While cleaning up my public GitHub repos I found a workflow that referenced a compromised trivy-action tag, checked whether I was exposed, and replaced the tag with a pinned commit and a self-test.

One oversized company homepage ran Job Radar's crawler out of memory, and because the task came back after every restart, almost nothing was collected for nearly 6 hours and nothing alerted.

Fleet Pulse's canary controller for Docker Compose and Traefik blocked three Job Radar releases on the day I built it, one deliberate failure and two real flaws in my own setup.

A restart of Docker's socket left containers holding a stale bind mount, so Traefik returned 404 for new routes and monitoring agents went blind; a small self-healing script on five nodes fixed it.

Traefik's IP allowlist for the tailnet range rejected tailnet clients because Tailscale's exit-node masquerade changed their source address, fixed with a mangle rule on all five nodes.

Promtail looped forever on a backlog Loki would not accept, and every retry made dockerd re-parse 159 MB of container logs; a positions volume, a slower service-discovery refresh and a force-recreate fixed it.

A VPS hit load 93 on 4 cores with 66% steal time; the cause was the host, not the workloads, and the useful work was in the alerts and in how I read the numbers.

A shared API key was restricted, two posting bots kept running without errors anyone saw, and a client's social channels went quiet or repeated themselves for about two months.

After Jenkins stopped working for a client's Astro and Strapi site, I wrote a deploy script that checks the page count, stages the build while the old one serves, and rolls back on a failed health check.