Field Signal · Curated Reading
The Engineering
Signal.
High-signal field notes, architecture teardowns, and engineering writing from 50 publications. A focused reading queue for becoming a stronger end-to-end engineer. Updated 20 Aug.
How AgentFlo built AI sales agents with Amazon Bedrock AgentCore – Part 1
Learn how AgentFlo built always-on AI sales agents on Amazon Bedrock AgentCore and the Strands Agents SDK. Part 1 covers three pillars of production-grade agents—velocity, standardization, and scalability—including recipe-based deployment, tool routing through AgentCore Gateway, and elastic, statefu...
A revisit of remote Spectre attacks on Cloudflare Workers
In 2024 and 2025, we reassessed remote Spectre attacks on our Workers infrastructure. We share details about the new attack primitives like Spectre gadgets, remote timers, achieving co-location and how new defenses further harden Cloudflare Workers.
How Clario technology detects PHI/PII in DICOM images using Amazon Bedrock
Clario, part of Thermo Fisher Scientific, uses Amazon Bedrock and Amazon Textract to automatically detect protected health information (PHI) and personally identifiable information (PII) across thousands of DICOM image slices in clinical trials, covering both metadata tags and text burned into the i...
AI-powered clinical trial eligibility and safety using Amazon Bedrock AgentCore
AI agents built on Amazon Bedrock AgentCore help clinical trial teams make fast, accurate enrollment decisions while keeping clinicians in control. This post shows how to architect an eligibility and safety screening agent using AWS HealthLake, AgentCore, and AgentCore Evaluations.
Kyverno is a platform primitive, not a security tool
Where does Kyverno live in your organization? I don’t mean which cluster! On which team’s slide deck does it show up? Whose budget line? For most companies I’ve talked to, the answer is security. Kyverno is...
How CISA’s BOD 26-04 changes vulnerability prioritization
Learn how CISA’s BOD 26-04 mandates risk-based vulnerability prioritization and how Datadog helps teams prioritize and remediate critical findings.
20× the CI traffic without getting slower: How we rebuilt Git serving at Datadog
Learn how Datadog built gitretriever to handle 20× more CI Git traffic while maintaining low latency and reducing backend CPU usage.
From chaos to context: Building an AI dev workflow
There's a particular kind of frustration that happens when prompting an AI assistant with the same correction multiple times in a single session. The marvels of modern large language models (LLMs) make it so you're working with the most enthusiastic apprentice you'll ever have. However, that apprent...
Improving infrastructure efficiency for growing demand in the age of AI
As demand for AI continues to grow, so does the infrastructure needed to support it.
BGP Role model: tracking the adoption of RFC 9234
RFC 9234 lets routers reject route leaks on their own, using BGP Roles and the Only to Customer attribute. We measured who has deployed it, and found two Tier 1 networks unexpectedly stripping OTC.
Cloud Native platform sovereignty through multi-plane architecture
When people talk about cloud sovereignty, the conversation often starts with regions: where a workload runs and where its data is stored. But choosing a region is only part of the story. The architecture of the...
Consistency is the new latency: AI at the data layer
As AI agents move from chatbots to taking action, their reliability depends on the consistency of the data layer beneath them. This post examines how replication lag poisons an agent's context and shows how to match Amazon Aurora, Amazon DynamoDB, and Amazon Keyspaces replication models to each task...
Two ways to measure the cumulative impact of experiments
Summing individual wins overstates true impact. See two accurate methods, holdouts and Datadog’s Cumulative Impact, and how to choose between them.
Centralize human and agentic work with Datadog Work Management
Learn how Datadog Work Management helps you coordinate human and AI agent–driven work while preserving context, ownership, and activity across tools.
Trace AWS Lambda durable functions with Datadog
Trace AWS Lambda durable executions across invocations to investigate operations, retries, failures, waits, and function status in Datadog.
From OpenTofu to Argo CD: GitLab as your AWS control plane
Configuring cloud-based environments is complex, as it requires considering networking, subscriptions, services, and all the components that make up the underlying infrastructure. Manual setup is error-prone, inconsistent, and difficult to reproduce. This tutorial shows how to set up a fully automat...
Avoid the massive end-to-end tax of default full history clones
It's easy to think of git clone as a client-side operation, but the settings of this operation impact the server side and all networks in between. When you run a default full history clone, the server has to walk the entire history, build a pack file for it (that's what "counting objects" is actuall...
Welcome Falkey the Falco and Ky the Kyverno Pyrenees
If you have yet to meet Phippy, she’s a friendly PHP app exploring the cloud native world with her pals. Over the last decade, Phippy’s circle has grown to include eighteen friends, with the newest members...
Governance guidance for CNCF projects: Choosing the right structure for your project’s size and stage
Clear patterns have emerged from governance reviews across 72 CNCF projects, distinguishing between what the CNCF requires at each maturity level versus what the data recommends for long-term project health. This post captures those patterns as...
GitLab Critical Patch Release: 19.2.4, 19.1.6, 19.0.8, 18.11.11
Open the source for the full engineering note.
Critical remote code execution in Serena, a popular MCP coding agent
Serena, one of the most widely used AI coding agents, ran attacker-supplied code the moment a developer opened a project. GitLab's Threat Research Group found a critical server-side template injection (GHSA-pp25-4cg4-qcr9, CVE pending) that executes arbitrary code in the Serena process. Anyone on se...
How Cloudflare detects MCP traffic and helps secure it
Cloudflare Gateway identifies MCP requests using protocol-level heuristics. Security teams can use that signal to find shadow MCP traffic, enforce Portal-only access for approved servers, and block direct connections on managed network paths.
Secure all your internal vibe-coded applications — in one click
Introducing Cloudflare Access for Workers. Attach an Access policy directly to a Worker and it applies everywhere that Worker runs — routes, custom domains, workers.dev, and previews — automatically.
Eleven minutes, zero humans: Building a self-healing Kubernetes upgrade pipeline on Kairos
Once upon a time, upgrading a Kubernetes control plane meant staying awake for it. SSH into every node. Run the upgrade by hand. Watch etcd health the whole time, hoping quorum holds through every reboot. This...
Serverless vehicle tracking at scale: Bosch L.OS on AWS
Learn how Bosch Mobility Platform Solutions built L.OS, a serverless vehicle tracking platform on AWS that unifies India's fragmented spot logistics market into a single real-time visibility layer using Amazon ECS, AWS Lambda, and Amazon MSK.