Spring Boot Actuator endpoints, health checks, readiness, security, and metrics without exposing sensitive production data.
10m
19
architecture
Bounded Contexts in Practice: Stop Calling Everything a Microservice
Use domain rules, transactions, and data ownership to define boundaries before extracting services from a Spring monolith.
10m
20
java
Contract Testing with Pact in Spring Boot: Stop Finding Incompatibilities in Production
Create consumer-provider contracts with Pact, verify them in Spring Boot, and block incompatible deployments through Pact Broker.
10m
21
java
Reactor and Virtual Threads: When to Parallelize in Spring Boot
Learn when parallel and runOn help in Reactor, why subscribeOn does not split items, and how to measure CPU, queues, and latency in Spring Boot.
13m
22
personal-growth
Why you reread the same code three times and miss the bug: the cost of forced familiarity
Learn to tell visual fatigue from familiarity and try a short routine for reviewing your own code with more attention.
6m
23
java
Spring Boot 3 and virtual threads: what really changes in APIs with blocking I/O
See when virtual threads help Spring MVC APIs with blocking I/O, with a benchmark, pinning diagnostics, and the path from Java 21 to 25.
12m