# DevOps Insights > Practical DevOps reference organised around symptoms rather than subjects: named error states with documented cause sets, side-by-side comparisons of concepts people routinely conflate, and calculators that run entirely in the browser. Pages are written for the shape of the arrival. Somebody who pasted an error string from a terminal wants /problems; somebody holding two concepts they believe are one wants /compare; somebody who needs a number wants /tools. Each problem page follows a fixed model — what it means, how you know, why it happens by cause, how to diagnose, how to fix, how to verify, how to prevent. Technical claims are sourced to primary documentation — vendor docs, man pages, specifications — that was fetched and checked rather than recalled. Where a detail could not be confirmed it is flagged as unconfirmed instead of being filled in. Likelihood is stated as common, occasional or rare, never as an invented percentage, and every listed cause carries a command that confirms or rules it out. No page requires an account and none asks the reader to connect infrastructure. The tools hold no state server-side. ## Problems — named error states, with causes and diagnosis - [Error acquiring the state lock](https://devopsinsights.in/problems/terraform-state-lock-stuck): Terraform. Something holds the Terraform state lock, usually a run that was killed before it could release it. But it may be a run that is still very much alive, and `force-unlock` on that… - [Terraform wants to change something nobody changed](https://devopsinsights.in/problems/terraform-state-drift): Terraform. A plan proposes changes to resources you did not touch: reality moved out from under the state, or the provider reports a difference that is not real. Reality moves when, for… - [502 Bad Gateway](https://devopsinsights.in/problems/http-502-bad-gateway): HTTP. The proxy could not get a usable response from the upstream server behind it, and is reporting a fact about somebody else. The answer is usually in whether the upstream was reachable… - [504 Gateway Timeout](https://devopsinsights.in/problems/http-504-gateway-timeout): HTTP. The proxy gave up waiting: usually for a response from a reachable upstream, occasionally for the connection itself. Unlike a 502, nothing failed — the proxy gave up waiting, which… - [Container exits immediately](https://devopsinsights.in/problems/docker-container-exits-immediately): Docker. The container starts, the process finishes, and Docker stops the container — because a container lives exactly as long as its main process. The exit code tells you which of two… - [Bind for 0.0.0.0:PORT failed: port is already allocated](https://devopsinsights.in/problems/docker-port-already-allocated): Docker. Something already holds the host port you asked Docker to publish, so the new container cannot bind it. Usually another running container, and sometimes a process on the host that… - [Connection refused between containers](https://devopsinsights.in/problems/docker-cannot-connect-between-containers): Docker. Almost always one of three: `localhost` used instead of the other container's name, no shared network, or the app listening only on its own loopback. Each has a one-line check below. - [no space left on device](https://devopsinsights.in/problems/docker-no-space-left-on-device): Docker. Docker has filled the filesystem, and almost always with things nothing is using: build cache, dangling images, stopped containers and orphaned volumes. Deleting containers does not… - [permission denied while trying to connect to the Docker daemon socket](https://devopsinsights.in/problems/docker-socket-permission-denied): Docker. Your user cannot open the Docker daemon's socket, /var/run/docker.sock, which only root and members of the docker group can use. Add yourself to the group and start a new login… - [The connection to the server localhost:8080 was refused](https://devopsinsights.in/problems/kubectl-connection-refused-localhost-8080): Kubernetes. kubectl found no kubeconfig, so it fell back to its built-in default, http://localhost:8080, where no API server is listening. The fix is to give kubectl the cluster's… - [error: You must be logged in to the server (Unauthorized)](https://devopsinsights.in/problems/kubectl-unauthorized-must-be-logged-in): Kubernetes. The API server was reached but rejected the credentials kubectl sent, with HTTP 401. Usually the client certificate has expired (kubeadm's last one year), a token or cloud login… - [CrashLoopBackOff](https://devopsinsights.in/problems/kubernetes-crashloopbackoff): Kubernetes. A container starts, exits, and Kubernetes restarts it — repeatedly. The loop itself is not the fault; it is the symptom of whatever makes the container exit. - [OOMKilled (exit code 137)](https://devopsinsights.in/problems/kubernetes-oomkilled): Kubernetes. The kernel killed your container because memory ran out: usually the container went over its own limit, sometimes the whole node ran short. Reason `OOMKilled` is the signature… - [ImagePullBackOff](https://devopsinsights.in/problems/kubernetes-imagepullbackoff): Kubernetes. The kubelet cannot retrieve the container image, and is now backing off between attempts. Almost always the name, the credentials, or the network — in that order of likelihood. - [Pod stuck in Pending](https://devopsinsights.in/problems/kubernetes-pod-pending): Kubernetes. The pod exists in the API but no node has accepted it. Nothing is running yet, so logs are empty — the answer is always in the scheduler's own explanation. - [Not authorized to perform sts:AssumeRoleWithWebIdentity](https://devopsinsights.in/problems/github-actions-oidc-assume-role-failed): GitHub Actions. GitHub issued a valid OIDC token and AWS refused to exchange it for the role's temporary credentials. Almost never a permissions problem — the role's trust policy is… - [Error: no matching signatures](https://devopsinsights.in/problems/cosign-no-matching-signatures): Sigstore / cosign. cosign found no signature on the image that satisfies the identity you asked it to accept. Either nothing signed it, or something did and you are checking for a different… - [push declined due to repository rule violations](https://devopsinsights.in/problems/github-push-declined-secret-detected): GitHub. GitHub found something that looks like a credential in the commits you are pushing and refused the push. Deleting the line and committing again does not clear it — the secret is… - [Passes locally, fails in CI](https://devopsinsights.in/problems/ci-passes-locally-fails-in-ci): CI/CD. The same commit behaves differently on two machines, so something about those machines differs. The list of candidates is short, and each one can be confirmed rather than guessed at. - [Service has no endpoints](https://devopsinsights.in/problems/kubernetes-service-has-no-endpoints): Kubernetes. The Service exists and its name resolves, but nothing is behind it, so connections to it have nowhere to go. Almost always the selector, the readiness of the pods, or the port —… - [The model performs worse in production than in evaluation](https://devopsinsights.in/problems/model-worse-in-production-than-evaluation): MLOps. Evaluation said one thing and production says another, yet nothing errors, nothing restarts, and the service is healthy. That is why this is usually found late and by somebody… - [The vulnerability scan blocked the build](https://devopsinsights.in/problems/vulnerability-scan-blocked-the-build): CI/CD. A scanner found something and stopped the pipeline, and the question is not how to make it pass. It is whether this finding is reachable, exploitable and fixable, and those are three… - [PersistentVolumeClaim stays Pending](https://devopsinsights.in/problems/kubernetes-pvc-pending): Kubernetes. The PersistentVolumeClaim stays Pending because it asks for storage nobody has offered yet. Either no StorageClass is provisioning, the class is waiting for a pod on purpose, or… - [x509: certificate signed by unknown authority](https://devopsinsights.in/problems/x509-certificate-signed-by-unknown-authority): TLS. Your client does not trust the server's certificate: Go says signed by unknown authority, curl and OpenSSL say unable to get local issuer certificate. Three different situations… - [Too many open files](https://devopsinsights.in/problems/linux-too-many-open-files): Linux. A process asked for one more file descriptor than it is allowed to have. Sockets cost descriptors too, so