DEV Community: Muthu Kumar Murugaiyan

What Reddit Taught Me About My Azure Infra Generator (In One Day)

Muthu Kumar Murugaiyan — Wed, 15 Jul 2026 06:29:58 +0000

I built a tool called LaunchStack that turns a short wizard into a full production-ready Azure stack — Terraform modules, Helm charts, CI/CD pipelines, monitoring dashboards, the works. No more starting every project's infra from a blank repo.

Before writing more code, I wanted to know one thing: does this actually hold up when someone outside my own head tries it? So I posted it on r/Terraform, expecting either silence or a handful of polite "cool idea" comments.

I got neither. I got told exactly what was wrong with it — and that turned out to be more valuable than a hundred passive upvotes.

What happened

The post did well by Reddit's standards — #4 on r/Terraform that day, 1.5K+ views within a couple hours, real comments. But the upvote ratio told a different story than the view count: people were engaging, and a chunk of them weren't happy.

Two comments in particular changed how I think about the product:

"Where are the sources?"

Fair. I was asking strangers to trust a wizard's output without showing them what that output actually looked like first. Nobody serious signs up for an unknown tool just to maybe see something useful at the end.

"Nah bro, I'm not giving you my email to test this... there's no examples or nothing."

This one stung a little, but it was the more important comment of the two. My dev environment required a real login (Microsoft/Google OAuth) before you could see anything the wizard produced. To me, that was just... how OAuth works. To a skeptical reader scrolling past a new account's link, it looked exactly like a lead-capture trap.

Both comments were versions of the same underlying problem: I was asking for trust before I'd earned it.

What I changed

Two fixes, both shipped within the hour, directly in the comment thread:

Added a placeholder-email option for the dev environment, so trying the wizard didn't require handing over anything real.
Published a sample generated repo on GitHub — folder structure, actual rendered Terraform/Helm output, screenshots — so anyone could see exactly what the wizard produces without running it at all.

That second one mattered more than I expected. It turned "trust me" into "here, look for yourself" — which is a much easier ask.

The technical feedback itself

Buried under the trust-and-friction comments was the actual thing I was there for: real questions about the generated output — someone asking about multi-cloud support (AWS/GCP), others poking at the architecture choices in the AKS stack. That's the conversation I was hoping to have from the start, and it only really opened up once the friction was addressed.

The unglamorous part: fighting AutoMod

Worth mentioning since it's not talked about much: a brand-new Reddit account posting links gets aggressively filtered. One of my own comments got auto-hidden for low karma. Later, editing the post to add the sample-repo link sent the entire post back into a manual review queue — even though it had already been live and performing for hours.

The fix was boring but effective: a short, honest message to the subreddit's mods explaining what happened. They reinstated everything within a couple hours. No drama, just a queue.

If you're planning to post something similar from a fresh account, budget for this. It's not a sign your content's bad — it's just how spam filtering works at scale, and low-karma accounts get caught in the net along with actual spam.

What I'd tell someone about to do this

Ask for criticism explicitly, and mean it. "Tear it apart" as a literal instruction changes what people feel comfortable saying.
Remove every unnecessary barrier before you post, not after. I found out about the login-wall problem the hard way; I could've just... not required real login for a dev demo in the first place.
Show the output before asking for the interaction. A sample repo or screenshots up front would have prevented half the pushback entirely.
Reply fast, and don't get defensive. Every reply I gave that started with "fair feedback" did more for the thread's tone than any amount of explaining myself would have.

LaunchStack is still in dev, Azure-only for now (AWS/GCP planned once this is solid). If you want to see what the wizard actually outputs before trying it yourself, the sample repo's linked below.

Sample output repo: github.com/muthusethu/launchstack

Building SlimShield: A Production-Ready Docker Security Platform with 18 Advanced Features 🚀

Muthu Kumar Murugaiyan — Fri, 05 Dec 2025 23:15:47 +0000

Hey everyone! 👋

I'm excited to share SlimShield, an advanced Docker security scanning platform I've been building. It's now live and production-ready!

