AWS Bahrain data loss, Gemini hacking incident, and new Claude Opus

This transcript was generated automatically and has not been fully reviewed. Timestamps are approximate and wording may contain errors.

00:07 Welcome to The Cloud Pod, where the forecast is always cloudy.

00:10 We talk weekly about all things AWS, GCP, and Azure. We are your hosts, Justin, Jonathan, Ryan, and Matt.

00:18 Episode 373, recorded for September 22nd, 2026. Raiders of the Lost Claude Artifact. Good evening, Matt. How you doing?

00:29 Oi, how about you?

00:31 I am sleepy. But, uh, but you know, we, we did a great job communicating with Ryan cuz we were like, we can record on Tuesday. And he's like, well, I can't really record on Tuesday or I can maybe record on Tuesday, Monday or Tuesday, but not Wednesday. And we read it as I can't record any day by Wednesday. So we moved it to Wednesday and then he didn't say anything. So here we are on Wednesday recording Tuesday show and he's not here. That's how we roll here with confusion and, uh, time and scheduling. As Matt and I both complain often in the background, like scheduling everyone is like scheduling cats and it's very difficult.

01:05 I describe it as there's 4 of us that work for 3 companies with 9 kids in 2 time zones.

01:12 I mean, that should have been the show title.

01:15 Trying to schedule it.

01:17 Try to— you try to schedule this. Yeah.

01:20 Everyone's like, it can't be hard to schedule. Cause I talked to my friends about it. I'm like, no, no, it really is. There's 4 of us. We all, you know, we travel for work. We got families, multiple time zones. It's just not easy.

01:31 No, it's not easy. Uh, but it used to just be me and then I would chase Peter and Jonathan and Ryan and, you know, be lucky if I got a single person to join. And so now at least you're consistently here with me. So that's helpful. So even if they're not available, we're like, we're still recording. Screw you guys.

01:49 We even have a whole Vault feature around it that nobody uses.

01:54 Yeah, I mean, I use it all the time. You do too, but, uh, yeah, yeah, no one else says yes or no they're gonna be there, so we just have to chase them down, which, yeah, that's how it works. Uh, I mean, we also, like, you and I have been doing a really good job adding our thoughts to episode, uh, show notes, so it goes out in our newsletter and it goes on the website as our blog. Uh, and like, I've enjoyed reading what you've put in there, uh, and I put a lot in there too, and, uh, they've done none. I think Ryan's one time actually. So there you go. Yeah, it's the way it works. That's all right.

02:21 We're trying.

02:22 They care. They just are busy just like we are. All right, we have a follow-up. So if you remember 6 months ago, gas prices were low, diesel prices, you know, not that much more expensive than unleaded gas. And now many, many months later, gas is like almost $9 a gallon for diesel here in California and everyone's complaining all because of a drone strike, or sorry, a war in Iran. that ended up hitting some AWS facilities in Bahrain and the UAE. And, uh, Amazon has updated us as of the 15th of September that customer data and resources in Bahrain region and the one UAE availability zone are permanently unrecoverable. So if you didn't get your data, it's not coming back. So, uh, Bahrain situation deteriorated further than initially reported. The second availability zone went down in April, taking the entire region offline, exceeding what the region's redundancy design could handle. and the UA impact is more contained, limited to just one of the AZs, with AWS continuing to recover work on the remaining two zones and shared regional infrastructure. And basically said the last official update they said was that it would take months to restore, and now they've officially said, nope, sorry, can't. It's gone forever. So I hope you have backups. I hope you have evacuated that region. And, you know, maybe when the war is over, those regions will get rebuilt and be fully back up and running, and you'll need to have a good DR plan.

03:39 I think it'll be more interesting if they just shut down the region at one point. Like, we've given up and walk away. Or, you know, it'd be an interesting use case of any of the cloud providers walking away from a region at one point.

03:52 I mean, I think there's too much money in those regions. I mean, Bahrain, I don't know, I don't know as many much about it, but like, you know, KSA, all the data center company, all the— everybody's building new regions in KSA right now because they want to go after the big oil money. UAE is a pretty big economic hub in the Middle East. To not have a region there, I think, would be a mistake. So I, I suspect that we will see these get rebuilt. I mean, Amazon is basically saying Bahrain, uh, won't come back up online till probably early 2027 at the earliest, but that's assuming regional conflicts, uh, get addressed in the area, which there's no hope in that at this moment, it feels like.

