DEV Community: Flora Brandão

Hosting unreachable web applications on Upsun 🔒

Flora Brandão — Fri, 09 Oct 2026 11:27:27 +0000

Exposing applications that should never answer requests from the open internet is a major security risk. Deciding how to lock down access without adding unnecessary architectural layers can be a real headache.

Here is how to manage unreachable applications on Upsun:

The problem: Certain internal applications must stay completely isolated from public internet requests.
The fix: Choose between two main strategies: setting up a public route with restricted access, or configuring no public route at all.
Why it matters: Understanding these route constraints helps you balance security layers effectively without over-complicating your setup.

Check out the full article to see how to pick the right isolation strategy for your stack:

How to host a website that isn't publicly reachable - Upsun Developer

Some applications should never answer a request from the open internet. Here are the ways to make one unreachable on Upsun, and how to pick between them.

developer.upsun.com

Running apache airflow on hardened containers 🔒

Flora Brandão — Wed, 07 Oct 2026 10:25:02 +0000

Running Apache Airflow on a locked-down platform can be an engineering challenge when you need to balance container security and task isolation.

Here is how to handle task isolation on hardened containers:

The problem: Secure, locked-down containers cause your own process to disappear and force tough decisions around runtime variables and task isolation.
The fix: Write 30 lines of C to manage process execution and control the exact level of task isolation you need.
Why it matters: Developers get to run Airflow on secure infrastructure without losing the specific workload boundaries required for their tasks.

Check out the full article to see how to configure Apache Airflow on a hardened platform:

Airflow on a locked-down platform - Upsun Developer

Running Apache Airflow on Upsun's hardened containers takes 30 lines of C and a decision about how much task isolation you actually want back.

developer.upsun.com

Why AI coding tools moved your bottleneck ⚡

Flora Brandão — Mon, 05 Oct 2026 15:46:25 +0000

AI tools made code output surge, but shipping software still feels slow. Speeding up code creation just pushed the constraint downstream to reviews, approvals, and spec quality.

AI increases pull request volume without expanding review capacity.
Adding mandatory reviewers adds process friction without clearing the backlog.
Better routing sends engineering, product, and security decisions to their actual owners in parallel queues.
Explicit specs matter more now because AI agents build ambiguity literally without human judgment to fill gaps.

Fixing decision routing keeps your workflow moving without overloading your engineering team.

Read the full write-up to see how to fix your post-coding bottleneck:

Where the AI coding bottleneck actually goes | Upsun

Individual coding got fast. Review, approval, and spec quality didn't. A practical guide to what to put in place before the backlog gets worse.

upsun.com

AI governance: security assurance for the cloud AI era 🔒

Flora Brandão — Fri, 02 Oct 2026 14:32:02 +0000

Chasing unsupported vendor claims and filling out endless security questionnaires during vendor reviews is a massive time sink. Standard ISO 27001 and SOC 2 reports cover access controls and encryption, but traditional compliance was never designed for AI governance questions like context, permissions, and human approval.

Here is how to evaluate AI security and governance:

Look beyond traditional compliance to management standards built specifically for AI, such as ISO/IEC 42001.
Embed core principles like risk assessment, human oversight, and traceability directly into your systems.
Shift to governed operating models like Upsun Dispatch™ where AI agents and humans ship code together safely through defined workflows.

This gives your team a clear way to maintain development speed without sacrificing human control or auditability.

Read the full article to explore how to evaluate AI-enabled providers:

Trust you can verify: security assurance for AI | Upsun

See the independent evidence behind Upsun's security: ISO 27001, SOC 2 Type 2 audits, and how we're extending governance to AI with Upsun Dispatch

upsun.com

Why shared context beats faster AI coding tools 🤖

Flora Brandão — Thu, 01 Oct 2026 15:27:51 +0000

Adopting AI coding agents often stalls at the review queue. Engineers generate code fast in isolation, but the rest of the team still has to understand, review, and integrate it.

The fix:

Put engineering, product, and marketing context in one shared monorepo
Give human team members and AI agents access to the exact same documentation and vocabulary
Maintain a strict glossary so AI models do not guess at ambiguous terms
Optimize CI pipelines to keep review queues moving fast

Why it matters:

AI agents stop making bad assumptions about architecture or deployment
Context stops hiding in meetings or private channels
Small decisions get unblocked instantly across the entire team

Check out the full article to see how shared context keeps teams shipping:

Shared context for AI coding agents | Upsun

Upsun's engineers found that shared context for AI coding agents, one repo, shared docs, one glossary, does more for team speed than better tools.

upsun.com

Stop wasting time on cloud architecture before checking feasibility 🚀

Flora Brandão — Wed, 30 Sep 2026 14:07:21 +0000

Cloud migrations routinely run over budget and behind schedule because teams underestimate capability gaps and hidden dependencies at the outset. Strategy is wasted effort if you do not know whether the move is even realistic right now.

Here is how to figure it out:

Run a quick five-question check with the workload owner before building target architectures or runbooks.
Look for concrete triggers like contract renewals or data residency needs rather than a vague desire to reduce vendor lock-in.
Identify the five main blockers early: provider dependencies, coupled tooling, single cutover risks, skill gaps, and missing triggers.
Prefer staged, independently validated migrations over risky single-window cutovers without rollback paths.

Checking feasibility upfront saves your team from mistiming a major move and burning weeks on premature strategy.

Read the full article to get the complete checklist:

Migration feasibility checklist for IT leaders | Upsun

Five questions IT leaders can answer in an afternoon to decide whether a cloud migration is feasible now, later, or blocked - before touching architecture

upsun.com

Stop paying for idle containers when running AI agents 🤖

Flora Brandão — Wed, 30 Sep 2026 09:08:44 +0000

Running AI agents usually forces a bad trade-off. You either isolate them in a sandbox cut off from project data, or you pay to keep full containers idle while waiting on prompts.

