Spot

Isolating other people’s code on a shared EKS hosting cluster — why gVisor over plain containers, Fargate or per-team nodes, why Cilium replaces the default VPC CNI while the cluster is still empty, how the node bootstrap installs a pinned and checksummed gVisor that fails closed, the missing gvisor-bin directory that broke the first apply, and the app domain and __Host- cookie that keep user apps away from the dashboard.

Moving CI off GitHub-hosted runners after the organization ran out of included minutes — one spot EC2 instance with no inbound access, runners registered with a one-hour token sent over SSM, the key pair and long polling behind every job, the tools the image had to add back, why public repositories stay out, and the weak points that lead to the next post.