Sugau Blog
Articles on cloud repatriation, bare metal storage, infrastructure security, and sovereign AI — by the engineer who builds it.
The Australian build, priced from the iron up: roughly US$320M best case to US$1.8B worst, then a US$110–460M annual run-rate forever. The binding constraint isn’t GPUs — it’s the few hundred people who can run the pipeline, and the will to pull the expats home.
Read articleISO 27001, SOC 2, GDPR compliance, penetration test reports — none of it answers the question that matters. Every CISO who signed a US cloud contract after June 2013 made a conscious choice. This is the record that they were told.
Read articleOpenShift promises enterprise Kubernetes. What it delivers is a Ferrari with a mandatory chauffeur — IBM controls the keys, the route, and the bill. What CTOs need to know before they sign.
Read articleA data centre physically located in Sydney doesn’t guarantee data sovereignty. Under the US CLOUD Act, American authorities can compel AWS to produce data held anywhere in the world — including AWS Sydney.
Read articleClaude Mythos autonomously discovered more than 10,000 critical zero-days in two months. Only 6% are patched. The coordinated disclosure window was designed for a different world — and the threat model has permanently changed.
Read articleThe patch window is still open. The attack surface can still be reduced. The architectural decision is still in front of most organisations. A practical three-step clock reset for the CTO who understood the diagnosis and is now asking what to actually do.
Read articleWhen an AWS data centre overheated in May 2026, Coinbase went down for seven hours — because the matching engine cannot failover and nobody had practised the runbook. Multi-AZ is a feature. DR is a discipline. The difference, and what to do Monday morning.
Read articleOn April 21, 2026, Andrew Morton announced he was stepping away from the Linux memory management subsystem he had maintained for 26 years. Almost no one responded. 17.9% of kernel CVEs, every Android phone and AWS instance — held together at its most critical layer by one individual.
Read articleYour security budget encodes a threat model built for a crime that no longer exists. The hacker in a hoodie is gone; what replaced him is a market — access brokers, ransomware franchises, escrow. You weren’t targeted. You were inventory.
Read articleFrom Ford’s GAZ plant in 1930 to 36 OneWeb satellites seized on a Baikonur launchpad in 2022, Russia’s technology acquisition doctrine spans a century. The blueprints are now in Chinese aerospace databases.
Read articleA repeatable framework for evaluating any open source project before committing it to production — governance, license history, community health, security posture, and acquisition risk. The checklist that tells you whether to adopt with confidence or plan the exit first.
Read articleOn March 31, 2026, North Korean operatives poisoned Axios on npm — 100 million weekly downloads, present in 80% of cloud environments. The attack lasted three hours. Every CI pipeline that ran npm install got a backdoor. Here is how it worked and how to stop it.
A company spending $30,000+ a month on AWS paid off their bare-metal hardware in eight months. Five architectural consequences of owning the stack — and why no hyperscaler can match them.
Read articleThe number you get in load testing is the number you get in production. Why Go delivers that guarantee under autoscaling — and the two runtime settings (GOMAXPROCS, GOMEMLIMIT) that make or break it inside a container.
$30,000 a month on AWS became $6,000 a month in a Tier 5 colocation facility — with ten times the capacity headroom. The three hidden costs of cloud, and the real numbers from a gaming company that left.
Read articleThe DevOps market confuses deployment operators for platform engineers. The xz-utils backdoor shows exactly why that gap costs organisations more than a slow pipeline — and what a platform engineer’s answer actually looks like.
Read articleA two-year state-level operation came within days of silently backdooring SSH authentication on half the internet. It was caught by one engineer’s curiosity on one afternoon. Here are the six failure points and the architecture that blocks each one.
Read articleMicrosoft embedded Claude into its Security Development Lifecycle instead of its own Copilot. That is not a partnership announcement. It is a verdict — and it tells you which AI to trust for security-critical deployments.
Read articleSolarWinds inserted 3,500 lines of inspectable code. A compromised AI model hides in a trillion parameters. We have no equivalent of a diff, no SBOM, and no pipeline integrity monitor — and the capability trap makes it more dangerous, not less.
