Wix runs about 2.5% of the websites out there. When a site owner writes backend code, it runs on the Kubernetes platform I keep alive, one site per gVisor sandbox. Untrusted code finds every crack. Dublin.
When a pod hangs and it isn't our bug, I go find whose it is.
Once, containerd nodes said Ready while no new pod could start. A snapshotter had hung, and snapshot GC waited on it forever. I bounded the GC. It got merged. Then it got reverted, because the maintainers wanted it fixed on the client side. Fair. So I put the deadline there, and that one stuck.
Most hunts end like that: a fix upstream and a write-up of how I found it.
Other cracks, fixed upstream
- gVisor: a wedged sandbox kept the shim lock forever → 30s deadlines on Kill, Stats, Status
- gVisor: a missed systrap interrupt blocked teardown → only the stuck subprocess dies
- gVisor: a random memory gap put the spinning queue on a thread stack → the queue moves with the gap
- gVisor: the last indefinite waits → in review
- SOCI: fd leak on pod-start bursts → close the Verify reader
- metrics-server: one slow scrape drops the whole node from
kubectl top→ open - Security Profiles Operator: AppArmorProfile owners in node status. The first one, 2023.
My Claude Code mod. It draws replies in color right in the terminal: tables, code with copy buttons, mermaid diagrams and charts, 15 themes.
It started because I'd built a whole VS Code wrapper just to see mermaid diagrams in Claude Code replies. A mod turned out to be the better way.