this usually arrives disguised as a network fault. Two different errors… - [Pod stuck in Terminating](https://devopsinsights.in/problems/kubernetes-pod-stuck-terminating): Kubernetes. Deletion of the pod was accepted but not completed, so it shows Terminating and stays there. The pod carries a deletionTimestamp and is waiting on something — a grace period… - [context deadline exceeded](https://devopsinsights.in/problems/prometheus-context-deadline-exceeded): Prometheus. The scrape took longer than scrape_timeout, so Prometheus gave up and marked the target down. The default window is 10 seconds. The usual cause is an exporter doing real work… - [DNS lookup fails inside a pod](https://devopsinsights.in/problems/kubernetes-dns-resolution-failure): Kubernetes. A pod cannot turn a name into an address, so connections by Service or host name fail. The cluster's DNS has a short, fixed chain — CoreDNS pods, the kube-dns Service, its… - [Push rejected as non-fast-forward](https://devopsinsights.in/problems/git-push-rejected-non-fast-forward): Git. The remote branch has commits yours is not built on, so accepting your push would drop them. Git refuses by default. The fix is almost never --force — it is to incorporate what is… - [fatal: refusing to merge unrelated histories](https://devopsinsights.in/problems/git-refusing-to-merge-unrelated-histories): Git. The two branches share no commit at all, so Git cannot tell what changed on each side and refuses rather than guess. Usually a repository was created on the host with a README while… - [FATAL: sorry, too many clients already](https://devopsinsights.in/problems/postgres-too-many-connections): PostgreSQL. PostgreSQL has a fixed number of connection slots and every one is taken. Which of two messages you got matters: one means your application has run out while the database still… - [systemd service fails to start](https://devopsinsights.in/problems/systemd-service-fails-to-start): systemd. systemd tried to start the service and it did not stay up, and the exit status tells you which of two very different things happened. Either systemd could not even launch your… - [Error: Invalid for_each argument](https://devopsinsights.in/problems/terraform-invalid-for-each-argument): Terraform. Terraform names every for_each instance by its key, so it needs those keys before it changes anything. When a key comes from something that does not exist yet, a function such as… - [Error: Saved plan is stale](https://devopsinsights.in/problems/terraform-saved-plan-is-stale): Terraform. A saved plan records the state it was worked out against, and Terraform refuses to apply it once that state has changed. Anything that writes the state in between counts —… - [Error: Inconsistent dependency lock file](https://devopsinsights.in/problems/terraform-inconsistent-dependency-lock-file): Terraform. `.terraform.lock.hcl` records exactly which version of each provider the configuration uses. When the configuration asks for a provider the lock file does not have, or for a… - [Permission denied (publickey)](https://devopsinsights.in/problems/ssh-permission-denied-publickey): SSH. The server tried every key your client offered and accepted none, and that one line covers several unrelated problems. The key is not in authorized_keys, the wrong user, file… - [Host key verification failed](https://devopsinsights.in/problems/ssh-host-key-verification-failed): SSH. SSH could not match the server's host key against your known_hosts file, so it stopped before sending anything. Either the key changed, which can be a rebuilt server or someone… - [npm error ERESOLVE unable to resolve dependency tree](https://devopsinsights.in/problems/npm-eresolve-unable-to-resolve-dependency-tree): npm. npm could not build a dependency tree that satisfies every package's peerDependencies, so it stopped. The error names the package already in your tree and the package whose peer range… - [413 Request Entity Too Large](https://devopsinsights.in/problems/nginx-413-request-entity-too-large): nginx. Something between the client and your application refused the request because its body was larger than that layer allows. On nginx the limit is client_max_body_size, 1m unless set… - [Pod Evicted](https://devopsinsights.in/problems/kubernetes-pod-evicted): Kubernetes. The kubelet stopped the pod to protect its node, or because the pod went over its own ephemeral-storage limit. The pod is left behind with phase Failed, reason Evicted, and a… - [CreateContainerConfigError](https://devopsinsights.in/problems/kubernetes-createcontainerconfigerror): Kubernetes. The kubelet could not assemble the container's configuration, so it never created the container. Usually a ConfigMap or Secret the container's environment refers to does not… - [Readiness probe failed](https://devopsinsights.in/problems/kubernetes-readiness-probe-failed): Kubernetes. The kubelet's readiness check on a container failed, so the pod is marked not ready and Services stop sending it traffic. The container is not restarted. The event's text after… - [exec format error](https://devopsinsights.in/problems/docker-exec-format-error): Docker. The kernel refused to run the container's entrypoint because the file is not something it can execute here. Usually the image was built for another CPU architecture, amd64 on an… - [kubelet is configured to not run on a host using cgroup v1](https://devopsinsights.in/problems/kubelet-cgroup-v1-not-supported): Kubernetes. From Kubernetes 1.35 the kubelet refuses to start on a node that still uses cgroup v1, because its failCgroupV1 setting now defaults to true. The lasting fix is moving the node… - [static pods may not reference](https://devopsinsights.in/problems/kubernetes-static-pod-api-reference): Kubernetes. From Kubernetes 1.34 the kubelet refuses a static Pod that refers to an API object: a ConfigMap, Secret, ServiceAccount or PersistentVolumeClaim. Kubernetes 1.37 removed the… - [additional privileges requested: pass --allow=fs.read](https://devopsinsights.in/problems/docker-compose-build-additional-privileges-requested): Docker Compose. Since Buildx 0.37.2, `docker compose build` fails when a Dockerfile, a build secret or an SSH key lives outside the project directory. Bake now enforces its filesystem… - [Runner version is deprecated and cannot receive messages](https://devopsinsights.in/problems/github-actions-runner-version-deprecated): GitHub Actions. GitHub stops sending jobs to a self-hosted runner that is too far behind the newest runner release, and GitHub Enterprise Cloud enforces this since 29 Sep 2026. A runner… - [blob unknown to registry](https://devopsinsights.in/problems/docker-push-blob-unknown-to-registry): Docker. Since Docker 29.7 (BuildKit 0.32), images are built with their provenance attestation stored as an OCI artifact that points at the image manifest. Some registries, GitLab's among… - [net/http: timeout awaiting response headers](https://devopsinsights.in/problems/docker-push-timeout-awaiting-response-headers): Docker. Docker 29.7+ and containerd 2.3+ give a registry 30 seconds to start answering, so pushing or pulling a large layer from a slow registry fails. Registries that finish storing or… - [disk quota exceeded writing to /tmp](https://devopsinsights.in/problems/ubuntu-26-04-tmp-disk-quota-exceeded): Ubuntu 26.04. Ubuntu 26.04 mounts /tmp in RAM, limited to half the memory with a per-user quota, so writing several gigabytes there fails while the disk is nearly empty. It hits GitHub's… - [bufio.Scanner: token too long](https://devopsinsights.in/problems/terraform-aws-bufio-scanner-token-too-long): Terraform AWS provider. Terraform AWS provider 6.69.0 fails any API call with a line over 64 KB: large IAM managed policies, Lambda layer uploads, API Gateway templates. Upgrade to 6.69.1… - [Missing Resource Identity After Read](https://devopsinsights.in/problems/terraform-missing-resource-identity-after-read): Terraform. A provider release added or changed resource identity, and it reads your existing resources wrongly: no identity at all, or one that differs from state. It is a provider bug… - [Provider produced inconsistent result after apply](https://devopsinsights.in/problems/terraform-provider-produced-inconsistent-result-after-apply): Terraform. After apply the provider returned a different value than it planned, usually because the API rewrote what you sent: its case, order or JSON formatting. On create, Terraform keeps… - [error: externally-managed-environment](https://devopsinsights.in/problems/pip-externally-managed-environment): Python (pip). pip refuses to install into a Python that the operating system or Homebrew manages, so a system update cannot break it. Install into a virtual environment, use pipx for… - [You have reached your pull rate limit](https://devopsinsights.in/problems/docker-hub-pull-rate-limit): Docker Hub. Docker Hub limits how many images can be pulled without a paid account, counted per IP address for anonymous pulls, and you went over. Authenticate every pull with docker login… - [failed calling webhook](https://devopsinsights.in/problems/kubernetes-failed-calling-webhook): Kubernetes. The API server could not reach an admission webhook that has to approve your request, so it rejected the request. The text after failed to call webhook says why: no pods behind… - [fatal: detected dubious ownership in repository](https://devopsinsights.in/problems/git-detected-dubious-ownership): Git. Git refuses to work in a repository owned by another user, because that user's config could run commands as you. Common in containers, CI and shared drives. Fix the ownership, or mark… - [Unable to locate credentials](https://devopsinsights.in/problems/aws-unable-to-locate-credentials): AWS CLI. The AWS CLI or SDK found no credentials anywhere it looks: no environment variables, no profile with keys, no instance or container role. Run aws configure list to see what it… - [Error: Kubernetes cluster unreachable](https://devopsinsights.in/problems/helm-kubernetes-cluster-unreachable): Helm. Helm could not reach a cluster: localhost:8080 in the message means it found no kubeconfig at all, any other address means nothing answered there. In Terraform it usually means the… - [SignatureDoesNotMatch](https://devopsinsights.in/problems/aws-signaturedoesnotmatch): AWS. AWS recalculated your request's signature and got a different one: the secret key, a header, the URL or the clock differs from what was signed. With presigned S3 URLs it is usually a… - [exec /entrypoint.sh: no such file or directory](https://devopsinsights.in/problems/container-exec-no-such-file-or-directory): Docker. The entrypoint exists, but the program that runs it does not: a Windows line ending in its first line, bash missing from the image, or a glibc binary on Alpine. Fix the line… - [remote: Support for password authentication was removed](https://devopsinsights.in/problems/github-password-authentication-removed): GitHub. GitHub stopped accepting account passwords for Git over HTTPS on 13 August 2021, so use a personal access token, gh auth login or SSH instead. If Git does not even ask, a saved old… - [Error: Invalid count argument](https://devopsinsights.in/problems/terraform-invalid-count-argument): Terraform. Terraform must know how many instances count makes before it plans, but your count comes from a value that only exists after apply, such as an ID. Derive count from values in… - [fatal: Need to specify how to reconcile divergent branches](https://devopsinsights.in/problems/git-pull-divergent-branches): Git. Your branch and the remote both have commits the other lacks, and since Git 2.33.1 git pull will not choose between merging and rebasing for you. Pick one for this pull with --rebase… - [Unable to negotiate: no matching host key type found. Their offer: ssh-rsa](https://devopsinsights.in/problems/ssh-unable-to-negotiate-no-matching-host-key-type): OpenSSH. Your SSH client and the server share no allowed algorithm, usually because the server offers only retired ones: ssh-rsa SHA-1, old key exchange or CBC. Update or reconfigure the… - [ExpiredToken: The security token included in the request is expired](https://devopsinsights.in/problems/aws-security-token-expired): AWS. Temporary AWS credentials have a lifetime, from 15 minutes to 12 hours, and the ones being used have run out. Most often they were exported as environment variables, which never renew… - [error: src refspec main does not match any](https://devopsinsights.in/problems/git-src-refspec-does-not-match-any): Git. Git has no local branch called main to push: there are no commits yet, the branch is called master, or CI checked out a single commit. Push the branch you have, rename it, or push… - [error: remote origin already exists](https://devopsinsights.in/problems/git-remote-origin-already-exists): Git. The repository already has a remote called origin, often because you cloned it or ran the setup steps twice, so git remote add origin refuses. Change its URL with git remote set-url… - [Error: Backend configuration changed](https://devopsinsights.in/problems/terraform-backend-configuration-changed): Terraform. The backend settings in your configuration no longer match what this working directory was set up with, so Terraform wants init again. Use -migrate-state to move existing state… - [no matches for kind in version](https://devopsinsights.in/problems/kubernetes-no-matches-for-kind): Kubernetes. The cluster does not serve that kind in that apiVersion: the version was removed in a Kubernetes upgrade, or the kind's CRD is not installed. Change the manifest to the served… - [error: Your local changes to the following files would be overwritten by merge](https://devopsinsights.in/problems/git-local-changes-would-be-overwritten-by-merge): Git. git pull stopped because you have uncommitted edits to files the incoming commits also change, and merging would overwrite them. Commit them, stash them around the pull, or discard… - [error: pathspec did not match any file(s) known to git](https://devopsinsights.in/problems/git-pathspec-did-not-match-any-files): Git. git checkout did not find a local branch, tag or file with that name, so it treated the name as a file path and matched nothing. Usually the branch exists only on the remote and has… - [fatal: The current branch has no upstream branch](https://devopsinsights.in/problems/git-current-branch-has-no-upstream): Git. The branch you are pushing was created locally and is not yet linked to a branch on the remote, so a plain git push does not know where to send it. Push it once with git push -u origin… - [*** Please tell me who you are](https://devopsinsights.in/problems/git-please-tell-me-who-you-are): Git. Git needs a name and email for every commit and none is configured for this user, which is normal in fresh containers and CI runners. Set user.name and user.email with git config… - [ssh: Could not resolve hostname](https://devopsinsights.in/problems/ssh-could-not-resolve-hostname): OpenSSH. ssh could not turn the host name into an IP address, so it never got as far as connecting or logging in. Usually a typo, a Host alias in ~/.ssh/config pointing at the wrong… - [Error: Reference to undeclared resource](https://devopsinsights.in/problems/terraform-reference-to-undeclared-resource): Terraform. Terraform found a reference to a resource that does not exist in the module where the reference is written. Usually a typo, a resource that lives in another module, or a data… - [Error: Duplicate resource configuration](https://devopsinsights.in/problems/terraform-duplicate-resource-configuration): Terraform. Two resource blocks in the same module have the same type and name, so Terraform cannot tell which one you mean. Usually the same block was pasted into two .tf files, or a copied… - [Error: Unsupported argument](https://devopsinsights.in/problems/terraform-unsupported-argument): Terraform. Terraform does not accept a name you used inside a block: the resource, data source or module has no argument or nested block with that name. Usually a typo, an argument written… - [fatal: not a git repository](https://devopsinsights.in/problems/git-not-a-git-repository): Git. Git looked in this directory and every parent for a .git and found none, so the command has no repository to work on. Usually you are in the wrong directory, or the files were copied… - [WARNING: UNPROTECTED PRIVATE KEY FILE!](https://devopsinsights.in/problems/ssh-unprotected-private-key-file): OpenSSH. ssh refused to use your private key because other users on the machine could read it, and then fell back to other keys or failed. Make the file readable by you alone with chmod… - [Error: Variables not allowed](https://devopsinsights.in/problems/terraform-variables-not-allowed): Terraform. Terraform found var. (or a local or data value) in a place that is read before variables exist: a backend block, a variable's default, or a module's source. For a backend, pass… - [Error: No value for required