9 min read · 12 sources

A million client hosts, each opening tens of thousands of TLS connections to hundreds of thousands of database servers, was Meta’s normal. Today, a single proxy tier called ZGateway sits in front of ZippyDB and now carries about 40% of its traffic at over a billion ops per second, with roughly 6% computational overhead. The proxy cut persistent connections by 19x and made fan-in independent of client population size.

The bigger story is what that vantage point buys you. Connection sprawl was the headline problem, but a shared tier also opens the door to admission control, load balancing, cross-region resilience, and operations that are far cheaper to evolve in one place than across a million client binaries.

ZGateway handles more than 1 billion operations per second and reduced total persistent connections by roughly 19x by collapsing a million-host TLS mesh into one proxy tier.

Meta's ZGateway and the case for putting a proxy in front of your database

Source: engineering.fb.com ↗

ZippyDB is Meta’s most-used key-value store, serving billions of ops/sec globally. Under direct client access, every client host had to learn the topology of tens of thousands of shards across hundreds of thousands of DB hosts, and each one opened its own TLS connection to each shard. That many-to-many mesh caused file-descriptor exhaustion and reboot loops during reconnect storms, because every client independently reconnected after a shard hiccup.

ZGateway centralizes connection management and request batching. Now clients talk to a fleet of proxies, and the proxies fan in to ZippyDB. Beyond batching, the proxy layer enables admission control, load balancing, cross-region resilience, and richer operations. Meta’s argument is the architectural one: shared vantage-point logic is far easier and safer to evolve in one tier than to push into a million client binaries owned by hundreds of teams.

The lessons generalize. If you operate a fleet of clients against a fleet of backends, the math eventually pushes you toward a proxy. The cost is one more hop and roughly 6% overhead at Meta’s scale; the benefit is collapsing combinatorial connection sprawl into a controllable surface.

Cloudflare pairs OpenAI's GPT-5.6 Cyber with live WAF and traffic context

Source: blog.cloudflare.com ↗

Cloudflare launched an invitation-only Vulnerability Discovery and Remediation service as part of Cloudflare Managed Defense. It runs OpenAI Daybreak models, including GPT-5.6 Cyber, via the OpenAI Daybreak Defense Network, scans authorized codebases, and proposes patches plus WAF mitigations. Human approval stays in the loop before anything is applied.

The interesting part is the network-derived context. Findings are scored against Cloudflare’s own route traffic, active WAF rules, and recent attack activity, so prioritization is driven by real production exposure rather than raw CVE severity. A path traversal bug on a route nobody hits ranks below a SSRF on a path Cloudflare is seeing hammered right now. Model prompts are routed through Cloudflare AI Gateway to OpenAI’s servers.

Access is via invitation through the Managed Defense team. For security teams already running Cloudflare WAF, this is the first time the vendor’s network telemetry and an LLM hunter are wired into the same remediation loop.

ClickHouse 26.8 pipes your SQL

Source: clickhouse.com ↗

ClickHouse 26.8 introduces pipelined SQL via a new |> operator. Queries become explicit chains of stages:

FROM table |> WHERE ... |> AGGREGATE ... |> ORDER BY ... |> LIMIT ...

This builds on the FROM-first syntax ClickHouse has supported since 22.12, and the post demonstrates equivalence against the uk_price_paid dataset for conventional, FROM-first, and pipelined forms.

The important detail is what is not new. Pipelined SQL is purely syntactic sugar over the existing query model. There are no new execution semantics, so it composes with everything else: existing functions, JOINs, settings, and optimizer behavior all carry over. The win is readability and composition. Multi-step transformations stop nesting into subqueries and CTEs and start reading like the data flow you actually want. For teams writing long analytical queries against ClickHouse, this is a free upgrade in clarity.

OpenTofu is researching built-in linting

Source: opentofu.org ↗

OpenTofu is researching built-in linting support, the most-voted feature request in its GitHub repo. Investigation is happening during the v1.13 development window.

The team is being deliberate about scope. They distinguish three things: style checkers (formatting), fixed-ruleset static analyzers (built-in rules), and generic harness-style linters (custom plugins). They also flag an architectural wrinkle: OpenTofu’s plan-phase execution already produces output that looks a lot like static analysis, so figuring out where a linter actually lives in the pipeline is part of the design work. v1.13 will ship experimental built-in rules; reusable rulesets and custom plugin support are slated for later.

Treat this as a directional roadmap signal rather than a tool you can adopt. The interesting promise is unifying pre-plan static checks with post-plan policy enforcement, so the same rule can be evaluated repeatedly as more context becomes available during validation, planning, and application.

NVIDIA's central identity gateway for federated Kubernetes and AI platforms

Source: developer.nvidia.com ↗

SSO proves who you are at the entry point and then forgets. Inside a federated AI platform spanning multiple Kubernetes clusters across clouds, that leaves notebooks, catalogs, query tools, and AI assistants guessing at identity. NVIDIA’s central identity gateway pattern puts one service in charge of session creation, validation, refresh, and logout, with regional gateways enforcing local access policy.

The implementation is standard OIDC plus a shared session store, stateless data-plane gateways, and a small identity-validation API. NVIDIA reports a 55% reduction in repeated login events across internal developer platforms spanning AWS and OCI Kubernetes clusters, plus consistent logout and delegated identity for AI assistants. For teams running multi-cluster AI platforms, the pattern is a cleaner answer to the “who is this user, really?” question downstream of SSO.

