// package.json (root)
{
  "name": "my-monorepo",
  "private": true,
  "workspaces": ["apps/*", "packages/*"],
  "scripts": {
    "build": "turbo build",
    "dev": "turbo dev",
    "lint": "turbo lint",
    "test": "turbo test"
  },
  "devDependencies": {
    "turbo": "^2.0.0",
    "typescript": "^5.4.0"
  }
}

// turbo.json
{
  "$schema": "https://turbo.build/schema.json",
  "tasks": {
    "build": {
      "dependsOn": ["^build"],
      "outputs": [".next/**", "!.next/cache/**", "dist/**"]
    },
    "dev": {
      "cache": false,
      "persistent": true
    },
    "lint": {
      "dependsOn": ["^build"]
    },
    "test": {
      "dependsOn": ["build"],
      "outputs": ["coverage/**"],
      "inputs": ["src/**/*.tsx", "src/**/*.ts", "test/**/*.ts"]
    }
  }
}

apps/
  web/          → depends on @repo/ui, @repo/api-client
  admin/        → depends on @repo/ui, @repo/api-client
  docs/         → depends on @repo/ui, @repo/docs-utils
packages/
  ui/           → no internal deps
  api-client/   → no internal deps
  docs-utils/   → no internal deps
  config/       → no internal deps (ESLint, TypeScript configs)

# First build (slow)
$ turbo build
• building web
• building admin
• building docs
• building ui
• building api-client
• building docs-utils

→ Tasks run by turbo: 6 (64ms each, 384ms total)

# Second build (instant - cache hit)
$ turbo build
• building web (cache hit)
• building admin (cache hit)
• building docs (cache hit)
• building ui (cache hit)
• building api-client (cache hit)
• building docs-utils (cache hit)

→ Tasks run by turbo: 0 (6 in cache, 12ms total)

# Create Nx workspace
npx create-nx-workspace@latest myorg --preset=ts

# Add a new application
npx nx generate @nx/nextjs:app admin

# Add a library
npx nx generate @nx/js:library api-client --directory=packages/api-client

# Only build/test/lint what changed (and what depends on what changed)
npx nx affected --target=build --base=origin/main

# This is the game-changer for large monorepos
# Instead of rebuilding everything, Nx computes the dependency graph
# and only rebuilds the affected packages

# Opens browser with interactive dependency graph
npx nx graph

// nx.json
{
  "namedInputs": {
    "default": ["{projectRoot}/**/*"],
    "production": ["!{projectRoot}/**/*.spec.ts"]
  },
  "targetDefaults": {
    "build": {
      "dependsOn": ["^build"],
      "cache": true,
      "inputs": ["production", "^production"]
    }
  },
  "nxCloudAccessToken": "your-nx-cloud-token"
}

mkdir my-monorepo && cd my-monorepo
git init
npm init -y
npm install -D turbo
mkdir apps packages

# Move one package
mv ../old-repo/packages/ui apps/ui
cd apps/ui
npm init -y
# Update package.json name to @myorg/ui
cd ../..
git add -A
git commit -m "feat: move ui package"

// Before (old package.json)
{
  "name": "ui",
  "dependencies": {
    "react": "^18.0.0"
  }
}

// After (in monorepo)
{
  "name": "@myorg/ui",
  "peerDependencies": {
    "react": "^18.0.0"
  }
}

# packages/config-eslint/index.js
module.exports = {
  extends: ['next/core-web-vitals', 'turbo'],
  rules: {
    '@typescript-eslint/no-unused-vars': 'error'
  }
};

# packages/config-typescript/base.json
{
  "compilerOptions": {
    "target": "ES2022",
    "lib": ["ES2022"],
    "strict": true,
    "esModuleInterop": true,
    "skipLibCheck": true
  }
}

# pnpm-workspace.yaml
packages:
  - 'apps/*'
  - 'packages/*'

# .npmrc
save-exact=true

# Option 1: Keep history (preserve all commit messages)
git subtree add --prefix=apps/web https://github.com/old/web.git main

# Option 2: Fresh start (cleaner, lose history)
mv old-repo/web apps/web

# GitHub Actions with Turborepo
name: CI

on: [push, pull_request]

jobs:
  affected:
    name: Check affected
    runs-on: ubuntu-latest
    outputs:
      affected: ${{ steps.turbo.outputs.affected }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: pnpm/action-setup@v3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - id: turbo
        run: echo "affected=$(pnpm turbo run build --dry-run=json | jq -r '.packages | if length > 0 then "true" else "false" end')" >> $GITHUB_OUTPUT

  build:
    needs: affected
    if: needs.affected.outputs.affected == 'true'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v3
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - run: pnpm turbo build --filter=...affected packages...