04:30 No. I mean, the cost of launching these regions has to be a lot. So, you know, I can definitely see them wanting to get their money out, but at some cost is at some cost at one point. I don't want to be around the table at Amazon or any of the cloud providers when they have to make that final decision on one of these regions.

04:52 Yeah, I mean, I think you, uh, California, US West 1, that region will be there forever until the last customer leaves, I think is how that'll work. And now that you're there, why would you ever leave? And although I imagine the hardware eventually has to die on these things, so you know, they have original, you know, M and C class instances, C3, C4, C5s, like how, I mean, I'm sure they're adding new, some new capacity to refresh. So when the old ones die, they have somewhere to go, I guess. 'Cause I mean, those hardware doesn't run forever, unfortunately.

05:23 I remember like 5 years ago they did a, they did a big refresh in US West 1. That I heard through the grapevine to like help with a lot of capacity issues and things like that. But I can't imagine it's like new instance types and stuff like that. But I haven't honestly checked in a long time because I don't feel like paying that 10% extra tax.

05:42 Yeah, I don't, I don't want to pay that either. I can go— when US West 2 is right there, why would I do that? All right, well, general news, uh, Gemini has gone rogue and hacked 3 companies. Apparently a third-party security cybersecurity test in May, Gemini used publicly available information to guess credentials and gain unauthorized authorized access to 3 real companies instead of test targets, and then stopped once it recognized the discrepancy. Google disclosed the incident only after the Wall Street Journal inquired and characterized the event as a mistaken identity rather than model misalignment, a framing that security experts have questioned. Testing firm Irregular reportedly left Gemini with unintended internet access during the evaluation, which was a contributing factor that allowed the model to interact with systems outside of the intended test environments. The incident raises questions about disclosure practices for AI safety events and how companies define misalignment when models take unauthorized autonomous actions, even if those actions are later self-corrected. Similar containment issues have reportedly occurred in testing models from Meta and OpenAI. And Anthropic has so far been sitting on their high horse that they haven't had these issues other than when they prompted an agent to do something. But I assume they're just next. The way these things are going right now, they'll be the next one to get hacked. Well, it's—

06:51 they're interesting because they're different issues. You know, OpenAI's was it found a zero-day bug in Artifactory. And then this is actually that they didn't configure the environment correctly. They left it with internet access. So like, Artifactory, sure, there's only so much you can deal with. You know, it's a third party, there's vulnerability. It did a good job in attacking and then self-coordinating across all of its agents to share that information, which is terrifying. So here, this is like a, you know, a sandbox misconfiguration, almost. So like, there is human error in a lot in these, in some of these things too, you know, should Artifactory have been accessible from the, you know, from the other one? Probably not, or should have been one way, I'm not sure. But, you know, when you're actually testing things, you probably realistically have to really harden them, go get somebody from NSA that built an offline network, you know, and go from there.

07:55 The question is, is this a regular company they call out here in this? Um, I'm pretty sure they're the same company that was involved in the OpenAI hack on Hugging Face. So I, I think maybe we should point at the testing firm because this is the second time I know they've been implicated in these type of issues. Maybe we just should refer, look at their, their controls and how they feel like doing it because they seem to have some bad practices that have caused nothing but grief for the AI companies.

08:20 They have a bunch of jobs.

08:23 I bet they do. And maybe insecurity.

08:27 Yeah.