variable](https://devopsinsights.in/problems/terraform-no-value-for-required-variable): Terraform. A variable in the configuration you are running (the root module) has no default and no value reached it. Terraform could not ask for one, because input is off, as in CI. Usually… - [Error: Missing required argument](https://devopsinsights.in/problems/terraform-missing-required-argument): Terraform. A resource, data source or module block leaves out an argument that it must have. Usually it was never set, it is misspelt (look for an Unsupported argument error beside it), or… - [/bin/bash^M: bad interpreter: No such file or directory](https://devopsinsights.in/problems/bad-interpreter-no-such-file-or-directory): Linux. The kernel could not find the program named on the script's first line. The ^M in the message means the file has Windows line endings, so the interpreter's name ends in an invisible… - [Error: Unsupported attribute](https://devopsinsights.in/problems/terraform-unsupported-attribute): Terraform. A reference asks for an attribute that the value it points at does not have. Usually a module output that was never declared, a misspelt attribute, a field read from a whole list… - [error: cannot lock ref](https://devopsinsights.in/problems/git-cannot-lock-ref): Git. Git could not update a branch or remote-tracking ref, so the fetch, pull or commit stopped part-way. Usually a remote branch such as feature was replaced by one such as feature/x, two… - [fatal: Unable to create '.git/index.lock': File exists](https://devopsinsights.in/problems/git-index-lock-file-exists): Git. Git found .git/index.lock, the file it uses to stop two commands changing the staging area at once, so it refused to start. Either another Git command really is running, or one crashed… - [yaml: mapping values are not allowed in this context](https://devopsinsights.in/problems/yaml-mapping-values-are-not-allowed): YAML. The parser met a colon followed by a space where a new key cannot start. Usually a value that itself contains ": " and is not quoted, two keys on one line, or a line indented further… - [yaml: did not find expected key](https://devopsinsights.in/problems/yaml-did-not-find-expected-key): YAML. A line inside a block is indented differently from the keys around it, so the parser cannot place it. The line number usually points at the line before the real mistake, which is why… - [yaml: found character that cannot start any token](https://devopsinsights.in/problems/yaml-found-character-that-cannot-start-any-token): YAML. The parser met a character YAML does not allow there: almost always a tab used for indentation, or an unquoted value starting with @ or a backtick. - [ssh: connect to host port 22: Connection refused](https://devopsinsights.in/problems/ssh-connection-refused): OpenSSH. Your machine reached the server, and something there answered that nothing accepts connections on that port. Usually sshd is not running, you are using the wrong port, or a… - [kex_exchange_identification: Connection closed by remote host](https://devopsinsights.in/problems/ssh-kex-exchange-identification): OpenSSH. The TCP connection opened, but the server closed or reset it before the two sides even exchanged SSH greetings. Usually sshd is refusing new connections for a while (too many… - [ssh: connect to host port 22: Connection timed out](https://devopsinsights.in/problems/ssh-connection-timed-out): OpenSSH. Your packets left, but nothing came back: no answer, not even a refusal. Usually a firewall or cloud security rule silently drops them, the address is wrong or private, or the… - [JavaScript heap out of memory](https://devopsinsights.in/problems/javascript-heap-out-of-memory): Node.js. Node.js ran out of room in its own memory heap and stopped the process: the job needed more than V8's heap limit allows. Usually a build or test run that is simply big, a leak in a… - [Makefile: *** missing separator](https://devopsinsights.in/problems/make-missing-separator): Make. make found a line in your Makefile that it cannot read as a rule, a variable or a recipe. Almost always a recipe line indented with spaces instead of a tab; sometimes a merge-conflict… - [bind: Address already in use (EADDRINUSE)](https://devopsinsights.in/problems/address-already-in-use): Linux and macOS. Your program asked the operating system for a network port that something else is already listening on, so it could not start listening there. Usually an earlier copy of… - [fatal: could not read Username for 'https://github.com': terminal prompts disabled](https://devopsinsights.in/problems/git-could-not-read-username): Git. Git needed a username and password for an https:// repository, had none stored, and was not allowed to ask. Usually a CI job with no credentials for that repository, a private or… - [syntax error: unexpected end of file](https://devopsinsights.in/problems/bash-syntax-error-unexpected-end-of-file): Bash. Bash reached the end of your script while a block it was reading was still open, so it gave up. Usually an if without its fi, a loop without done, a function without its closing… - [Error: Invalid value for input variable](https://devopsinsights.in/problems/terraform-invalid-value-for-input-variable): Terraform. A value given to a Terraform variable does not match the variable's type, or fails one of its validation rules. The message says which variable, where the value came from, and… - [npm error code EACCES: permission denied, mkdir](https://devopsinsights.in/problems/npm-eacces-permission-denied): npm. npm tried to create a folder your account is not allowed to write to, usually the shared folder for global packages or a cache left owned by root. The fix is to install where you own… - [SyntaxError: Cannot use import statement outside a module](https://devopsinsights.in/problems/node-cannot-use-import-statement-outside-a-module): Node.js. Node.js loaded your file as a CommonJS script, where import statements are not allowed. Usually the package is not marked as an ES module, the Node.js version is older than… - [Error \[ERR_REQUIRE_ESM\]: require() of ES Module not supported](https://devopsinsights.in/problems/node-err-require-esm): Node.js. CommonJS code called require() on a package or file that is an ES module, and this Node.js version cannot load ES modules that way. Newer Node.js can, except for modules that use… - [warning: LF will be replaced by CRLF the next time Git touches it](https://devopsinsights.in/problems/git-lf-will-be-replaced-by-crlf): Git. A warning, not an error: Git is set to convert line endings, and this file will get different ones in your working folder at its next checkout. Your commit still worked. - [SSL routines::wrong version number](https://devopsinsights.in/problems/ssl-wrong-version-number): TLS. Your client started a TLS (https) handshake, and the server answered in plain text. Almost always https:// on a port that speaks plain HTTP, implicit TLS on a mail port that expects… - [sed: 1: "file": invalid command code](https://devopsinsights.in/problems/sed-invalid-command-code): sed. You ran sed -i in the GNU form on macOS, where sed is the BSD version and -i needs a backup suffix as its next argument. It used your s/// command as that suffix and then tried to run… - [jq: parse error: Invalid numeric literal](https://devopsinsights.in/problems/jq-parse-error-invalid-numeric-literal): jq. jq was given something that is not JSON, usually an HTML error page or a plain-text message from an API that failed. The related Cannot iterate over null means the JSON was valid but… - [Text file busy](https://devopsinsights.in/problems/linux-text-file-busy): Linux. Something tried to write into a program file while that program is running, and Linux refuses to change a running executable in place. Usually a deploy that copies a new binary over… - [Argument list too long](https://devopsinsights.in/problems/linux-argument-list-too-long): Linux. A shell glob such as rm *.log expanded to more file names than the system lets one command receive. The command never started; split the work with find or xargs instead. - [Error: Reference to undeclared input variable](https://devopsinsights.in/problems/terraform-reference-to-undeclared-input-variable): Terraform. The configuration reads var.NAME, but the module it is in has no variable block with that name. Usually a typo, or a child module using a variable only the root module declares. - [error: cannot rebase: You have unstaged