Blog
Engineering, product, and public-sector notes on the DevOps execution layer.
I was a software engineer at Salesforce and Google before founding a company in July 2024. The standard for good code stayed the same. What changed is that the questions in front of the code became mine: which customer problem, and why now. Notes on how the definition of good work shifted from engineer to founder.
John Baek
Expecting a team to speed up after hiring experienced engineers is natural. But there is something to check before opening the role: can you describe why work is slow as a concrete scene? Notes on separating work time from elapsed time, writing down the expected outcome, and how to judge a senior hire.
John Baek
A question that started in a StarCraft lobby, where saying I was Korean was enough to make opponents leave. Where does skill actually come from? Move the practice-and-feedback loop of a PC bang into a developer day and you get an environment where you can see what happens after every change.
John Baek
Every time I ask for ownership while running a small company, a question comes back to me. What did I hand over, how far could they decide, and did I explain the criteria up front? Four conditions that make ownership possible, and what a leader has to do first.
John Baek
The contract size a vendor wants and the reason a customer pays are two separate explanations. Working through a hypothetical ROI calculation to the end shows why counting only the hours saved per deployment falls short, and which items belong in the same table.
John Baek
Complaints about a familiar tool are easy to hear. But a complaint is not the same as a buying problem. What one conversation taught me about separating the friction a customer mentions from the problem their organization actually has to solve, and the four questions to ask instead.
John Baek
Issues, repositories, reviews, CI/CD, docs, AI. Every new feature made the product description longer, but not the reason to choose it today. So we changed the question: what decision can the customer not make right now? Why Change sits at the center of CollabOps.
John Baek
Adding one more criterion to the post about building every connector and still recommending migration. Do not make the structure that feels natural to the vendor the starting point for the customer. Ask for the outcome they want and the smallest change that delivers it, then do the engineering that integration actually requires.
John Baek
In organizations where product managers write code with AI and several agents work at once, who checks what before a change reaches production? A role design for verification, approval, and recovery that is independent of the author, grounded in NIST SSDF, SLSA provenance, and the Google SRE postmortem culture.
John Baek
Security comparisons of Git and SVN mix two separate questions: where the repository runs and what gets replicated to developers. Using official documentation, this post compares five items in a table (internal hosting, local copy scope, per-path read separation, egress, access revocation) and ends with a checklist for a source control security review.
John Baek
Asked whether Git can run in a closed network at all, I checked the official docs, government announcements, and procurement records. The answer is yes, internal-network Git can be operated safely. Here are the evidence, the two design decisions that make it so, and a question list for security reviews.
John Baek
The problem Mylyn set out to solve in the mid-2000s is the agent context problem. What changed is that the thing reading that context is no longer only a person.
Yeongsang Kim
Once writing code got cheap, a developer's time moved to judging and approving. Here is why those jobs cannot live outside the editor, and the choices behind the CollabOps VS Code extension.
Seungbaek Lee
Organizations evaluating an SCM replacement ask two things. Does it handle deployment beyond version control, and where does it install — we run UNIX. On what it means for repository, change requests, pipelines, and deployment to live on one plane, and an honest answer to the UNIX question.
John Baek
How does this work with Eclipse, and can it integrate with our ITSM — these two questions almost always arrive together. What "standard Git protocol" actually means as an answer, and why the real substance of the ITSM requirement is the evidence chain.
John Baek
Ten concurrent users fit on one 80GB GPU, dozens start at two, and if a hundred people run agents simultaneously you're genuinely talking dozens of cards. The VRAM formula, model tiering, and why agent token consumption dominates sizing. A write-up of the GPU questions we keep getting in meetings.
John Baek
There's a question we get in almost every public-sector meeting. We lock a file before we touch it — so how does your solution work? On the difference between lock-based and branch-merge models, how control survives without locks, and a migration path that doesn't throw away history.
John Baek
The answer we give institutions that want a PoC but have no GPUs. Only the agent needs GPU; everything else on the platform runs on CPU servers. How the 30-day PoC actually proceeds, how much of document generation is really automatic, and why "we should validate fit before adopting" is exactly right.
John Baek
In the meeting, my answer was "it has more collaboration built in." Not wrong, but empty. Here's the honest version — where SVN and TortoiseSVN are genuinely good, what exactly differs in version-control terms, and why what we sell is a property, not a feature list.
John Baek
A major SI organization with a fully automated toolchain asked us why they'd need us at all. Three-year projects, year-long planning phases, strict governance. Their question rests on three premises. Let's examine each one.
John Baek
A division head at a public agency told us. Why do we run SVN? Even when our own people complain, we keep it because it's stable. Stability comes first. That is the reference. On how public-sector adoption decisions actually work, and what a vendor should do about it.