Read articleRunning Kimi K2.6 on sovereign infrastructure is not air-gapped security. The air-gap protects you from network exfiltration. It does not protect you from computation that manipulates outputs from inside the perimeter. Model provenance is the question nobody is asking.
Read article80% of breaches in 2025 came from known risks. The definition of “known risks” just quietly expanded — AI coding assistants, MCP servers, agentic frameworks, and Terraform state files storing API keys in plain text.
Read articleCohere committed $20 billion to European sovereign AI infrastructure the same week France announced 2.5 million government workstations moving to Linux. Two stories nobody connected — and what they reveal about where the next decade of AI infrastructure is actually being decided.
Read articleFor classified, regulated, and sovereign environments, public AI APIs are architecturally disqualified — not just risky. The full stack that replaces them: vLLM, open-weight models, pgvector, Go agentic layer, and a RAG pipeline that never leaves your boundary.
Read articleThe most common objection to bare-metal is what happens when you need to scale faster than you can buy hardware. The answer is Cluster API, Karpenter, and a burst node pool that provisions in minutes and scales to zero when the pressure passes.
Read articleTwo anonymised case studies: a defence systems integrator whose air-gapped cluster is now also its sovereign AI platform, and a gaming company that cut its AWS bill by 81% and recovered hardware costs in eight months.
Read articleVanilla Kubernetes on cloud VMs is not a radical move. It removes the managed services toll booth between you and the Linux infrastructure the cloud already is — and makes self-hosting PostgreSQL, Redis, and Kafka straightforward and reversible.
Read articleRDS runs PostgreSQL on a VM very similar to yours and charges three to five times the underlying compute. The tax is not small — and it was designed that way. Managed services are the highest-margin products in the cloud portfolio.
Read articleWritten for the person who looks at the cloud bill every month, asks a question, receives an answer full of technical language, and walks away less certain. The managed services premium does not appear as a line item. Here is how to find it.
Read articlePostgreSQL 17 with CloudNativePG replaces your document store, work queue, full-text search engine, and vector database. A benchmark-backed case for consolidation — and an honest list of the workloads where Postgres loses and you should keep Redis, ClickHouse, or a graph database.
Read articleThe redundant capacity every production bare-metal cluster carries for HA is not waste — it is optionality. Run sandboxes, internal tools, experiments, and free tiers at near-zero marginal cost.
Read articleYour cloud provider’s IAM console has 1,200 possible permission actions. Your attack surface is not a misconfigured server. It’s the system itself.
Read articleFor regulated, classified, and sovereign environments, public AI APIs are not a security risk to be mitigated. They are architecturally disqualified.
Read articleTraditional air-gapped systems are absolute: no network in, no network out. The egress air gap model is a practical middle ground that is defensible and operational.
Read articleEBS is a network block device. Every IO your application makes travels across a network and comes back. That round trip is the spinner your users are watching.
Read articleFour NVMe drives in the right configuration do not just match EBS. They make EBS look like a budget option you are overpaying for.
Read articlePostgreSQL on EBS gp3 versus PostgreSQL on local NVMe RAID-10. The latency numbers, the throughput gap, and why PostgreSQL rewards fast local storage.
Read articleThe honest part. When bare-metal local storage is the clear engineering answer, and when cloud storage is still the right call.
Read articleA four-part series on storage. Not because it is a glamorous topic. Because it is costing you money every month and slowing your users down every day.
Read articleThe cloud industry’s defining security doctrine sounds like partnership. It functions like a liability waiver — and the breach logs prove it.
Read articleEvery LLM is a mathematical distillation of data. Every interaction your company sends to a third-party AI is a potential training signal — gifted, often for free.
Read articleThe breach is rarely the intrusion. The breach is the exfiltration. And exfiltration requires egress. Most organisations are running without enforced egress controls.
Read articlepip install Is an Act of Trust. Have You Thought About Who You’re Trusting?Open source runs the world. You inherited it from strangers on the internet, and you ship it to production every day. The mitigation is ownership, not paranoia.
Read article