changes](https://devopsinsights.in/problems/git-cannot-rebase-unstaged-changes): Git. git rebase or git pull --rebase found uncommitted changes to tracked files and stopped before changing anything. Commit them, stash them, or rebase with --autostash. - [error: The following untracked working tree files would be overwritten by checkout](https://devopsinsights.in/problems/git-untracked-files-would-be-overwritten): Git. A file you have locally but never committed exists, tracked, in the branch or commits you are switching to or pulling. Git stops rather than replace it, even when the contents are… - [Git tag already exists (rejected, would clobber existing tag)](https://devopsinsights.in/problems/git-tag-already-exists): Git. A tag with that name already points at a different commit, and Git does not move tags unless you force it. Creating, pushing and fetching a moved tag all stop with a variant of this… - [Error: YAML parse error on a Helm chart template](https://devopsinsights.in/problems/helm-yaml-parse-error): Helm. A Helm template rendered text that is not valid YAML, usually because of toYaml indentation or an unquoted value. The line number counts rendered lines, not template lines, so render… - [nil pointer evaluating interface {} in a Helm template](https://devopsinsights.in/problems/helm-nil-pointer-evaluating-interface): Helm. The template reads a nested value such as .Values.database.host, and the parent, database, is not set. Give the parent a default, guard it with with, or make it required. - [Error: Invalid index](https://devopsinsights.in/problems/terraform-invalid-index): Terraform. An expression asked for list item N, a map key, or resource [0], and that element does not exist. Usually a list shorter than expected, a missing map key, or a resource whose… - [Error: Cycle](https://devopsinsights.in/problems/terraform-cycle): Terraform. Two or more things in the configuration each need the other to exist first, so Terraform cannot order them. The error lists every object in the loop; break one link in it. - [Error: Module not installed](https://devopsinsights.in/problems/terraform-module-not-installed): Terraform. Terraform found a module block it has not downloaded or linked yet, or one whose source changed since terraform init last ran. Run terraform init again in that directory. - [SSL_CTX_use_PrivateKey failed: key values mismatch](https://devopsinsights.in/problems/nginx-ssl-key-values-mismatch): nginx. The private key nginx loaded does not belong to the certificate it loaded first. Usually the wrong key file, a key from before a renewal, or a chain file with the certificates in the… - [unbound variable](https://devopsinsights.in/problems/bash-unbound-variable): Bash. The script runs with set -u (often as set -euo pipefail) and read a variable or argument that was never set, so bash stopped. Set it, give it a default, or fail with a clear message. - [Bad substitution](https://devopsinsights.in/problems/sh-bad-substitution): Linux shell. A bash-only expansion such as ${VAR^^}, ${VAR:0:3} or an array ran under /bin/sh, which on Debian and Ubuntu is dash. Run it with bash, or use a POSIX form. - [\[: too many arguments](https://devopsinsights.in/problems/bash-test-too-many-arguments): Bash. A [ ] test received a different number of words than it expects, almost always because a variable was not quoted and was empty or contained spaces. The test fails, and the script… - [syntax error near unexpected token](https://devopsinsights.in/problems/bash-syntax-error-near-unexpected-token): Bash. Bash could not parse the script, so none of it ran, and the token it names is where parsing broke. A token of $'\r' means Windows line endings, ( means unquoted parentheses, and fi or… - [set: Illegal option -o pipefail](https://devopsinsights.in/problems/dash-illegal-option-pipefail): Linux shell. A script written for bash ran under /bin/sh, which on Debian and Ubuntu is dash. That shell rejects pipefail, source, [[ ]], arrays and the function keyword, and two of those… - [/usr/bin/env: 'python': No such file or directory](https://devopsinsights.in/problems/env-python-no-such-file-or-directory): Linux. A script's first line asks for python, and this system only has python3. Current Ubuntu and Debian do not install a python command. Point the script at python3, or install the… - [curl: (6) Could not resolve host](https://devopsinsights.in/problems/curl-6-could-not-resolve-host): curl. curl could not turn the host name into an IP address, so it never connected. Either the name is wrong, or DNS is not working from where curl runs, such as inside a container or a CI… - [curl: (7) Failed to connect](https://devopsinsights.in/problems/curl-7-failed-to-connect): curl. curl found the host's address but nothing accepted the connection on that port. Usually the service is not running yet, listens on another port or address, or a firewall refuses it. - [curl: (28) Operation timed out](https://devopsinsights.in/problems/curl-28-operation-timed-out): curl. curl gave up waiting, and the wording of the message says where it was stuck. Failed to connect … Timeout was reached means the connection never opened; Operation timed out … bytes… - [curl: (22) The requested URL returned error](https://devopsinsights.in/problems/curl-22-requested-url-returned-error): curl. The server answered with an HTTP error (400 or above) and curl was run with -f or --fail, so it exited 22 instead of saving the error page. The number after error: is the HTTP status… ## Comparisons — two things that get mistaken for one - [502 Bad Gateway vs 504 Gateway Timeout](https://devopsinsights.in/compare/502-vs-504): HTTP. A 502 means the attempt ended — refused, or the upstream closed the connection before its response header was complete. A 504 means the attempt never ended, and the proxy stopped… - [Symptom-based vs cause-based alerts](https://devopsinsights.in/compare/symptom-vs-cause-alerting): SRE. A symptom alert fires when users are affected. A cause alert fires when a thing you can measure looks unusual. The second set is far larger, because each symptom has many possible… - [EXPOSE vs -p / --publish](https://devopsinsights.in/compare/expose-vs-publish): Docker. EXPOSE is documentation. `-p` is what actually makes a port reachable through your machine's own addresses, such as `localhost`, and from other machines. Neither one changes what… - [ENTRYPOINT vs CMD](https://devopsinsights.in/compare/entrypoint-vs-cmd): Docker. ENTRYPOINT is the command that always runs. CMD is the default arguments, and anything you type after the image name replaces them. - [readinessProbe vs livenessProbe](https://devopsinsights.in/compare/readiness-vs-liveness): Kubernetes. Readiness controls whether traffic is sent to a pod. Liveness controls whether the container is restarted. Getting them the wrong way round is how a slow-starting application… - [Requests vs limits](https://devopsinsights.in/compare/requests-vs-limits): Kubernetes. Requests are what the scheduler reserves for you. Limits are the ceiling the kernel enforces. For memory, the limit is a hard ceiling: a container the kernel cannot reclaim back… - [SLO vs SLA](https://devopsinsights.in/compare/slo-vs-sla): SRE. An SLI is what you measure. An SLO is the target you hold yourself to. An SLA is a contract with consequences if you miss it — and Google's SRE book advises promising less in it than… - [Image vs container](https://devopsinsights.in/compare/image-vs-container): Docker. An image is a read-only template. A container is a running instance of one, with a writable layer on top that disappears when the container is removed. - [Security group vs Network ACL](https://devopsinsights.in/compare/security-group-vs-nacl): AWS. A security group is stateful, so a reply to allowed traffic is allowed automatically. A network ACL is stateless, so the reply needs its own rule — and the rule that is easy to miss is… - [Ingress vs Gateway API](https://devopsinsights.in/compare/ingress-vs-gateway-api): Kubernetes. Ingress is not deprecated. The Kubernetes documentation calls it frozen, which means it stays generally available with no plans for removal but will never gain another feature… - [ConfigMap vs Secret](https://devopsinsights.in/compare/configmap-vs-secret): Kubernetes. A Secret is not encrypted by default. Kubernetes stores Secrets unencrypted in etcd unless encryption at rest is turned on, and base64 is only the format the data field has to… - [Docker volume vs bind mount](https://devopsinsights.in/compare/docker-volume-vs-bind-mount): Docker. A volume is storage Docker creates and manages; a bind mount is a directory you already have on the host. The difference that breaks things: mounting an empty volume over a path… - [Deployment vs StatefulSet](https://devopsinsights.in/compare/deployment-vs-statefulset): Kubernetes. Use a Deployment when any replica can stand in for any other, and a StatefulSet when each replica needs to keep its own name, its own storage, and its place in a start-up order… - [401 Unauthorized vs 403 Forbidden](https://devopsinsights.in/compare/401-vs-403): HTTP. 401 means the server does not have valid credentials from you — none were sent, or the ones sent were not accepted — and it must say how to authenticate. 