@Global()
@Module({
  providers: [GameService],
  exports: [GameService],
})
export class GameModule {}

String Script → Lexer → Tokens → Parser → AST → Server Evaluator → Robot Actions

IF CAN_SEE_ENEMY
  FIRE
END
MOVE

WHILE TRUE DO
  IF CAN_SEE_ENEMY AND MY_ENERGY > 30 DO
    BROADCAST(NEAREST_VISIBLE_X)
    BURST_FIRE
  ELSE IF IN_STASIS DO
    WAIT
  ELSE DO
    SCAN
    PATHFIND
  END
END

// Before: useState causes re-render on every tick
const [gameState, setGameState] = useState(null);

// After: useRef for game logic, throttled state for UI only
const gameStateRef = useRef(null); // updates at 60fps, zero re-renders
const [uiState, setUiState] = useState(null); // updates at 10fps, DOM only

logic-arena/
├── apps/
│   ├── client/     # Next.js 16, React Three Fiber, PWA
│   └── server/     # NestJS 11, Socket.io, JWT
└── packages/
    ├── engine/     # Custom TypeScript physics engine
    └── logic-parser/ # AliScript lexer, parser, evaluator

fn main() {
    let s = String::from("hello");
    let r1 = &s;
    let r2 = &s;
    println!("{} and {}", r1, r2);
}

error[E0502]: cannot borrow `s` as immutable because it is also
borrowed as mutable
  --> src/main.rs:4:13
   |
3  |     let r1 = &s;
   |              -- first borrow occurs here
4  |     let r2 = &s;
   |              ^^ second borrow occurs here
5  |     println!("{} and {}", r1, r2);
   |                            -- first borrow needs to be valid
   |                            for the duration of the borrow

help: consider using the reference count for shared ownership

help: consider using `Rc<String>` if you don't need exclusive ownership

// Before (2024): Complex futures, Pin, Box, manual polling
// After (2026): Clean async/await like Go/Python

use tokio;

#[tokio::main]
async fn main() -> Result<(), Box<dyn Error>> {
    let data = fetch_data("https://api.example.com/data").await?;
    let processed = process(data).await;
    save_to_db(processed).await?;
    Ok(())
}

async fn fetch_data(url: &str) -> Result<String, reqwest::Error> {
    reqwest::get(url).await?.text().await
}

# Cargo.toml — Production Rust is just dependency management
[dependencies]
# Web framework
axum = "0.7"
tower = "0.4"
tower-http = { version = "0.5", features = ["cors", "compression"] }

# Async runtime
tokio = { version = "1", features = ["full"] }

# Serialization
serde = { version = "1", features = ["derive"] }
serde_json = "1"

# Database
sqlx = { version = "0.8", features = ["runtime-tokio", "postgres"] }

# Error handling
anyhow = "1"
thiserror = "2"

# Logging
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = ["env-filter"] }

# Testing
tokio-test = "0.4"

use axum::{
    extract::{Path, State},
    http::StatusCode,
    response::Json,
    routing::{get, post},
    Router,
};
use serde::{Deserialize, Serialize};
use sqlx::postgres::PgPoolOptions;
use std::sync::Arc;
use tower_http::cors::CorsLayer;

#[derive(Debug, Serialize, Deserialize, sqlx::FromRow)]
struct User {
    id: i32,
    name: String,
    email: String,
}

#[derive(Clone)]
struct AppState {
    db: sqlx::PgPool,
}

async fn create_user(
    State(state): State<Arc<AppState>>,
    Json(payload): Json<CreateUserPayload>,
) -> Result<(StatusCode, Json<User>), AppError> {
    let user = sqlx::query_as::<_, User>(
        r#"INSERT INTO users (name, email) VALUES ($1, $2)
           RETURNING id, name, email"#
    )
    .bind(&payload.name)
    .bind(&payload.email)
    .fetch_one(&state.db)
    .await?;

    Ok((StatusCode::CREATED, Json(user)))
}

async fn get_user(
    Path(user_id): Path<i32>,
    State(state): State<Arc<AppState>>,
) -> Result<Json<User>, AppError> {
    let user = sqlx::query_as::<_, User>(
        "SELECT id, name, email FROM users WHERE id = $1"
    )
    .bind(user_id)
    .fetch_optional(&state.db)
    .await?
    .ok_or(AppError::NotFound)?;