🔗 Live Demo: https://slimshield.itscloudhub.com

What is SlimShield?

SlimShield helps DevOps and security teams scan Dockerfiles and container images for vulnerabilities, optimization issues, and compliance violations. Think of it as a comprehensive security scanner that goes beyond basic CVE detection.

Key Features (18 Production-Ready Features!)

Security & Analysis

✨ CVE Detection with EPSS Scoring - Real-time vulnerability scanning with exploit prediction
✨ AI Risk Index - Intelligent false positive filtering with confidence scoring
✨ Auto-Fixer - Automated Dockerfile remediation and security fixes
✨ Distroless Detection - Identifies and recommends minimal container images
✨ SBOM Generation - Creates Software Bill of Materials in SPDX & CycloneDX formats

Compliance & Policy

✨ 7 Compliance Frameworks - HIPAA, PCI-DSS, SOC 2, GDPR, NIST, ISO 27001, CIS
✨ Security Policy Engine - Custom rule creation and enforcement
✨ License Policy Engine - License compliance checking and violation detection

Advanced Features

✨ Exception Management - Centralized false positive handling
✨ Incremental Scanning - Compare scans over time for changed layers
✨ Scan Comparison - Track security improvements and trends
✨ Multi-Registry Support - Unified dashboard for all your registries
✨ Webhook Notifications - Real-time alerts (Slack, Teams, Discord)
✨ Offline Mode - Air-gap scanning with local CVE database

Reports & Integration

✨ Multiple Report Formats - PDF, JSON, HTML, CSV, SARIF, JUnit XML
✨ CLI Tool - Full command-line access for CI/CD integration (Pro plan)
✨ REST API - 53+ endpoints for complete programmatic access
✨ Payment Integration - Stripe-powered subscription management

Tech Stack

Backend API:

FastAPI (Python 3.10+) with async support
PostgreSQL for production data
Redis for caching and rate limiting
Docker SDK for container operations
NVD API integration for CVE data

Frontend Portal:

React 18 with TypeScript
Tailwind CSS for styling
Axios + React Query for data fetching
Recharts for visualizations

CLI Tool:

Python 3.8+ with Click framework
Rich terminal formatting
JWT authentication with keyring

Infrastructure:

Docker & Docker Compose
Alembic for database migrations
Nginx reverse proxy
Prometheus metrics support

Architecture

Three integrated services:

Backend API (Port 9000) - Core scanning engine
Frontend Portal (Port 3000) - Web interface
CLI Tool - Terminal access for automation

Pricing Plans

💚 Free Plan - $0/month, 25 scans, basic features
💙 Pro Plan - $8/month, 150 scans, CLI access, advanced features
🚀 Enterprise - Custom pricing, 10,000+ scans, dedicated support

What I'm Looking For

Your honest feedback on:

Security - Any vulnerabilities you spot?
UX/UI - Is the interface intuitive? Any friction points?
Performance - How's the scanning speed and page load time?
Features - What's missing? What would you add?
Pricing - Does the value match the pricing?
DevOps Integration - How would you integrate this into your workflow?

The Journey

This started as a learning project but evolved into a comprehensive security platform. The biggest challenges were:

Implementing real-time CVE analysis with EPSS scoring
Building the auto-fix engine that understands Dockerfile context
Creating 7 compliance frameworks from scratch
Optimizing scanning performance for large images

What's Next

Advanced runtime correlation (monitoring integration)
More compliance frameworks
Enhanced AI capabilities for risk assessment
Team collaboration features
Custom integration marketplace

Try breaking it! I'm actively working on improvements and would love to hear what you think. 🚀

P.S. - Special shoutout to the DevOps community for inspiration. If you find bugs or have suggestions, drop them in the comments!

Thanks for checking it out! 🙏

Hey Dev.to community! 👋 After months of building, learning, and debugging, I'm thrilled to share SlimShield - an advanced Docker security scanning platform that's now production-ready and deployed! Try it here: https://slimshield.itscloudhub.com

Muthu Kumar Murugaiyan — Fri, 05 Dec 2025 23:09:53 +0000

slimshield.itscloudhub.com