08:27 So yeah, that's, that one's all a little, a little weird to me, but we'll see if, uh, it happens to Anthropic too. But you know, the fact that Gemini just came out, you know, after they were prompted by the Wall Street Journal, I do, I do think there should be disclosure practices, just like financial disclosure and breach disclosure. Like you should be disclosing these things, especially if you're gonna become publicly traded. I think this becomes a, a bigger issue, uh, for, you know, investor trust, public trust, etc. Um, so I do hope that they come up with something for disclosure at some point. All right. Claude, Cowork, and Chat are now becoming Claude. Uh, so basically they're getting rid of the distinction between Claude, Cowork, and Chat. This is interesting mostly because the way Cowork works is it runs basically an agent inside of your laptop where Chat is really just a two-way chat conversation back and forth with the model at Anthropic. For a long time, Cowork was way behind on many of the auditing capabilities, the hotel support, et cetera, was lacking there. But you know, for most power users, I think most of us have moved over to Cowork a long time ago 'cause it just gives you way more flexibility and you, you know, oh, I wanna add a document now to give you more context, or I wanted to tweak this a little bit, or I want you to create me a document or something. It can do that so much more effectively in Cowork than it can in Chat. So I think this makes sense that this is gonna happen. I assume They're going to use some smarts to make it decide when to use the local agent to do things versus when it's going to go out to Claude and ask directly from the model. Because there are, you know, it is more expensive to use an agent. You got to load the tools, you have to do more, more context usage, which, you know, maybe they do want because it costs more money to run. But I am glad to see it because I think it's been confusing for end users who aren't as technical to understand the differences between the two. And also the controls now could be simplified and standardized between the two.

10:09 Yeah, it just felt like an unnecessary distinction that they had, which I get why, like they were slowly building up, they were building up their security practices and everything else along those lines. But like you said, like, I guess I'm officially a power user in your eyes. You know, I moved over a long time ago and especially when they were running Cowork for like 50% promotion, it was the same thing with more power and I got more usage. I know I moved a couple other people over to that too, cuz you know, I saw what you saw. Oh, here's some files, here's some this, here's some that, point to these things. And it was able to kind of go a little bit more autonomously at it versus handholding along the way.

10:50 Yeah, I, I agree. I think it's a much more robust way to go. Well, now we don't have to argue about it anymore.

10:56 Ryan still has to deal with it, but we'll let him. He's not here to defend himself. Exactly.

11:01 Cloud Cod— Cloud Cod, that's a fish. Cloud Code now generates artifacts, live shareable web pages built from coding sessions, full context including codebase, connected tools, and conversation history, which is now in beta for Cloud Team Enterprise orgs. Artifacts auto-update in place as work progresses with each publish, creating a new version at the same URL, version history for rollback, and a gallery for browsing past artifacts. Common use cases highlighted is incident debugging, where an engineer can generate a page combining error logs, suspect commits, and error rate charts, and share one link that stays current as investigation continues. Access controls are org-scoped with artifacts are private by default, cannot be made public, and admins get role-based access control, retention policies, and compliance APIs. Available now via the Cloud Code CLI and desktop app. And I use it today, in fact, because I said, I need— give me a one-pager on this issue, and it created me a little artifact I kept up to date as I was making some changes to some cost savings stuff I'm using Claude for right now.

11:54 That's pretty cool. I haven't thought about using it in code, just so much of what my day job is, is more cowork-related, but doing a lot of the stuff that we do for BoltBot and things like that that, you know, Justin and I have talked about over time, I could definitely see it being useful because I've sent Justin snippets and be like, hey, what do you think about this? And he's like, oh, tweak these things. And Justin's really good at that last mile, I feel like, of making it be nice and pretty and usable. And I'm like, eh. Close enough. So this I definitely see using more over time.

12:26 Yeah, I, I think it's, it just going to be native way that it displays data. And I, I, yeah, I still hope that Claude eventually gets image generation capabilities, because it's one thing it really does still lack in. And some of these type— and some of these things are areas that it could do a good job, but it does such a good job on like other UI artifacts, like creating web pages, creating, you know, UI specifications. It can do all of that. It just doesn't generate an image and sometimes an image is all you really need. And so, uh, I always have to go back to ChatGPT. That's why I still have a subscription there to make images occasionally. Or Gemini is the other choice you can go to for that. And like, we have our cover generator for our fun covers. Uh, those are all AI generated because, uh, none of us are artistic here at the show. So, you know, but that's all done by AI and I can't use Anthropic for that. So I have to have different models and different providers to do that, which is It's very frustrating. I just wish I could have one that was really good, but, uh, I guess I could just use ChatGPT for everything, but nah, why do that?