    Ok(Json(user))
}

#[derive(Debug, thiserror::Error)]
enum AppError {
    #[error("User not found")]
    NotFound,
    #[error("Database error: {0}")]
    Database(#[from] sqlx::Error),
}

impl IntoResponse for AppError {
    fn into_response(self) -> Response {
        let (status, message) = match self {
            AppError::NotFound => (StatusCode::NOT_FOUND, self.to_string()),
            AppError::Database(e) => (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()),
        };
        (status, Json(serde_json::json!({ "error": message }))).into_response()
    }
}

type Response = axum::response::Response;

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    tracing_subscriber::fmt::init();

    let db = PgPoolOptions::new()
        .max_connections(5)
        .connect("postgres://user:pass@localhost/mydb")
        .await?;

    let state = Arc::new(AppState { db });

    let app = Router::new()
        .route("/users", post(create_user))
        .route("/users/:id", get(get_user))
        .layer(CorsLayer::permissive())
        .with_state(state);

    let listener = tokio::net::TcpListener::bind("0.0.0.0:3000")
        .await?;
    axum::serve(listener, app).await?;

    Ok(())
}

// C/C++ memory vulnerabilities (common in production):
// - Buffer overflow
// - Use after free
// - Double free
// - Race conditions

// The National Security Agency (NSA) and CISA now recommend:
// "Consider migrating to memory-safe languages like Rust"

# Rust incremental compilation improved dramatically

# First build (cold cache)
$ cargo build --release
# Time: ~45s for a medium project

# Incremental build (one file changed)
$ cargo build --release
# Time: ~8s (was ~35s in 2024)

# rust-analyzer type checking
# VS Code + rust-analyzer gives instant feedback
# Before you even save, you see borrow errors

# For faster iteration, use these settings in .cargo/config.toml

[build]
# Use all CPU cores for linking
rustflags = ["-C", "linker=clang", "-C", "codegen-units=1"]

# Or use mold linker (much faster than default lld)
[target.x86_64-unknown-linux-gnu]
linker = "clang"
rustflags = ["-C", "link-arg=-fuse-ld=mold"]

// math_utils/src/lib.rs
use wasm_bindgen::prelude::*;

#[wasm_bindgen]
pub fn fibonacci(n: u32) -> u64 {
    match n {
        0 => 0,
        1 => 1,
        _ => {
            let mut a: u64 = 0;
            let mut b: u64 = 1;
            for _ in 2..=n {
                let temp = a + b;
                a = b;
                b = temp;
            }
            b
        }
    }
}

# Build for WASM
cargo install wasm-pack
wasm-pack build --target web

# 200x faster than JavaScript for Fibonacci
# Smaller binary than comparable C++ WASM
# Zero runtime overhead

# Data science / ML
# Python with NumPy/PyTorch is the standard
# Rust bindings exist but ecosystem is fragmented
# Not worth the learning curve for ML work

# Scripts and automation
# Python/Bash/Shell are faster to write
# Rust is overkill for one-off scripts

# Simple CRUD APIs where Go/Python is "good enough"
# Don't use Rust because it's cool
# Use it when you need the performance or safety

# Realistic timeline to productivity in Rust:

Week 1: Fighting the borrow checker constantly
Week 2: Understanding ownership conceptually
Week 3: Writing simple programs without fighting
Month 2: Comfortable with lifetimes in structs
Month 3: Can navigate async Rust and the crate ecosystem
Month 6: Productive Rust developer

# The curve is real but the investment pays off
# Once you internalize ownership, you see memory bugs everywhere in C code

# The old way
logger.info(f"Processing order {order_id} for user {user_id}")
logger.info(f"Payment processing for ${amount}")
logger.error(f"Payment failed: {error_code}")

# Debugging a production issue:
# 1. Find the right log lines across 50 service logs
# 2. Correlate timestamps across machines (which may not be synced)
# 3. Reconstruct what happened from thousands of log lines
# 4. Hope the relevant lines weren't filtered out by your logging library

# The new way: OpenTelemetry
from opentelemetry import trace
from opentelemetry.sdk.trace import TracerProvider
from opentelemetry.sdk.trace.export import BatchSpanProcessor
from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter

# Set up the tracer
trace.set_tracer_provider(TracerProvider())
trace.get_tracer_provider().add_span_processor(
    BatchSpanProcessor(OTLPSpanExporter())
)
tracer = trace.get_tracer(__name__)

