I ran curl ifconfig.me on four different servers and got the same address back four times. That single result invalidated the entire approach I had spent three days validating on EC2. This is the full path from that discovery to three services running on my own subdomains with valid certificates and zero inbound ports.
Most Kubernetes debugging images ship as a monolithic package. netshoot is 202 MB. That 202 MB gets pulled whether the task requires dig or tshark. On edge clusters, metered connections, or environments with registry pull rate limits, that bandwidth cost accumulates across teams and incidents.
DebugBox takes a different approach: three variants, each scoped to a specific category of debugging work.
DebugBox ships 3 container image variants across 2 architectures to 2 registries, producing 22 tags per release. The pipeline that handles this has three properties I consider non-negotiable: no image ships without a security scan, no manual step is required to cut a release, and local development runs the same checks as CI.
This post covers the full pipeline architecture: how the base image lifecycle was separated from the variants, why SHA digest pinning replaced :latest, and how Trivy gates are configured to block releases on real vulnerabilities.
DebugBox v1.0.0 shipped with every tool I could justify. The power variant included bird (a BGP routing daemon), bridge-utils, nano, py3-pip, and speedtest-cli. In v1.1.0, all five were removed. Several other tools were moved between variants. The result: balanced dropped from 51 MB to 47 MB, power from 112 MB to 91 MB.
This post covers the decision framework used to evaluate each tool, the specific changes made, and how the project's manifest system prevents tool lists from drifting across documentation.
This document defines the exact rules for writing project cards in data/projects.yaml for projects.ibtisam-iq.com. Every rule was extracted from real mistakes caught and corrected during the authoring sessions. If an LLM is reading this, follow every rule exactly.
The YAML file is the single source of truth. A push to data/projects.yaml triggers node scripts/generate-projects.js, which auto-generates src/data/projects.ts. The generated TypeScript file must never be edited directly.
Writing clear, professional content is just as critical as writing immutable infrastructure code. Whether I am drafting a runbook, an architectural design document, or a professional summary, I have defined a strict LLM persona to ensure consistency.
Whenever I use AI to assist with writing, I provide it with a link to this exact reference page. This ensures the output reflects my actual engineering philosophy, experience level, and writing style. It avoids the arrogance of a "10-year Principal Architect," completely bans "robotic AI speak," and maintains strict production-grade standards.
Everything was green for months. One new folder added, one push made, and CI started crashing with AttributeError: 'NoneType' object has no attribute 'replace'. Local builds: perfectly fine. GitHub Actions: dead.
This is the full root cause analysis and fix.