13:23 I feel like over time though, like I don't want, I want my Claude code, I want Anthropic to focus on Claude code and CoWork and the next gen things. I don't know that I care as much. I don't want the provider to become an all-in-one printer where it does everything mediocre. You know, I want it to, you know, I don't mind that they haven't gone into that, that far yet. At least that's me. Like though, paying two people sucks, which I totally get.

13:54 So, um, if you remember just, uh, 10 days ago, you know, there was a big huff about, uh, you know, AI needing to slow down and that we're losing control of AI and that, you know, we need more slow. We talked about Bill Gates and he said we need to slow it and, you know, Anthropic and OpenAI said the same thing. And, you know, I took that, I took that to heart, you know, like, okay, good. You know, we're gonna have Claude Opus for a while, Opus 5, and we're gonna, you know, ChatGPT 6 will be around for a while and all will be fine. You know, these are, these are models are all pretty satisfactory, although I had some complaints around, uh, Opus 5. Uh, and then yesterday in the morning, Matt pings me and says, hey, they just released Opus 5.5. And I'm like, huh, that's weird. And then an hour later, OpenAI releases GPT-6 Sol and GPT Luna. And I'm like, hmm, doesn't really seem like slowing down now, does it?

14:50 So they're following the Gemini model. Let's see how fast we can release new models.

14:54 Yeah, but Gemini models, you know, basically evolve at a snail's pace. So even when they do major models, they're not really that much better. So yeah, so Anthropic Opus 5.5 is the first model in the 5.5 family matching Claude Fable 5.1 performance on most tasks. Now, if you remember, not too long ago, Fable was considered a national security threat along with Mythos. But now here it is. We have Opus 5.5 with Fable 5.1 performance at a cost of 40% less to run than Opus 5. They gave you a price cut. They're giving you $4 per million input tokens and $20 per million output tokens. It was $5 and $25 previously. And cache reads are now at 20 cents per million, which is 60% cheaper than Opus 5. And output generation is over 30% faster on this. So I mean, like, they're giving you Opus 5.5, has Fable 5.1 capacity and capability apparently, and they're giving you a small discount for a better model. So that's all positive, which is pretty cool. This also falls into coding benchmarks, which show substantial efficiency gains. One tester completed a 680,000-line code migration under a day, and an audit of the 200,000-line codebase took under 3 hours versus the over 20 hours for Opus 5. By using 2.5 times fewer tokens. On Frontier code, GPT-5.5 beat GPT-6 Astra at roughly 20% of the cost per task. And the model ships with expanded safety infrastructure, including an automated behavioral audit across nearly 2,000 scenarios, a classifier screening every agent action before execution, and an auditable open-source sandbox, and an 85% reduction in attempts to circumvent containment boundaries compared to Opus 5 and Claude Mythos 5.1. Due to strong biology and cybersecurity capabilities comparable to Claude Mythos 5.1, Opus 5.5 deploys with safeguards similar to Fable 5.1, routing most cybersecurity attacks to Opus 4.8 by default, with vetted access available through the Life Sciences Verification Program and expanded Cyber Verification Program. Opus 5.5 is generally available now across AWS, Google Cloud, and Microsoft Azure, as well as Snowflake and many other providers. We all had multiple press releases that we have gracefully stripped from the show, so you don't have to talk about each one of them. And bore Matt to death.

16:56 I just didn't want to blow out the listener's eardrums with the clapping sound effects.

17:00 Yeah, I'm sure they appreciate it.

17:02 Yeah. You still do it with the horn, but that's fine. I mean, I don't know about you, but I've definitely done a decent amount of stuff with Opus 5.5, and I find it a lot better than 5.1, 5.0. I used to go up to Fable for more complicated things, and I don't think I've had to move up to Fable at all in the last 2 days. I still do have my security reviews done by Fabric, but I don't know that I need that anymore, especially with this. So, and I barely touch my tokens, I feel like. So I definitely feel like there's been a lot of under the, under the covers improvements behind the scenes. I was going to say under the scenes, but you know, that didn't feel right. Um, improvements there that help a lot. So, you know, I'm grateful for it and I don't know about your experience thus far, Justin.