403 means the server… - [count vs for_each](https://devopsinsights.in/compare/terraform-count-vs-for-each): Terraform. count names each instance by its position in a list; for_each names it by a key. Remove an item from the front or middle of a list driven by count and every instance after it… - [Docker image tag vs digest](https://devopsinsights.in/compare/docker-image-tag-vs-digest): Docker. A tag is a name the publisher can move to a different image at any time; a digest is a hash of the image's content, so it can only ever mean that one image. Deploy by tag and two… - [Git merge vs rebase](https://devopsinsights.in/compare/git-merge-vs-rebase): Git. Both bring your branch up to date with another one. Merge adds a commit with two parents and leaves every existing commit as it was. Rebase replays your commits on top of the other… - [Git reset vs revert](https://devopsinsights.in/compare/git-reset-vs-revert): Git. Reset moves your branch back to an earlier commit, so the commits after it stop being part of the branch. Revert keeps every commit and adds a new one that undoes the changes. On… - [Free memory vs available memory](https://devopsinsights.in/compare/linux-free-vs-available-memory): Linux. `free` is memory nothing is using at all; `available` is the kernel's estimate of how much a new program could get without swapping, which counts the page cache it can give back. On… ## Tools — calculators and converters, browser-only - [Kubernetes Manifest Analyzer](https://devopsinsights.in/tools/kubernetes-yaml): Paste a manifest. Removed API versions and newer changes (gitRepo, externalIPs, Ingress NGINX), privileged containers, missing limits, absent probes, plaintext secrets — each linked to the… - [Kubernetes Resource Calculator](https://devopsinsights.in/tools/resource-calculator): Requests and limits from observed usage, with the reasoning. - [Dockerfile Analyzer](https://devopsinsights.in/tools/dockerfile): Secrets baked into layers, root execution, unpinned bases, install scripts. Points at the line. - [docker run to Compose Converter](https://devopsinsights.in/tools/docker-run-to-compose): A docker run command as a Compose service, with every flag it could not convert listed. - [HTTP Status Code Explainer](https://devopsinsights.in/tools/http-status): What a status code means, and whether your app or the proxy in front of it sent it. - [Container Exit Code Explainer](https://devopsinsights.in/tools/exit-codes): What 137, 143 and 139 mean, and the rule behind them. - [Retry and Backoff Calculator](https://devopsinsights.in/tools/retry-backoff): The total time a retry schedule consumes, which is the number every timeout above it has to clear. - [systemd Service Unit Generator](https://devopsinsights.in/tools/systemd-unit): A service unit with its own user, restarts and sandboxing, and the commands to check it. - [GitHub Actions OIDC Trust Policy Checker](https://devopsinsights.in/tools/github-oidc-trust): Which condition in an AWS role's trust policy rejects your GitHub Actions job, and why. - [Error Budget Calculator](https://devopsinsights.in/tools/error-budget): What an availability target allows, and the burn rate. - [Availability Calculator](https://devopsinsights.in/tools/availability): Whole-system availability from parts in series and redundant groups, with the working shown. - [On-Call Load Assessment](https://devopsinsights.in/tools/oncall-load): Your paging numbers against published thresholds — Google SRE's 2 per shift, the 30–50% actionable band, DORA recovery tiers. - [CIDR Calculator](https://devopsinsights.in/tools/cidr-calculator): Network address, usable range and host count for an IPv4 block — including the /31 and /32 cases where subtracting two is wrong. - [Cron Expression Explainer](https://devopsinsights.in/tools/cron): Reads a five-field schedule in plain language and shows its next runs, with a warning about the day-of-month and day-of-week union rule. - [YAML and JSON Validator](https://devopsinsights.in/tools/yaml-json): Where the file breaks, in a sentence rather than "unexpected token" — with the line, the column, and conversion between the two formats. - [Cron Expression Builder](https://devopsinsights.in/tools/cron-builder): Describe when a job should run and get the expression, read back through the same engine that explains one. ## Guides — long-form, start to production - [Docker](https://devopsinsights.in/guides/docker): Images, containers, volumes and networking, from first run to a production-shaped setup. - [Docker Compose](https://devopsinsights.in/guides/docker-compose): Multi-container applications, service dependencies and environment handling. - [Docker Swarm](https://devopsinsights.in/guides/docker-swarm): Clustering, services and rolling updates with Docker's built-in orchestrator. - [DevOps deadlines, 2026 to 2029](https://devopsinsights.in/upgrades/deadlines): Upgrade notes. Certificate lifetimes, the EU Cyber Resilience Act, and end-of-life dates for Kubernetes, EKS, Node.js, Python, PostgreSQL and Linux, each with a check and its source. - [Helm 3 to Helm 4](https://devopsinsights.in/upgrades/helm-4): Upgrade notes. What Helm 4 changes by design, the open 4.2+ regressions that drop null values, and how to compare Helm 3 and 4 output before ubuntu-latest switches you. - [Migrating off Ingress NGINX](https://devopsinsights.in/upgrades/ingress-nginx): Upgrade notes. Ingress NGINX was retired in March 2026. The five behaviours that break after a move to Gateway API, how to find them before you migrate, and how to keep them in an HTTPRoute. - [Amazon EC2 explained](https://devopsinsights.in/aws/ec2): AWS guide. Instance types and names, connecting with SSH, Instance Connect or Session Manager, what stop, reboot, hibernate and terminate do to IPs and disks, IMDSv2, user data, and fixes… - [Amazon S3 explained](https://devopsinsights.in/aws/s3): AWS guide. Buckets, objects and keys in plain English, Block Public Access, bucket policies and disabled ACLs, presigned URLs, static websites, and an explorer that shows whether the… - [AWS IAM explained](https://devopsinsights.in/aws/iam): AWS guide. Users, groups, roles and policies in plain English, how AWS decides allow or deny, how to read an AccessDenied message, and an explorer that shows which policy blocks a request. - [Amazon VPC explained](https://devopsinsights.in/aws/vpc): AWS guide. What a VPC is in plain English, then subnets, route tables, internet and NAT gateways, security groups and a private database, with an interactive diagram and troubleshooting. - [Kubernetes upgrades, 1.34 to 1.37: what breaks](https://devopsinsights.in/upgrades/kubernetes): Upgrade notes. Each change from 1.34 to 1.37 that can stop a kubelet or fail a workload, with the message, a check to run before upgrading, and the official source. - [ubuntu-latest is moving to Ubuntu 26.04](https://devopsinsights.in/upgrades/github-actions-ubuntu-26-04): Upgrade notes. What changes when GitHub Actions moves ubuntu-latest to 26.04: Docker 29, Compose v5, Helm 4, Python 3.14, Java 25, CMake 4 and removed tools, with checks and how to pin. ## Topics — subject hubs collecting the guides, problems, comparisons and articles for each area - [Containers & Docker](https://devopsinsights.in/topics/containers): Containers - [Kubernetes](https://devopsinsights.in/topics/kubernetes): Kubernetes - [CI/CD & Delivery](https://devopsinsights.in/topics/ci-cd): CI/CD - [Infrastructure as Code](https://devopsinsights.in/topics/infrastructure-as-code): IaC - [Observability & Monitoring](https://devopsinsights.in/topics/observability): Observability - [Linux & Networking](https://devopsinsights.in/topics/linux-and-networking): Linux ## Articles - [Terraform Identity Errors After a Provider