John Baek
Every demo gets the same question. Shouldn't the AI look at the connected sources, not just the file it's changing? And who builds those connections? The answer is that nobody does. Here's the structure behind that short answer.
John Baek
Claude Code and Cursor are collapsing the cost of writing code. But when code gets cheap, the bottleneck doesn't disappear; it moves. On context supply, execution paths, approval, and where coding agents and a DevOps platform interlock.
John Baek
Every adoption meeting asks whether we integrate with GitLab, SVN, and Jenkins. We do. And we still recommend migrating. On what integration can move, what it can't, and when integration genuinely is the right answer.
John Baek
Twelve months after The Next Decade of DevOps Is Agentic. Honest evaluation of which hypotheses held, which were partially wrong, and which we abandoned.
John Baek
Q2's four major releases (AI Agent GA, Integration Marketplace beta, OpenShift Operator, FIPS-validated builds) + 12 minor changes summarized.
John Baek
Six months after Why Three Pillars Aren't Enough. How the four added signals (events / user journeys / deploy correlation / similarity) actually performed in production.
John Baek
On per-minute price, self-hosted wins by 80%. On DIY total cost, GitHub Actions wins by 35%. Move the indirect costs from people to a platform and the math flips one more time. Twelve months of measured numbers.
John Baek
A GUI demo takes *5–10 minutes*. A CLI tour takes *30 seconds*. The CLI is the fastest way to convey our product's mental model.
John Baek
New domain. Zero backlinks. DA zero. Can we get *cited in LLM answers* in six months? *Conditional yes*. The four-stage experiment with measured results.
John Baek
Global SaaS sales playbooks don't transfer directly to Korean enterprises. Five realities we observed across six Korean customers and the responses.
John Baek
Cloud DR guides assume *multi-region*. Air-gapped has *no regions*. A four-resource taxonomy and a redundancy strategy for each.
John Baek
Treat ISO 27001 as a *paperwork project* and you'll quit at month six. The certification reshapes *how the org operates*. A realistic guide for small teams.
John Baek
"Multi-agent systems" are 2026's hype. We tried it five times and *fell back to single-agent every time*. Why *one agent + good tools* is almost always the right answer.
John Baek
For the first nine months we *explicitly refused* to build an integration marketplace. At month twelve we reversed the decision. The four variables behind it.
John Baek
Not "agents replace people." It's that humans and agents share the same authority model and the same audit trail. That single difference defines the next ten years.
John Baek
The MCP server *official guide* gets you to PoC. The *production deployment* that follows hits five things the guide doesn't cover — JSON-RPC translation, per-tool authorization, error semantics, lifecycle, isolation.
John Baek
2023's answer was almost always RAG. 2026's answer is *conditional*. Four variables that decide it — and the cases where the answer is *both*.
John Baek
Nine months of founding. People, money, product, market — 23 decisions. *Seven* clearly right, *six* clearly wrong, *the rest* still unknown. An honest record.
John Baek
Zero Trust assumes *no perimeter*. Air-gapped networks assume *strong perimeter*. They're not in conflict — *zero trust within the perimeter* is the answer.
John Baek
Nine months running self-hosted *Llama 3 / Qwen 2.5* in an air-gapped environment where cloud LLMs aren't an option. The four things guides skip — GPU allocation, throughput, fine-tuning, model refresh.
John Baek
We assumed *LLM call cost is small*. Six months in, the bill was *$4,200*. Six weeks of work and six patterns brought it to *$890*. The breakdown.
John Baek
Code assistants only need a cloud GPU. Operational agents don't. Three structural constraints — data boundary, execution authority, audit obligation — decide everything else.
John Baek
Seven enterprise tools compared on their on-prem deployment models. What each *assumes*, who each *excludes*, and why CollabOps started from a *different assumption*.
John Baek
When an agent acts in production, you must be able to *undo it*. It's not "ctrl+z". Four rollback strategies and the scenarios each fails in.
John Baek
CollabOps's minimum is *one VM, 8 vCPU, 16 GB RAM, 200 GB SSD, one internal IP*. That single line compresses *six months of architectural decisions*. Here's how.
John Baek
At some point an AI agent decides *I can't* and hands off to a human. If that handoff isn't designed well, the human *starts the investigation from scratch*.
John Baek
Customers may have *no Kubernetes, no infra expertise, no matter what existing systems they run* — we still need to deploy. The five environment classes from 17 PoCs and the path into each.
John Baek
Every modern B2B is *SaaS first*. We're *self-hosted first*. The four reasons — and the *paradoxical growth effect* of this choice.
John Baek
Six months of rebuilding our system to use *only FIPS 140-3 validated cryptography* for one US federal customer. Time, money, and political cost.
John Baek
CollabOps AI Agent went GA after *eight months of beta*. The four launch holds we made and why each was cheaper than launching.