# Instrument your code
def process_order(order_id: str, user_id: str, amount: float):
    with tracer.start_as_current_span("process_order") as span:
        span.set_attribute("order.id", order_id)
        span.set_attribute("user.id", user_id)
        span.set_attribute("order.amount", amount)

        with tracer.start_as_current_span("validate_order"):
            # validation logic
            pass

        with tracer.start_as_current_span("process_payment") as payment_span:
            payment_span.set_attribute("payment.method", "stripe")
            result = stripe.charge(amount)
            payment_span.set_attribute("payment.status", result.status)

            with tracer.start_as_current_span("send_confirmation"):
                send_email(user_id, result)

process_order (2.3s)
├── validate_order (0.1s)
├── process_payment (2.1s)
│   ├── stripe.charge (1.8s)
│   └── send_confirmation (0.3s)

# otel-collector-config.yaml
receivers:
  otlp:
    protocols:
      grpc:
      http:

processors:
  batch:
    timeout: 5s
    send_batch_size: 1024

  memory_limiter:
    check_interval: 1s
    limit_mib: 4000

exporters:
  otlp/tempo:
    endpoint: tempo:4317
    tls:
      insecure: false

  datadog:
    api:
      key: ${DATADOG_API_KEY}

service:
  pipelines:
    traces:
      receivers: [otlp]
      processors: [memory_limiter, batch]
      exporters: [otlp/tempo, datadog]
    metrics:
      receivers: [otlp]
      processors: [memory_limiter, batch]
      exporters: [otlp/tempo, datadog]

# Install the agent
pip install opentelemetry-instrumentation-all

# Run your app with auto-instrumentation
opentelemetry-instrument python your_app.py

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-service
spec:
  template:
    spec:
      containers:
      - name: my-service
        image: my-service:latest
        env:
        - name: OTEL_SERVICE_NAME
          value: "my-service"
        - name: OTEL_EXPORTER_OTLP_ENDPOINT
          value: "http://otel-collector:4317"
        - name: OTEL_RESOURCE_ATTRIBUTES
          value: "deployment.environment=production"
        - name: OTEL_PROPAGATORS
          value: "tracecontext,baggage"
        - name: OTEL_TRACES_SAMPLER
          value: "parentbased_traceidratio"
        - name: OTEL_TRACES_SAMPLER_ARG
          value: "0.1"  # Sample 10% of traces

from opentelemetry import metrics
from opentelemetry.sdk.metrics import MeterProvider
from opentelemetry.sdk.metrics.export import PeriodicExportingMetricReader
from opentelemetry.exporter.otlp.proto.grpc.metric_exporter import OTLPMetricExporter

# Set up metrics
metric_reader = PeriodicExportingMetricReader(
    OTLPMetricExporter(), export_interval_millis=30000
)
metrics.set_meter_provider(MeterProvider(metric_readers=[metric_reader]))
meter = metrics.get_meter(__name__)

# Create metrics
order_counter = meter.create_counter(
    "orders_processed",
    description="Number of orders processed",
    unit="1"
)

payment_duration = meter.create_histogram(
    "payment_duration",
    description="Payment processing duration",
    unit="ms"
)

error_counter = meter.create_counter(
    "payment_errors",
    description="Number of payment errors"
)

# Use them
def process_payment(amount: float):
    with tracer.start_as_current_span("process_payment"):
        try:
            start = time.time()
            result = stripe.charge(amount)
            payment_duration.record((time.time() - start) * 1000)
            order_counter.add(1, {"status": "success"})
            return result
        except Exception as e:
            error_counter.add(1, {"error": type(e).__name__})
            raise

import structlog

structlog.configure(
    processors=[
        structlog.processors.TimeStamper(fmt="iso"),
        structlog.processors.JSONRenderer()
    ]
)

log = structlog.get_logger()

# Structured logs now include trace context automatically
log.info("payment_processed",
    order_id="12345",
    amount=99.99,
    # These are automatically injected from the current trace:
    # trace_id, span_id, trace_flags
)

from opentelemetry.sdk.trace.samplers import TraceIdRatioBased

# Sample 10% of all traces
sampler = TraceIdRatioBased(0.1)

provider = TracerProvider(sampler=sampler)

# Grafana Tempo tail-based sampling
overrides:
  "service.namespace:payments":
    processors:
      - type: latency
        threshold_ms: 1000  # Always keep traces > 1s
      - type: status_code
        status_codes:
          - ERROR  # Always keep errors
      - type: trace_state
        key: environment
        values: [production]  # Always keep production
      - type: probabilistic
        sampling_percentage: 5  # Sample 5% of the rest

