How Infrastructure Connects to Everything Else

A VM is a kernel running on virtual hardware; what that kernel does is the OS domain.

Container isolation is a kernel feature. This domain uses it; the OS domain explains it.

A block device becomes useful only once a filesystem is on it.

Connection handling and backpressure at the process level decide what a target can absorb.

A virtual network is address ranges and route tables — the fundamentals are taught there.

L4 versus L7 is a question about which layer the balancer terminates.

Translation tables and port allocation explain why a NAT exhausts under load.

Edge selection is a routing and resolution problem before it is a caching one.

The policy is the mechanism; the principle and its threat model live in Security.

Storage, rotation, revocation and audit are a security discipline this domain operationalizes.

Subnet boundaries are one implementation of a segmentation strategy.

The pipeline that can deploy to production is one of the highest-value identities you own.

The provider runs the process; the schema, queries and indexes are still database engineering.

Adding a replica buys read capacity and introduces staleness you must design around.

The volume you provision decides how fast a commit can be durable.

Right-sizing a database instance is a buffer-pool decision wearing an infrastructure label.

Architecture decides that the work should be async; this domain runs and scales the workers.

Architecture decides to scale horizontally; this domain deploys and health-checks the fleet.

Discovery only becomes a problem once services are separately deployable.

System design decides that a cache is warranted. This domain deploys, secures, monitors and scales it.

Scaling on the right signal requires knowing which metric represents pressure.

Sizing without a distribution — not just an average — is how a zone failure takes down the survivors.

A run that lasts ten minutes is a job, not a request, and needs a queue and a worker.

Executing model-chosen code is exactly the case where the isolation boundary has to be real.

A model API key is a production secret with a per-token cost attached to its misuse.