Task containers offer a different approach:

Single-purpose execution: Define a task in your config.yaml to run exactly one command. Once the process exits, the container is removed.
Full project access: Run tasks in preview environments with access to cloned production data and services instead of working in a blind sandbox.
Zero idle costs: Billing only covers the exact seconds the command runs.

It gives your agents real infrastructure to complete work, test changes, and spin down without wasting resources.

Check out the full article to see how task containers work under the hood and how to set them up:

Task containers: infrastructure built for AI agents | Upsun

Upsun's task containers run once and disappear, giving AI agents access to production-like data without paying for idle infrastructure

upsun.com

Navigating build bersus buy in agentic engineering 🤖

Flora Brandão — Tue, 29 Sep 2026 14:24:20 +0000

Running local AI agents on laptops breaks the second you close your lid or step into a Wi-Fi dead zone. Beyond the personal frustration, it leaves engineering organizations with zero visibility or governance over what those agents actually executed.

Here is how to make practical build versus buy decisions across your agent stack:

Centralize execution inside temporary sandboxes so work continues reliably and audit logs remain intact.
Avoid unconstrained local tools in favor of harness engineering that enforces permission boundaries.
Treat infrastructure options as replaceable commodities by keeping your orchestration layer decoupled.
Use off the shelf frontier models, but build internal evaluation frameworks to benchmark real performance and cost.

Your team should buy standard infrastructure components and build only the evaluation logic and safety constraints that represent your actual product judgment.

Read the full article to explore how these patterns apply at every layer of the stack:

Build vs. buy in agentic engineering | Upsun

How Upsun engineers decided what to build and what to buy at each layer while creating Dispatch, its AI agent platform

upsun.com

Stop waiting on shared staging: Provision per-branch environments automatically 🚀

Flora Brandão — Thu, 24 Sep 2026 15:44:38 +0000

Shared staging servers are queues, not test beds. You push code and immediately wait for seed data to refresh, for someone to fix broken migrations, or for the server to free up.

The problem:

Shared environments accumulate everyone's half-finished changes and reflect no single developer's work.
Configurations quietly drift from production, causing tests to pass in staging and fail on release.

The fix:

Provision an isolated environment automatically as a direct byproduct of pushing a Git branch.
Build environments from the exact same single declarative configuration file used by production.
Promote the tested container image directly to production upon merging instead of triggering a rebuild.

Why it matters:

Ten active branches mean ten independent, production-aligned environments running in parallel.
Environments automatically tear down when branches close, removing manual cleanup and keeping costs down.

Check out the full article for a detailed breakdown of how to eliminate staging bottlenecks:

Turn every branch into a production-like environment | Upsun

Stop queuing behind shared staging. Git-native environment provisioning gives every branch its own full, production-aligned environment the moment it's pushed — no manual setup required.

upsun.com

Fixing multicloud chaos with policy guardrails ☁️

Flora Brandão — Thu, 24 Sep 2026 09:04:11 +0000

Running multiple cloud providers usually means managing separate consoles, disjointed identity models, and runbooks that silently drift out of sync.

The problem: Rebuilding deployment, monitoring, and compliance workflows for every new cloud provider fragments your tooling.
The fix: Separate your application configuration from platform provisioning, and write governance guardrails directly as code.
Why it matters: Your code and security rules travel together across any cloud without multiplying operational complexity or audit debt.

Check out the full article to see how to structure portable, policy-aware environments:

Portable multicloud environments with guardrails | Upsun

Deploy one YAML config across AWS, Azure, Google Cloud and more, with governance guardrails that travel with your app. Multicloud control, no lock-in

upsun.com

Stop multicloud sprawl before it ruins your on-call ☁️

Flora Brandão — Wed, 23 Sep 2026 14:24:51 +0000

When every cloud setup grows its own custom pipeline and runbook, operating model debt accumulates fast.

The grind:

Teams optimize for hosting capacity instead of delivery workflow
Separate cloud providers bring fragmented pipelines, audit processes, and dashboards
Duplicated operational overhead ends up costing more than the cloud bill

The fix:

Treat cloud providers as deployment targets sitting under one delivery layer
Define applications, declare policies, and establish workflows once
Keep the developer workflow identical regardless of where the workload runs

Why it matters:
Using a single, consistent delivery layer eliminates sprawl at the source and keeps your delivery process fast and auditable.

Read the full article for a practical walkthrough on fitting app delivery into a multicloud operating model:

Multicloud operating model: a practical guide | Upsun

Multicloud operating models fragment over time. Learn the four signs of sprawl and how a single delivery layer keeps governance and ops consistent

upsun.com

Why Let's Encrypt renewals fail 🔒

Flora Brandão — Wed, 23 Sep 2026 09:01:53 +0000

Failed certificate renewals are a classic engineering grind that can quietly break your site. The HTTP-01 challenge usually fails due to subtle routing and infrastructure misconfigurations.

Here is what breaks your renewals:

The problem: Forgotten AAAA IPv6 records, restrictive CAA policies, or CDN features like Cloudflare Bot Fight Mode blocking challenge requests.
The fix: Ensure your request path correctly forwards challenge traffic and set up early alerts for renewal failures.
Why it matters: Understanding how the HTTP-01 challenge moves through your stack prevents surprise downtime and saves you from emergency SSL debugging.

Check out the full technical write-up to learn more about troubleshooting certificate renewals:

Why Let's Encrypt certificate renewals fail - Upsun Developer

Certificate renewals fail for a handful of recurring reasons. Here's how the HTTP-01 challenge works and what breaks it, from IPv6 records to CDN rules.

developer.upsun.com