John Baek
Cosign adoption itself takes *two weeks*. The key-rotation policy took *seven months* to settle. Four assumptions that broke in that gap.
John Baek
LLM agent *memory* isn't about *storing everything*. It's about *deciding what to forget*. Four memory types, four forgetting policies.
John Baek
We started with SBOM as an *audit PDF*. Six months later it had become *the first tool we reach for in incident response*. The four-stage transition.
John Baek
SLSA Level 2 is *nearly free*. Level 3 is where *real cost* starts. Eighteen months of measured time, money, and political cost.
John Baek
Not an integration dashboard, not a workflow engine. What it means for state, authority, and execution to live on the same plane.
John Baek
Eighteen months of building our first three enterprise customers with one engineer and one solutions architect, no BD hire. The five tactics that worked and three that didn't.
John Baek
There's plenty of comparison material between the two — almost none from the *air-gapped* perspective. Where they actually diverge across four evaluation axes.
John Baek
Five Dockerfile patterns that were *recommended in 2020* now *work against you in 2026*. What changed.
John Baek
"Tests are slow, parallelize them" isn't always the right answer. Six months of data on diminishing returns.
John Baek
Implement the financial *four-eyes* control by the book and *the deploy pipeline stops*. Four patterns that actually work, observed across six banks.
John Baek
What I thought when I first read the spec, the traps that bit us over six months of writing tool adapters, and why this turned out to be the deciding piece for our DevOps agents.
John Baek
We started with *3 OS × 3 Node = 9 jobs*. Six months later, *4 axes × avg 5* meant *100× the original build time*. How to cost matrices *up front*.
John Baek
After adopting Renovate, *60% of our PRs* were auto-generated and *5% broke production*. Those four patterns.
John Baek
The monorepo / polyrepo debate isn't unanswerable. It's *conditionally* answered. Five variables decide it. The pattern across seven cases.
John Baek
We asked the same one-line question to seven customer security teams. The answers split *completely*. The four variables that decide the answer — and the boundary we recommend.
John Baek
The moment you *write* a TIPS application is too late. The four pieces of material that go into a strong application are *generated six months earlier*. What to accumulate up front.
John Baek
The decision to spin up an ephemeral environment per PR is *seductive*. Twelve months of measured cost showed *the bill wasn't where the cost lived*.
John Baek
A list of every cloud-CI assumption that broke when we shipped our first on-prem deployment. Not theory — what actually went wrong, in order.
John Baek
We started with feature flags as on/off toggles. Nine months later they had become *the most frequently changed surface in our infrastructure*. The transition point and what changes there.
John Baek
GitOps stands on the proposition that *git is the single source of truth*. Some K-ISMS controls collide with that proposition directly. Six points and the workarounds.
John Baek
The assumption that canary works is *mostly correct*. Outside that "mostly" are seven patterns. Cases we lived through, broken down.
John Baek
Four months of redesigning permissions from policies fragmented across tools to a single graph. Why RBAC fell short, why ABAC wasn't the answer, and why graph-based delegation was load-bearing.
John Baek
Error budgets in books are clean. A year of *actually applying one* in production isn't. What four quarters taught us, in order.
John Baek
It is convenient to say "three views of the same picture." That isn't accurate. The differences are responsibility boundary, SLOs, and the platform-as-product model.
John Baek
For SCA and dependency scanning to mean anything in air-gapped networks, you need to maintain CVE / OSV / vendor advisory data internally. Four data streams, four sync traps, one verification.
John Baek
Logs, metrics, and traces all looked normal. Twenty-three users couldn't pay for twenty-three minutes. The gap between those two facts is where the "three pillars of observability" stopped being enough.
John Baek
I've been close to 19 cloud migrations in public sector and finance. Six finished on time, five never finished, eight in between. The eight had the same five things break in the same order.
John Baek
We swapped 47 long-lived AWS access keys for OIDC workload identity. Six months later the audit trail dropped from 47 lines per deploy to one. The six-step migration and the assumptions that broke along the way.
John Baek
We thought we'd save $48k a year by going self-hosted. We saved $11k. Here's where the other $37k went.
John Baek
Past the "shift left" slogan — what DevSecOps means in practice, where it fails, and how it changes shape in on-prem environments.
John Baek
We migrated four customers off Jenkins. Three went smoothly. The fourth took seven months. The difference wasn't the pipelines. It was the five things Jenkins kept hidden.
John Baek
Six months of writing a PEG parser because we couldn't accept the "almost the same" 80% of GitHub Actions expressions. What we cut, what we added, what it actually cost.
John Baek
Seventeen years, five distinct stages. What each one solved, what it left unsolved, and where we actually are now.
John Baek
The structural reasons tool integration keeps failing in on-prem environments — and why an execution layer matters more than another dashboard on top.
John Baek