# Grafana Tempo + SLO example
groups:
  - name: orders-slo
    rules:
    - alert: OrderLatencyHigh
      expr: |
        histogram_quantile(0.95,
          sum(rate(tracetest_s spans{ service="order-service" }[5m]))
          by (le)
        ) > 1000
      for: 5m
      labels:
        severity: critical
      annotations:
        summary: "Order processing P95 latency > 1s"
        runbook_url: "https://wiki.example.com/runbooks/order-latency"

    - alert: PaymentErrorRateHigh
      expr: |
        sum(rate(tracetest_spans{ 
          service="payment-service",
          span.kind="server",
          otel.status_code="ERROR"
        }[5m])) /
        sum(rate(tracetest_spans{ 
          service="payment-service",
          span.kind="server"
        }[5m])) > 0.01
      for: 2m
      labels:
        severity: critical

Instrumentation Layer:
├── OpenTelemetry SDK (auto-instrumentation)
├── Language-specific agents (Python, Node, Go, Java, Rust)
└── Custom spans for business logic

Collection Layer:
├── OpenTelemetry Collector (otelcol)
├── Grafana Alloy (successor to Grafana Agent)
└── Vector (for logs and metrics)

Storage & Query Layer:
├── Grafana Tempo (traces) — S3/MinIO backend
├── Prometheus + Thanos (metrics)
├── Loki (logs)
└── Datadog/New Relic/Honeycomb (if you prefer managed)

Visualization:
└── Grafana (universal) or platform-native UIs

Alerting:
└── Grafana Alerting or platform-native

# docker-compose.yml
services:
  otel-collector:
    image: otel/opentelemetry-collector:0.96.0
    volumes:
      - ./otel-collector-config.yaml:/etc/otelcol-contrib/config.yaml
    ports:
      - "4317:4317"   # OTLP gRPC
      - "4318:4318"   # OTLP HTTP
      - "8888:8888"   # Prometheus metrics

# Python
pip install opentelemetry-api 
            opentelemetry-sdk 
            opentelemetry-exporter-otlp 
            opentelemetry-instrumentation-flask

# Run with auto-instrumentation
OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317 
OTEL_SERVICE_NAME=my-service 
opentelemetry-instrument python app.py

# macOS
brew install podman
podman machine init
podman machine start

# Linux (Fedora/RHEL already has it)
sudo dnf install podman

# Verify
podman run --rm docker.io/library/alpine echo "Podman works!"

# Docker: daemon-based (root privilege required)
# dockerd runs as root, all containers are children of root process

# Podman: daemon-free (user privilege)
# Each container runs as a child of your user process
# No root daemon = no root vulnerabilities

# Podman 5.x (2026) features:
# - Rootless containers by default
# - Pods (like Kubernetes pods)
# - cgroups v2 fully supported
# - Kubernetes YAML support (podman generate kube)
# - Docker-compatible CLI (alias docker=podman works)

# Create a pod with multiple containers
podman pod create --name myapp-pod 
  -p 8080:80 
  -p 5432:5432

# Add containers to the pod
podman run -d --pod myapp-pod --name nginx nginx:alpine
podman run -d --pod myapp-pod --name postgres postgres:16

# All containers in the pod share the network namespace
# Access localhost:80 → nginx
# Access localhost:5432 → postgres

# Generate Kubernetes YAML from the pod
podman generate kube myapp-pod > myapp.yaml
# Now deploy to Kubernetes with zero changes

# Podman runs as your user, not root
$ podman run --rm alpine id
uid=0(root) gid=0(root)

# Wait, root? This is actually correct inside the container
# The container's root is mapped to an unprivileged user on the host

# Check on the host
podman unshare cat /proc/self/uid_map
# Shows: 0 1000 1 (container root = host user 1000)

# This means even if a container escapes, it has limited host access

# Podman uses Dockerfiles directly
# Just point to your existing Dockerfiles

podman build -t myapp:latest .
podman push myapp:latest docker://registry.example.com/myapp:latest
# or
podman push myapp:latest containers://registry.example.com/myapp:latest

# The container registries support both:
# docker:// (Docker registry protocol)
# containers:// (OCI registry protocol)

# Docker Desktop:
# - Runs a full Alpine Linux VM (2-4GB RAM)
# - Shares your file system via osxfs (slow)
# - Virtual USB/Network stack
# - $0-$21/month depending on company size

# Lima:
# - Uses macOS native virtualization (Hypervisor.framework)
# - Better performance
# - Native file sharing (virtiofs)
# - Free and open source

# Install
brew install lima

# Create a template
limactl start

# It creates an Alpine Linux VM with:
# - containerd + nerdctl
# - BuildKit
# - BuildPull-Through caching
# - Rootful + Rootless support