YugabyteDB Resource Governance: noisy-neighbor protection for consolidated clusters

Source: yugabyte.com ↗

YugabyteDB Resource Governance is the CPU management engine behind YugabyteDB Multitenancy. It dynamically distributes CPU across active databases on a shared cluster so a runaway report or a traffic spike in one database does not starve the others.

It applies to both foreground YSQL query processing and background work. Each database gets a fair share, and predictable performance is the explicit goal. The pitch is operational: consolidate many databases onto fewer, larger clusters without giving up isolation, avoiding the old tradeoff between dedicated clusters (safe but wasteful) and full consolidation (cheap but risky). For teams running dozens of internal databases on shared Postgres-compatible infrastructure, this is the kind of control plane that makes consolidation defensible.

AWS, Kiro, and LaunchDarkly automate the experimentation loop

Source: aws.amazon.com ↗

AWS published a reference architecture that chains Kiro (code generation), AWS DevOps Agent (orchestration and release-readiness review), and LaunchDarkly (feature flags, experiments, and Guarded Releases) into an autonomous experimentation loop.

A team states a goal like “increase add-to-cart rate by 10%,” and the agents plan the experiment, implement the change, deploy it behind a flag, measure impact, and iterate within safety boundaries. Guarded Releases give you metric-driven rollouts with automatic rollback, so the loop is gated by real outcomes rather than vibes. Prerequisites include enabling AWS DevOps Agent in a supported region, a LaunchDarkly account (AWS Marketplace or direct), and registering LaunchDarkly’s hosted MCP server in the Agent Space at both account and project levels. This is the most concrete published example yet of an A/B testing tool being driven end-to-end by agents rather than humans.

Dropbox treats capacity as one coupled system

Source: dropbox.tech ↗

Dropbox detailed how its Infrastructure and Datacenter Engineering teams are absorbing AI-driven demand by squeezing more capacity out of existing data centers, combining Magic Pocket storage with colocated facilities where Dropbox runs its own servers and networking.

The framing is the actual content of the post. Dropbox treats capacity planning, fleet optimization, hardware lifecycle, power delivery, cooling, rack design, and facility planning as one coupled system, because density, power, and cooling trade off against each other. No specific numbers, versions, or product launches are disclosed, so the takeaway is the system-level optimization lens rather than any concrete efficiency metric. For engineers working on capacity or build-out, the post is a useful checklist of tradeoffs to stop treating as independent.

Docker catalogues YOLO mode flags across the major coding agents

Source: docker.com ↗

Docker’s explainer on YOLO mode is the term for running an AI coding agent with every action auto-approved and no confirmation prompts. Docker cites Stack Overflow’s 2025 Developer Survey, where 84% of developers use or plan to use AI tools, up from 76% the prior year.

The useful part is the flag map across agents: Claude Code’s --dangerously-skip-permissions, Codex CLI’s --full-auto (plus --dangerously-bypass-approvals-and-sandbox), Gemini CLI’s --yolo (or Ctrl+Y), GitHub Copilot CLI’s --allow-all / --yolo, and Cursor’s auto-run setting. Docker’s core argument is that the risk of YOLO mode is determined by the execution environment, not the autonomy itself. Running an auto-approved agent inside an isolated, disposable sandbox with scoped access and no real secrets is one thing. Running it on your laptop with your production kubeconfig is a different kind of story.

Fastly builds for Anthropic's Model Hardware Standard

Source: fastly.com ↗

Anthropic’s newly announced Model Hardware Standard (MHS) extends MCP-style agent interoperability from software into physical devices, letting AI agents safely operate robot arms, qPCR machines, and microscopes. Fastly responded by extending its stateless fastly/edge-mcp Compute implementation into an MHS research prototype.

The framing is “performance as safety.” A dropped or retryable checkout API call is merely annoying. An ambiguous “retry the move” command to a robot arm or a lab instrument can physically break materials or ruin an experiment. MHS reuses MCP’s architectural patterns but materially expands the security and reliability surface area. Fastly is positioning the edge as the right tier to host that bridge between software agents and physical hardware. For engineers integrating agentic tooling with non-software actuators, this is the spec to read.

Two repos worth a look

Source: github.com ↗

diagram-design is a Claude Code, Codex, Factory Droid, Pi, and Agent Skills-compatible skill shipping 39 editorial diagram types as self-contained HTML and SVG with no JavaScript, no build step, and no external images. Version 2.5.10 adds ten layout grammars, including Sankey, fishbone, Wardley map, kanban, user journey, deployment, dependency graph, UML class, story map, and database schema. It also redraws draw.io or Mermaid sources in the same design system at your chosen format and size, and ships each type in minimal-light, minimal-dark, and full-editorial static variants.

Alien is a managed self-hosting platform: a CLI plus cloud control plane that lets vendors deploy and operate software inside customer environments while retaining centralized control over updates, monitoring, and lifecycle. Install is a one-line curl or PowerShell script, and AI workloads are configured via flags like alien projects capabilities enable models --model byo/claude-opus-5 --provider anthropic, gated through least-privilege API keys. It targets the pain point where customers self-host but lack operational expertise, leaving the vendor blamed for breakage they cannot access or debug.