all posts
blog · topic

CI and ephemeral environments

A CI job or preview environment that starts clean and is destroyed afterwards cannot leak state into the next run. These posts cover ephemeral runners for untrusted pull requests, per-PR previews with their own database, and test isolation in microVMs.

Ephemeral CI runners on PandaStack

59 posts

·9 min read

Snapshot the Failure, Not the Log Line

The expensive part of an intermittent bug is not the analysis. It is getting back to the failing state. A log line is a guess someone made in advance about what would matter; a memory snapshot is the state itself.

debuggingflaky-testssnapshots
Ajay Kumar
·9 min read

Mobile CI in MicroVMs: What Runs and What Cannot

Mobile CI is not one workload. About ninety per cent of it is a JVM build that a microVM suits perfectly, and the rest needs hardware you cannot get from a Firecracker guest. Knowing which stage is which saves you a fortnight.

mobile-ciandroidgradle
Ajay Kumar
·11 min read

CircleCI Self-Hosted Runners on MicroVMs

The moment you move a CircleCI job onto your own machine runner, you quietly trade a fresh VM per job for a box that remembers every build that ever ran on it. That trade is the whole security story, and you do not have to make it.

circlecici-cdmicrovm
Ajay Kumar
·11 min read

Tekton Steps, MicroVM Bodies: Isolating Untrusted Tasks

A TaskRun is a Pod. That is Tekton's best feature and its sharpest constraint — because everything inside a Pod is inside one trust boundary, including the step running a stranger's build script.

tektonkubernetesci-cd
Ajay Kumar
·11 min read

Cross-Compilation Build Farms: One MicroVM Per Target

One binary becomes a matrix the moment somebody asks for arm64. Emulation lies about the parts you care about, cross-compiling breaks on the sysroot — here is the third answer.

cross-compilationbuild-systemsmicrovm
Ajay Kumar
·13 min read

Ephemeral Databases for AI Agents

Give an agent a run_sql tool and it will use it — including the DELETE it emits while debugging its own step. The fix isn't a better statement filter; it's a database that exists for one task and is deleted when the task ends.

ai-agentsdatabasepostgres
Ajay Kumar
·11 min read

Buildkite Agents on MicroVMs: One Job, One Machine

Buildkite's whole premise is that you supply the compute. That makes 'what do agents run on?' a product decision, not a detail — and containers answer it badly for CI.

buildkiteci-cdmicrovm
Ajay Kumar
·11 min read

Running Nix Builds Inside a Disposable VM

Nix's sandbox is a hermeticity fence, not a hypervisor — a hostile derivation still runs on your kernel. Here's how to put Nix inside a disposable VM without a cold /nix/store making every build miserable.

nixreproducible-buildsci-cd
Ajay Kumar
·10 min read

Building Container Images for Untrusted Repos Without Privileged Docker

Every RUN line in a user's Dockerfile is a shell command on your builder, as root, at build time. The build is the untrusted workload — not the thing you build.

dockerbuildkitkaniko
Ajay Kumar

More posts in this topic