# Use it like Docker
limactl shell default docker build -t myapp .
limactl shell default docker run -p 8080:80 myapp

# lima.yaml (or any .yaml in ~/.lima/_config/)
images:
  - location: "https://deps.sh/lima/alpine/3.19.1/lima.yaml"
    arch: "x86_64"
  - location: "https://deps.sh/lima/alpine/3.19.1/lima.yaml"
    arch: "aarch64"

provision:
  - mode: system
    script: |
      # Install containerd and dependencies
      apk add --no-cache 
        containerd 
        docker 
        docker-cli-compose 
        buildkit

  - mode: user
    script: |
      # User-level setup
      systemctl --user enable containerd
      systemctl --user start containerd

provision_scripts:
  - mode: system
    script: |
      cat > /etc/docker/daemon.json <<'EOF'
      {
        "registry-mirrors": ["https://mirror.gcr.io"],
        "storage-driver": "overlay2"
      }
      EOF
      rc-service docker start

mounts:
  - location: "~"
    writable: true
  - location: "/tmp/lima"
    writable: true

networks:
  - lima: bridged

cpu: 4
memory: 8GB
disk: 100GB

# Docker stack (Docker Inc.'s product):
# docker CLI → dockerd (daemon) → containerd → runc → containers

# containerd directly:
# ctr CLI (or nerdctl) → containerd → runc → containers

# Benefits:
# - Smaller attack surface (no dockerd)
# - Direct access to OCI images
# - Better integration with Kubernetes
# - Simpler debugging

# Install
apt install containerd

# Pull images
ctr images pull docker.io/library/nginx:alpine

# List images
ctr images ls

# Run containers
ctr run -t --rm docker.io/library/alpine:latest test-container ash

# Manage namespaces (like docker ps)
ctr ns ls
ctr -n k8s.io containers ls

# Install nerdctl
brew install nerdctl

# nerdctl works like docker but uses containerd
nerdctl build -t myapp:latest .
nerdctl run -p 8080:80 myapp:latest
nerdctl compose up

# Extra features nerdctl adds:
# - Image encryption (--encrypt)
# - BuildKit with containerd snapshotter
# - Gzip compression for images
# - Lazy pulling (stargz)

# /etc/buildkit/buildkitd.toml
[registry."docker.io"]
  mirrors = ["registry.docker.io"]

[registry."gcr.io"]
  insecure = true  # For air-gapped environments

[worker.oci]
  max-parallelism = 4  # Limit concurrent builds

[driver]
  snapshotter = "overlayfs"  # Faster than native

# Build with inline cache (embed cache metadata in image)
docker build --build-arg BUILDKIT_INLINE_CACHE=1 -t myapp:latest .

# Build with cache mount (persist package manager caches)
docker build -t myapp:latest . <<'EOF'
# syntax=docker/dockerfile:1.7
FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN --mount=type=cache,target=/root/.npm 
    npm ci --only=production
COPY . .
EOF

# The npm cache persists across builds
# `npm ci` runs with the cached node_modules

# Build for multiple architectures simultaneously
docker buildx create --use
docker buildx inspect --bootstrap

docker buildx build 
  --platform linux/amd64,linux/arm64 
  --tag myapp:latest 
  --push 
  .

# This builds simultaneously on:
# - amd64 (Intel/AMD)
# - arm64 (Apple Silicon, ARM servers)
# and pushes a manifest list to the registry

# Kubernetes node configuration for containerd
# /etc/containerd/config.toml

version = 2

[plugins."io.containerd.grpc.v1.cri"]
  sandbox_image = "registry.k8s.io/pause:3.9"

  [plugins."io.containerd.grpc.v1.cri".containerd]
    default_runtime_name = "runc"
    snapshotter = "overlayfs"

    [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
      runtime_type = "io.containerd.runc.v2"
      privileged_without_host_devices = false

      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
        BinaryName = "/usr/bin/runc"
        SystemdCgroup = true

  [plugins."io.containerd.grpc.v1.cri".registry]
    config_path = "/etc/containerd/certs.d"

# Docker Desktop pricing (2026):
# - Individuals: Free
# - Small business (<250 employees, <$10M): Free
# - Medium business: $21/month/user
# - Large business: Commercial license required

# Alternatives:
# - Podman: Free
# - Lima: Free
# - Rancher Desktop: Free (macOS/Windows)
# - OrbStack: Free (macOS, faster than Lima)

// Before: TypeScript couldn't narrow the type
function isString(value: unknown): boolean {
  return typeof value === 'string';
}

const values: (string | number)[] = ['hello', 42, 'world', 100];

