Sandboxed isn't safe
A security review read "safely process untrusted media" and asked the harder question. A sandbox stops escape; it does not stop exhaustion.
Tags
5 pages
Performance
One cache key per lockfile filled my runner's disk
The documented cargo cache key gives every lockfile its own cache. On a self-hosted runner that fills the disk. Whose disk was the advice for?
My blog was shipping 1.2 MB banners
A post hit Hacker News and the analytics showed pages far heavier than a static site should be. The cover images were the payload.
The fastest job is the one you never run
Half my CI jobs ran for no reason on every merge request. Skipping them with rules:changes, and why that is trickier than the manual suggests.
Stop installing the same tools on every pipeline job
Nearly every CI job began by fetching and compiling the same tools. Baking them into one image instead, and what that saved per pipeline.
