i build systems
from the machine up.

when i left, aug 20264,000+ accounts380 active VMs140 managed Postgres clusters20+ internal services

compute

the Go control plane for QEMU/KVM: VM lifecycle APIs, rescue boot, volume attach and cleanup, subnet operations, bare-metal host setup, and reconciliation after failed transitions.

block storage

a storage engine using SPDK and NVMe-oF, connected to QEMU guests through VFIO-user. a reconciler compares live bdev, lvol and RAID state with the database and recovers from crashes during provisioning.

kubernetes

managed Kubernetes: control-plane and worker bootstrap, OIDC and JWKS, short-lived join credentials, Cilium and CoreDNS, a CSI driver with attach, mount, resize and failover, and a Karpenter cloud provider.

identity / objects

identity and account services: IMDS tokens, Valkey-backed caching, IAM authorization, encrypted secrets. also the S3-compatible object storage API with multipart uploads, presigned URLs and SigV4 checksums.

managed data

managed Postgres and Kafka/Streams, using the compute and DNS services to provision nodes, replicas and brokers. this also covered topics, users and ACLs.

networking

an AF_PACKET ARP/NDP proxy with BPF filtering, VLAN handling, rate limits, GARP and IPv6 DAD, plus authoritative DNS with AXFR, IXFR, TSIG and weighted records.

shared libraries

Go libraries used by every service on the platform: an HTTP framework that generates OpenAPI 3.1 from Go types using reflection, shared error and domain types, and OpenTelemetry middleware.

developer tools

code generation from the OpenAPI 3.1 specs of eight services, producing an SDK, a CLI with 20 command groups, and a Terraform provider with 30 resources and 13 data sources.

console / delivery

the Next.js console for compute, buckets, Streams, secrets, billing and security groups, with an authenticated instance terminal using Xterm and WebSockets. i also worked on ephemeral CI runners using Firecracker on our own hardware, usage-based billing, and the docs site.

live migration

i rebuilt the disk migration tool with resumable sender and receiver sessions, checkpointing, pinned per-session TLS, heartbeats and idempotent thaw recovery.

GoCTypeScriptSwiftPythonKubernetesQEMU/KVMFirecrackerSPDKNVMe-oFVFIO-userCSIKarpenterLinuxPostgreSQLValkeyClickHouseKafkaOpenTelemetryOpenAPI 3.1TerraformNext.jsReactElectronDNSHTTP/2TLS