// You'd have to do this:
const strings = values.filter((v) => {
  if (isString(v)) {
    return v; // TypeScript still thought v could be number!
  }
  return false;
});

// Or this (more explicit but verbose):
const strings = values.filter((v): v is string => isString(v));

// Now TypeScript infers the type predicate automatically
function isString(value: unknown): boolean {
  return typeof value === 'string';
}

const values: (string | number)[] = ['hello', 42, 'world', 100];

// TypeScript now correctly narrows inside the filter callback
const strings = values.filter((v) => isString(v));
// strings is correctly typed as string[]

// Works with more complex predicates
function isNonNullable<T>(value: T): value is NonNullable<T> {
  return value !== null && value !== undefined;
}

const mixed: (string | null | undefined)[] = ['a', null, 'b', undefined, 'c'];
const defined = mixed.filter(isNonNullable);
// defined is string[]

// Before 5.5 required explicit type predicates everywhere
interface User {
  id: string;
  email: string;
  role: 'admin' | 'user' | 'guest';
}

function isAdmin(user: User): boolean {
  return user.role === 'admin';
}

function isActive(user: User): boolean {
  return user.email.includes('@'); // simplified
}

const users: User[] = /* from API */;

// Old way: explicit type predicates
const admins = users.filter((u): u is User => isAdmin(u) && isActive(u));

// 5.5 way: inferred predicates chain naturally
const admins = users.filter((u) => isAdmin(u) && isActive(u));

// This would have been a runtime error before
const emailRegex = new RegExp('[a-z+', 'i'); // Syntax error in regex!

// TypeScript 5.5: Error detected at compile time
// Error: Invalid regular expression: Range out of order in character class

// Another example
const dateRegex = new RegExp('(\d{4})-(\d{2})-(\d{2}', 'g'); // Missing closing paren
// Error: Invalid regular expression: Unterminated group

// Oops: accidentally escaped the wrong character
const phoneRegex = new RegExp('\d{3}[-*]\d{3}[-*]\d{4}');
// Valid! But what if you meant:

const zipRegex = new RegExp('d{5}'); // Missing backslash!
// TypeScript 5.5 catches this: 'd' should be '\d' in string
// Error: Invalid escape sequence in string literal

interface ApiResponse {
  status: 'success' | 'error';
  data?: object;
  error?: string;
}

const responses: ApiResponse[] = await fetchAll();

// Before 5.5: You had to manually type the filter result
const successful: ApiResponse[] = responses.filter((r) => r.status === 'success');
// This worked but was verbose for more complex scenarios

// 5.5 handles discriminated unions better
const successes = responses.filter((r) => r.status === 'success');
// successes is (ApiResponse & { status: 'success' })[] but crucially
// r.data is now properly typed as `object` (not `object | undefined`)

// Before 5.5: Weird edge cases with import assertions
import data from './data.json' assert { type: 'json' };

// 5.5: import attributes syntax (the new standard)
import data from './data.json' with { type: 'json' };

// This matters because `assert` is being deprecated in favor of `with`
// 5.5 ensures you're writing future-proof code

TypeScript 5.4: 45.2s full build
TypeScript 5.5: 38.7s full build
Improvement: ~14%

With --incremental:
TypeScript 5.4: 12.1s incremental
TypeScript 5.5: 9.8s incremental
Improvement: ~19%

// 5.5 refines what `satisfies` means for union types
type Color = 'red' | 'green' | 'blue';
type Theme = Record<string, Color | string>;

const theme = {
  primary: 'red',
  secondary: 'blue',
  custom: '#3498db', // This is valid (string, not Color)
} satisfies Theme;

// TypeScript now correctly narrows each property
const primary: Color = theme.primary; // 'red' (not Color | string)
const custom: string = theme.custom; // '#3498db' (not Color | string)

// Before 5.5, you sometimes had to cast even with satisfies

// This still requires explicit types - TypeScript can't infer from runtime
async function fetchUser(id: string): Promise<User> {
  // You still need to tell TypeScript what User is
  const response = await fetch(`/api/users/${id}`);
  return response.json(); // still any, needs type assertion or schema validation
}

// Best practice: use a schema validator (zod, typebox)
import { z } from 'zod';

const UserSchema = z.object({
  id: z.string(),
  email: z.string().email(),
  role: z.enum(['admin', 'user', 'guest']),
});

const response = await fetch(`/api/users/${id}`);
const user = UserSchema.parse(await response.json()); // typed correctly

// TypeScript still struggles with complex inference in some cases
function createReducer<S, A extends Action>(
  initialState: S,
  handlers: Record<string, (state: S, action: A) => S>
): Reducer<S, A> {
  return (state = initialState, action) => {
    const handler = handlers[action.type];
    return handler ? handler(state, action) : state;
  };
}

