Risorse tecniche
Engineering, explained — with real code
Short, practical guides on the tools I work with every day. Ready to copy.
Codice utile, quattro linguaggi
The same building block — a retry with exponential backoff and jitter — in the languages I use most. A call fails? It waits a little longer each time, with a pinch of randomness.
Docker
A container packages the app with everything it needs. The multi-stage build compila in un’immagine grande e spedisce solo il binario in una minima e sicura (distroless, non-root).
Infrastructure as Code (IaC)
Describing infrastructure in declarative, versioned files instead of clicking in a console.
- Riproducibile: lo stesso file ricostruisce un ambiente identico, ovunque.
- Versionata: every change is a pull request, with history and rollback.
- Strumenti: Terraform / OpenTofu, Pulumi — dichiarativi e idempotenti.
Kubernetes
You declare the desired state and Kubernetes works to make reality match: it restarts crashed pods, reschedules them, scales on demand. Here a web API in 3 replicas exposed by a Service.
And to scale automatically under load:
Istio — i due piani dati
A service mesh adds mTLS, traffic control and observability between services, without touching their code. Today it comes in two variants.
1 · Sidecar: an Envoy proxy next to every pod. Full L7, mature — but one proxy per pod.
2 · Ambient: niente sidecar; uno ztunnel per nodo (L4 + mTLS) e un waypoint opzionale per L7. Più leggero.
Traffic control is identical — here a 90/10 canary release:
CI/CD
Every push is built, tested and — if green — released automatically. No more “works on my machine”, no more Friday-night manual deploys.
DevSecOps
Security shifts a sinistra: the checks live inside the pipeline and block the build when something is wrong.
- SAST on the code, scanning of dipendenze, immagini e IaC.
- SBOM + firma dell’immagine (cosign): sai cosa gira, ed è tuo.
Sicurezza
La sicurezza non è una funzione da aggiungere — sono le impostazioni di default: zero-trust, privilegio minimo, cifratura ovunque (mTLS), segreti che non toccano mai il repository.
Observability
Monitoring tells you what qualcosa si è rotto; l’osservabilità ti fa capire why. Tre pilastri — metriche, log, tracce — idealmente via OpenTelemetry.
And you alert on the symptoms the user feels, not on every CPU spike:
RAG & LLM
An LLM is brilliant but doesn’t know your data. RAG retrieves the relevant pieces from your knowledge base and passes them to the model: grounded, citable answers, not hallucinations.
🔎 Provalo dal vivo: a real embedding model runs in your browser and finds, among my services, the ones most relevant to your question. It is the “retrieve” step of RAG.