Upgrade](https://devopsinsights.in/blog/terraform-resource-identity-errors): Missing Resource Identity After Read and Unexpected Identity Change usually start right after a provider upgrade. Why they are provider bugs, and the upgrade-or-pin fix that clears them. - [OOMKilled and Exit Code 137: Limit, Leak or Spike?](https://devopsinsights.in/blog/oomkilled-exit-code-137-limit-or-leak): OOMKilled means the kernel killed a Kubernetes container for using too much memory. How to tell a low limit from a leak or a one-off spike before you raise anything. - [docker push Failing Since Docker 29.7? Two Causes](https://devopsinsights.in/blog/docker-push-fails-after-29-7): Since Docker 29.7, docker push can fail with blob unknown to registry on GitLab or with timeout awaiting response headers on slow registries. How to tell which one you have, and what fixes… - [CrashLoopBackOff: Find the Cause in Three Commands](https://devopsinsights.in/blog/kubernetes-crashloopbackoff-read-the-last-crash): CrashLoopBackOff means a Kubernetes container keeps exiting and being restarted. Read the previous container's logs, its exit reason and the pod events, and the cause is usually on screen. - [Provider Produced Inconsistent Result After Apply, Explained](https://devopsinsights.in/blog/terraform-inconsistent-result-after-apply-explained): Provider produced inconsistent result after apply means the API rewrote a value you sent. How to read the was and but now values, fix the configuration, and avoid the tainted resource it… - [Ubuntu 26.04 Puts /tmp in RAM: Big CI Builds Run Out](https://devopsinsights.in/blog/ubuntu-26-04-tmp-ram-disk-ci): Ubuntu 26.04 mounts /tmp as a RAM disk with a per-user quota, so large builds fail with disk quota exceeded on the ubuntu-26.04 runner. How to check your job and the two-line fix. - [pip Says externally-managed-environment: What to Do](https://devopsinsights.in/blog/pip-install-externally-managed-environment): Why pip install now fails with externally-managed-environment on Ubuntu 24.04, Debian 12 and Homebrew, and the three fixes that work: a venv, pipx, or apt. Plus why it passes in GitHub… - [Leaving Ingress NGINX? Five Things That Will Quietly Return 404](https://devopsinsights.in/blog/leaving-ingress-nginx-five-404s): Ingress NGINX was retired in March 2026, and moving the same rules to Gateway API can break routes that worked for years. Five behaviours from the Kubernetes project's own write-up, in… - [Why Your GitHub Actions Cron Runs Late, or Not at All](https://devopsinsights.in/blog/github-actions-schedule-late-or-missing): Why a GitHub Actions scheduled workflow runs late or not at all: at most every five minutes, delays at busy times, default branch only, and UTC by default. Plus the 60-day switch-off in… - [Your S3 Bucket Is Not Public. That Is the Feature](https://devopsinsights.in/blog/s3-bucket-not-public-block-public-access): You added a public bucket policy and still get 403. Block Public Access has four switches at two levels, two of which only refuse new grants. How they combine, why encryption can block the… - [Stop, Start, Surprise: What Your EC2 Instance Forgets](https://devopsinsights.in/blog/ec2-stop-start-what-changes): What rebooting, stopping, hibernating and terminating an EC2 instance each keep and lose, from AWS's own comparison. Four actions that sound similar and are not, including the public IP… - [AWS Said Access Denied. Here Is How to Find the Policy That Did It](https://devopsinsights.in/blog/aws-access-denied-which-policy): When AWS says AccessDenied, the error names only one of the several policy types it checks in a fixed order: how to find the policy that actually said no. The two phrases that tell you… - [Flaky Tests: Fix, Quarantine, or Delete](https://devopsinsights.in/blog/flaky-tests-fix-quarantine-delete): The question is not how to eliminate flakiness. It is what to do with each flaky test — and there are exactly three answers, one of which people resist and should not. - [SBOMs: What They Answer, and What They Do Not](https://devopsinsights.in/blog/sbom-what-it-is-for): Most teams generate an SBOM and never read one. The single question it answers well, the four things it does not, and the difference between a compliance artifact and an operational one. - [Giving an AI Agent Production Access](https://devopsinsights.in/blog/ai-agent-production-access): Autonomy is not one decision. The four levels, the three properties that make an action safe to automate, and why the guardrail cannot live in the prompt. - [Reading a Kubernetes YAML You Did Not Write](https://devopsinsights.in/blog/reading-kubernetes-yaml-you-did-not-write): How to get oriented in a Kubernetes YAML file you did not write: four hundred lines, in production, by somebody who left. An order that works, and why the file may not be what is running. - [From DevOps to DevSecOps: Turning 312 Findings Into Four](https://devopsinsights.in/blog/devops-to-devsecops): Security scanners produce findings, and findings are not work until somebody can act on them: how a DevSecOps team turns 312 of them into four. The triage, the gate decision, and why false… - [Platform Engineering: Why Developers Route Around Your Platform](https://devopsinsights.in/blog/devops-to-platform-engineering): What actually changes moving from DevOps to platform engineering: your work stops being mandatory and starts being optional, and every design decision is now a negotiation with somebody's… - [Why Your Kubernetes Cluster Is Full at 10% Utilisation](https://devopsinsights.in/blog/kubernetes-cluster-full-but-idle): Why a Kubernetes cluster is full at 10% utilisation: the scheduler commits against requests, not usage, and that gap is where most overspend lives. Your dashboards and the scheduler are… - [From DevOps to MLOps and AIOps: What Actually Changes](https://devopsinsights.in/blog/devops-to-mlops-aiops-transition): MLOps and AIOps sound alike and are different jobs. What transfers from DevOps, the one assumption that breaks, and the failure modes worth learning before you need them — with examples. - [Your First Week On Call: An SRE Incident Response Guide](https://devopsinsights.in/blog/incident-response-on-call-sre-guide): What to actually do, in order, when a page arrives at 2am for a service you did not write — establishing whether it is real, what changed, and when to escalate. - [Helm Charts: Packaging Kubernetes Applications](https://devopsinsights.in/blog/helm-charts-packaging-kubernetes-applications): Master Helm charts for Kubernetes — chart structure, values, templates, repositories, environment management, and deployment best practices. - [Shell Scripting for DevOps: Essential Bash Automation](https://devopsinsights.in/blog/shell-scripting-devops-bash-automation): Learn essential Bash scripting for DevOps — variables, conditionals, loops, functions, error handling, cron jobs, and practical one-liners. - [AWS EC2 and VPC: Building Your First Cloud Infrastructure](https://devopsinsights.in/blog/aws-ec2-vpc-cloud-infrastructure): Step-by-step guide to building your first AWS infrastructure — VPCs, subnets, security groups, EC2 instances, and networking fundamentals. - [Securing Docker Containers, in Order of What It Buys You](https://devopsinsights.in/blog/securing-docker-containers-production-checklist): The same ten-item checklist, ordered by the threat each item actually closes — and honest about which three matter most and what none of them protect you from. - [Ansible for DevOps: Automating Server Configuration](https://devopsinsights.in/blog/ansible-devops-server-configuration): Get started with Ansible for server automation — inventory, playbooks, roles, common modules, and best practices for DevOps workflows. - [Understanding Kubernetes Networking: Services, Ingress, and DNS](https://devopsinsights.in/blog/kubernetes-networking-services-ingress-dns): Deep dive into Kubernetes networking — ClusterIP, NodePort, LoadBalancer, Ingress controllers, CoreDNS, and Network Policies explained with examples. - [GitOps: The Modern Way to Manage Kubernetes Deployments](https://devopsinsights.in/blog/gitops-manage-kubernetes-deployments): Learn GitOps principles and implement them with ArgoCD — automated Kubernetes deployments driven by Git pull requests. - [Nginx as a Reverse Proxy: The Config, and What Breaks](https://devopsinsights.in/blog/nginx-reverse-proxy-configuration-guide): The six lines that proxy, the four headers most examples omit, and the three failures a reverse proxy actually produces — 502, 504 and the 499 nobody receives. - [Monitoring Your Infrastructure with Prometheus and Grafana](https://devopsinsights.in/blog/monitoring-prometheus-grafana): Set up a production-grade monitoring stack with Prometheus and Grafana — metrics collection, PromQL queries, alerting, and dashboards. - [Linux Commands Every DevOps Engineer Must Know](https://devopsinsights.in/blog/linux-commands-devops-engineers): A practical reference of essential Linux commands for DevOps — file operations, text processing, networking, process management, and more. - [Infrastructure as Code with Terraform: State, Modules and CI](https://devopsinsights.in/blog/infrastructure-as-code-terraform): Learn Infrastructure as Code with Terraform — from your first resource to production-ready modules, state management, and CI integration. - [Setting Up a CI/CD Pipeline with GitHub Actions](https://devopsinsights.in/blog/ci-cd-pipeline-github-actions): Build a complete CI/CD pipeline with GitHub Actions — from running tests on every PR to automated production deployments. - [Kubernetes 101: The One Idea, Then the Nouns](https://devopsinsights.in/blog/kubernetes-101-pods-services-deployments): Kubernetes explained through the control loop under Pods, Deployments and Services, so you can predict what the cluster will do, not just name its parts. Most introductions stop at the… ## Questions and answers - [Terraform vs Ansible — when to use which?](https://devopsinsights.in/forum/terraform-vs-ansible-when-to-use-which-bh3l) - [What is GitOps and should I use it?](https://devopsinsights.in/forum/what-is-gitops-and-should-i-use-it-cxkc) - [How to monitor Docker containers with Prometheus?](https://devopsinsights.in/forum/how-to-monitor-docker-containers-with-prometheus-x9h0) - [Kubernetes vs Docker Swarm for production?](https://devopsinsights.in/forum/kubernetes-vs-docker-swarm-for-production-mlpq) - [Best CI/CD tool for small teams in 2026?](https://devopsinsights.in/forum/best-cicd-tool-for-small-teams-in-2026-lvai) - [How to install Docker on Ubuntu 22.04?](https://devopsinsights.in/forum/how-to-install-docker-on-ubuntu-2204-yin3) ## Optional - [Insufficient Flow Control Mechanisms](https://devopsinsights.in/security/cicd/insufficient-flow-control): Code or artifacts can travel from a developer's keyboard to production without anything standing in the way. - [Inadequate Identity and Access Management](https://devopsinsights.in/security/cicd/inadequate-identity-and-access-management): The pipeline accumulates identities — human, machine, and inherited — that nobody has counted, scoped or retired. - [Dependency Chain Abuse](https://devopsinsights.in/security/cicd/dependency-chain-abuse): The build fetches code from the internet and runs it, and an attacker only has to get their package into that set. - [Poisoned Pipeline Execution (PPE)](https://devopsinsights.in/security/cicd/poisoned-pipeline-execution): An attacker who can influence what the pipeline runs gets to run code with the pipeline's privileges, without ever touching production. - [Insufficient Pipeline-Based Access Controls](https://devopsinsights.in/security/cicd/insufficient-pbac): A pipeline step runs with far more access than its job requires, so any code that reaches it inherits the surplus. - [Insufficient Credential Hygiene](https://devopsinsights.in/security/cicd/insufficient-credential-hygiene): Secrets end up somewhere they were never meant to persist — a commit, a log line, an image layer, an environment dump. - [Insecure System Configuration](https://devopsinsights.in/security/cicd/insecure-system-configuration): The systems that run the pipeline are themselves unpatched, over-permissioned or exposed. - [Ungoverned Usage of Third-Party Services](https://devopsinsights.in/security/cicd/ungoverned-third-party-services): Third-party integrations accumulate broad, permanent access to source and pipelines, and nobody re-reviews them. - [Improper Artifact Integrity Validation](https://devopsinsights.in/security/cicd/improper-artifact-integrity-validation): Nothing checks that the artifact reaching production is the one that was built from the reviewed source. - [Insufficient Logging and Visibility](https://devopsinsights.in/security/cicd/insufficient-logging): When something does go wrong in the pipeline, there is not enough evidence to work out what happened. - [What happens if a Pod is deleted while it is serving traffic?](https://devopsinsights.in/scenarios/a-pod-is-deleted): Kubernetes. Two things start at once and neither waits for the other: the pod begins shutting down, and its address begins being removed from Services. Requests that arrive in the gap… - [What happens if a container exceeds its memory limit?](https://devopsinsights.in/scenarios/a-container-exceeds-its-memory-limit): Kubernetes. Once the kernel cannot reclaim enough memory to stay under the limit, it kills processes in the container, and the container ends when its main process dies. There is no… - [What happens if a Kubernetes node suddenly disappears?](https://devopsinsights.in/scenarios/a-node-suddenly-disappears): Kubernetes. More slowly than people expect. The control plane cannot distinguish a dead node from an unreachable one, so it waits: about 50 seconds (40 before Kubernetes 1.32) before the… - [What happens if DNS stops resolving inside the cluster?](https://devopsinsights.in/scenarios/dns-stops-resolving): Kubernetes. Almost everything breaks, in a way that looks like several unrelated failures at once — because service discovery is a dependency of nearly every call, and DNS caching means it… - [What happens if a deployment reports success but users still see errors?](https://devopsinsights.in/scenarios/a-deploy-reports-success-but-users-see-errors): Kubernetes. It means every check that ran was satisfied — and none of them checked the thing that is broken. A successful rollout proves that pods started and passed their probes, which is… - [Why does Terraform need a state file at all?](https://devopsinsights.in/why/terraform-needs-state): Terraform. Because your configuration says what should exist, and the cloud says what does exist, and neither tells you which real resource corresponds to which block of code. State is that… - [Why are Pods ephemeral?](https://devopsinsights.in/why/pods-are-ephemeral): Kubernetes. Because a system that can replace a workload cannot also promise it will persist. Ephemerality is not a limitation Kubernetes imposes — it is the price of automatic recovery… - [Why does Kubernetes use desired state instead of commands?](https://devopsinsights.in/why/kubernetes-uses-desired-state): Kubernetes. Because over an unreliable network you cannot know whether a command arrived. Declaring the intended end state makes that uncertainty harmless — the same declaration can be… - [Why are containers not just lightweight virtual machines?](https://devopsinsights.in/why/containers-are-not-virtual-machines): Docker. Because they share the host's kernel. A VM virtualises hardware and runs its own kernel; a container is an ordinary process with a restricted view of the same kernel everything else… - [Why can't you just remove a secret from Git after committing it?](https://devopsinsights.in/why/secrets-do-not-belong-in-git): CI/CD. Because git is built to remember. A commit is content-addressed and immutable, so deleting the file adds a new commit that removes it — while the original stays reachable, in your… - [Why do CI/CD systems insist on immutable artifacts?](https://devopsinsights.in/why/artifacts-should-be-immutable): CI/CD. So that testing something means anything. If the artifact can change between the test and the deploy, then passing tests tells you about a thing that no longer exists. - [Glossary](https://devopsinsights.in/glossary): Definitions for the vocabulary used across the site. - [All problems](https://devopsinsights.in/problems): Index of every error state covered, grouped by platform. - [RSS feed](https://devopsinsights.in/rss.xml): Articles only, newest first. - [Sitemap](https://devopsinsights.in/sitemap.xml): Every indexable URL, including pages not listed above. - [About](https://devopsinsights.in/about): Who maintains this and how the content is sourced. - [How pages are made](https://devopsinsights.in/editorial): AI-drafted and reviewed; what 'Reproduced' means; corrections; the forum's AI policy. - [Privacy](https://devopsinsights.in/privacy): What is collected, which is very little, and the one third party involved.