// The inference still requires explicit types in some scenarios
// This is fundamental to how TypeScript's type system works

npm install [email protected] --save-dev
# or
pnpm add -D [email protected]

// This pattern is now unnecessary in most cases:
array.filter((item): item is Type => predicate(item))

// Can become:
array.filter(predicate)

// Replace:
import foo from './foo.json' assert { type: 'json' };

// With:
import foo from './foo.json' with { type: 'json' };

// Add a lint rule to catch regex errors early
// ESLint rule: no-invalid-regexp

// Or add a custom rule in your CI:
const regex = new RegExp(pattern);
console.log('Regex valid:', regex.source);

class AddIndexesToOrders < ActiveRecord::Migration[7.0]
  def change
    add_index :orders, :user_id
  end
end

-- Migration 1: Safe - never locks
ALTER TABLE orders ADD COLUMN user_email VARCHAR(255);

-- Update application to write BOTH old and new columns
-- Deploy this first

-- Safe batched backfill
DO $$
DECLARE
  batch_size INT := 10000;
  offset_val INT := 0;
  max_id INT;
  updated INT;
BEGIN
  SELECT MAX(id) INTO max_id FROM orders;

  LOOP
    UPDATE orders 
    SET user_email = (SELECT email FROM users WHERE users.id = orders.user_id)
    WHERE id IN (
      SELECT id FROM orders 
      WHERE user_email IS NULL 
      AND id <= max_id
      ORDER BY id 
      LIMIT batch_size
    );

    GET DIAGNOSTICS updated = ROW_COUNT;
    EXIT WHEN updated = 0;

    -- Prevent lock contention
    PERFORM pg_sleep(0.1);
  END LOOP;
END $$;

-- Now safe because all rows have values
ALTER TABLE orders ALTER COLUMN user_email SET NOT NULL;

-- Set a short lock timeout so migration fails fast instead of hanging
SET lock_timeout = '2s';

-- Migration that might need a lock
ALTER TABLE orders ADD COLUMN status VARCHAR(50);

-- If it can't get lock in 2s, it fails immediately
-- Instead of blocking for minutes

-- BAD: Locks table, blocks reads/writes
CREATE INDEX idx_orders_user_id ON orders(user_id);

-- GOOD: Runs without locking, takes longer but zero downtime
CREATE INDEX CONCURRENTLY idx_orders_user_id ON orders(user_id);

# Rails: Tell it to run outside a transaction
class AddIndexesToOrders < ActiveRecord::Migration[7.0]
  disable_ddl_transaction!

  def change
    add_index :orders, :user_id, algorithm: :concurrently
  end
end

main (production schema)
  └── staging-test (validate migrations)
        └── feature/user-email-migration (your change)

# Before starting a migration
git checkout main
git pull
git checkout -b migration/user-email-fix

# Run migrations locally against fresh production copy
# Once validated:
git checkout main
git merge migration/user-email-fix
# Deploy migration to production

Before ANY production migration:

□ Tested on production-size dataset (at minimum on staging with production data snapshot)
□ Lock duration estimated (use EXPLAIN ANALYZE)
□ Rollback plan documented
□ Canary/deploy step prepared (migrate 1% of traffic, observe, then full deploy)
□ Alert thresholds set (if migration causes >X% error rate, auto-rollback)
□ Migrations scheduled during low-traffic window
□ On-call engineer aware and standing by
□ Database backup verified (point-in-time recovery tested)
□ Lock timeout set appropriately
□ Query plan examined for full table scans

ALTER TABLE users ADD COLUMN display_name VARCHAR(100);

# Update application to WRITE to both columns
# User.where(name: 'John').update(display_name: 'John') 
# runs in background

UPDATE users SET display_name = name WHERE display_name IS NULL;
-- In batches of 10,000 with 0.1s sleep

# Deploy code that only reads from display_name
# Verify everything works

ALTER TABLE users DROP COLUMN name;
-- Must run outside transaction for PostgreSQL

# Install
CREATE EXTENSION pg_repack;

# Repack a bloated table without locking
pg_repack -d mydb -t orders --no-indexes

# Repack with specific index
pg_repack -d mydb -t orders -i idx_orders_user_id

# Watch active queries during migration
pg_activity -h localhost -U postgres

# Or query directly
SELECT pid, state, query, query_start, now() - query_start AS duration
FROM pg_stat_activity
WHERE state != 'idle'
ORDER BY duration DESC;