DevOps · Tuesday, 25 August 2026 · Issue 83 · 7 stories

Agentic SRE, cheaper Glue, and the end of CVSS triage

Trendyol's multi-agent SRE finds root cause in four minutes. CISA just killed CVSS-driven patching. And Glue 6.0 is 30% cheaper with the best Iceberg v3 yet. Three shifts that change how you run things.

Containers & Orchestration

Run virtual desktops as Kubernetes pods with open-source abcdesktop.io

VDI is normally Citrix and VMware territory, not Kubernetes. abcdesktop.io inverts that: every user desktop and app runs as a Kubernetes pod or ephemeral container, letting the cluster handle scheduling, autoscaling, and per-session cleanup. The makers say it has run in production across multiple countries for five-plus years, streaming only pixels over HTML5 WebSocket so endpoints stay pure display clients. A genuinely unusual, fully open-source take on desktop-as-a-service.

abcdesktop.io ↗3 min read at source

Observability & Reliability

Trendyol's multi-agent SRE finds incident root cause in ~4 minutes

Trendyol's on-call crew now pairs with specialized AI agents that mirror how a senior engineer investigates: checking logs, tracing code, inspecting infrastructure, correlating across services. The result is root cause in roughly four minutes instead of an alert storm, and a real cut in false positives. It's a detailed, production-grade blueprint for taking agentic AI from demo to the pager rotation.

medium.com ↗9 min read at source

RAG that reads your old postmortems nails root causes 87% of the time

35-55% of incident time is spent hunting runbooks and old tickets, not fixing anything. This team built a five-layer RAG system grounded in ServiceNow, Confluence, PagerDuty and GitHub knowledge, and it hit 87.3% root-cause accuracy across 2,400 scenarios while cutting mean diagnosis time 59%. The lesson: most incident knowledge lives in unstructured text, not metrics, so standalone LLMs improvise badly without retrieval.

devops.com ↗9 min read at source

Cloud & Platform Engineering

DuckDB v2.0 turns the in-process engine into a networked server

DuckDB v2.0, "Cyanoptera," graduates the embedded database's quack extension to a stable client/server mode: any DuckDB process can now serve databases over the network and route queries straight to PostgreSQL and MySQL. Built on 10,000+ commits, the release also stabilizes extensions with a versioned C API and ABI guarantees. A single-binary analytical engine has quietly become a real database server.

infoq.com ↗3 min read at source

Glue 6.0: 30% cheaper ETL with the fullest Iceberg v3 yet

AWS Glue 6.0 is now generally available everywhere the service runs, and it costs 30% less than every prior version. The bigger deal: the most complete Iceberg v3 implementation on any serverless Spark service, headlined by the VARIANT type that stores JSON and event data without flattening schemas or duplicate copies. Under the hood it's Spark 4.1, Python 3.13, and Arrow-native Python UDFs, plus a real-time streaming mode with single-digit-millisecond latency. Cheaper, faster, and finally first-class for semi-structured data.

aws.amazon.com ↗4 min read at source

DevSecOps

Agent permission allowlists leak: 7 "narrow" commands that are wider than they look

A bug-bounty and CTF pass-through exercise shows why approving an AI agent's shell command or package install is not approving one action. Each allowlisted tool name maps to a far wider blast radius, and an agent can know more ways to abuse a tool than the human approving it. Command-name allowlists are a weak boundary; the trust is really going to every file and page that shapes the agent's next action.

shmulc.substack.com ↗11 min read at source

CISA's new rule: patch by real risk, not CVE severity scores

CISA's Binding Operational Directive 26-04 forces federal agencies to triage vulnerabilities on four risk factors: exposure, known-exploited status, exploit automation, and technical impact. A publicly exposed, KEV-listed, automatable flaw can demand remediation in three days plus forensic triage; low-risk bugs wait for the next upgrade. Static CVSS scores are out. Any team feeding into government pipelines should rebuild its prioritization around these variables now.

datadoghq.com ↗7 min read at source

You’re caught up.

That was all 7 stories in the 25 August issue.