17:52 Oh, it's been great. So I, I was getting real, real tired of Opus 5. It was very wordy. It was like, oh, I'm sorry, I've made the same mistake 3 times that a test couldn't have caught, that only the live production could have caught. I'm like, shut up. I don't care. Like, I don't need all this justification. Just acknowledge you fucked up or not. I don't care. And just let's make it work. And so the new 5.5 is much more Justin, uh, style. It's very succinct, it's very to the point, it doesn't dilly-dally. And while it doesn't— it still has a little bit of the problem that 5 did where like you'll tell it to do 4 things and it'll do 3 things and then be like, I did all the things you wanted. You're like, cool. Then like, wait, where's the 4th thing? It's like, oh right, I'm sorry about that, I actually didn't do the 4th thing. Like, but you just told me you did. Uh, it has a little less of that where it actually now reminded me like, hey, I Just remind you, I only done 3 of the 4 things. You want me to finish that 4th one now? I'm like, okay, that's a little better. I wish you'd just do the 4 things I asked you to do. But, uh, you know, here we are.

18:51 I started with probably, it must have been around 5 without me realizing now that you're saying it is a lot of times when I have it, you know, here's a list of my brain dump and I'll be like, split this up into tasks and go forth and do it. A lot of times we'll say, build me a table and update it every 2 minutes on the status of it. So I can see where it's at, mainly cuz I have slight ADD and I'm like, ooh, shiny object over here. Let me go back to this. And I don't remember where it was. So at least that gives it to me. So hopefully I don't have to do that as much now, but it's kind of part of my workflow because of, you know, the way 5.1 just blatantly missed stuff.

19:30 Yeah, it was, it was bad. It was annoying. Uh, so yeah, much better, much more succinct. I've gotten a lot done this week. Because I'm not reading through all this text that I don't care about anymore, which is great. So overall, I'm very pleased with the Opus 5 RAG. But, you know, but I'm also very happy with GLM 3.5.3. I'm still, I'm like, all of the work on Bolt and on, on my other bot for the other Slack room is all done in Ollama. I don't use Claude as much on my, my barbecue website. I use the, you know, Claude models all the time and it's doing a good job over there too. So I mean, it's, it's a good mix of things.

20:06 So I only drop down to a Llama when I start to run low on credits. So like last night when I was working on a couple features on Vault, I had to drop down and leave the reviews back in Claude. But I really haven't had that issue in a little while. But I also know I've been traveling for work and personal and my AI usage has been low the last couple weeks.

20:28 Yeah. You only wish it would just like, you know, your daily limit would just like stack. So when you're back, you could just like crush a bunch of stuff. Great.

20:34 I know it'd be great. Yeah.

20:36 I need rollover, I need rollover AI tokens.

20:39 Rollover minutes. I forgot about those.

20:41 Exactly. So I mentioned there was also new models from OpenAI. Uh, this is the GPT-6 Sol and Luna joining the Oster family. These two lower cost tiers alongside the previously announced Oster flagship model target cost sensitive workflows like coding agents and business automation. API pricing for Sol and Luna dropped 50% compared to GPT-5.6 promotional pricing. With GPT-6 Sol repeatedly beating Claude Opus 5 on Automation Bench at just 9% of the cost per task, and Agent LLMs Exam at 60% lower cost per task. On coding benchmarks, GPT-6 Sol scored 68.8 on DeepSWE version 1.1, with 1.1 points off Claude Fable 5's top score, at approximately 80% lower cost per task, and matched Claude's Fable 5.1 on Frontier Code at reduced cost. There's improved prompt caching now delivering a 90% discount on cached input token reads, with GitHub reporting a 50% reduction in prompt tokens requiring fresh processing across billions of Copilot requests, improving overall response latency. Factually improved notably with GPT-6 Sol cutting error rates roughly in half versus predecessor and GPT-6 Luna at higher effort levels matching GPT-5.6 Sol's factuality at about 1/100th the cost. Available today in ChatGPT Work and Codex for Plus, Pro, Business, Enterprise, and Education tiers. With Luna also reaching Free and Go users in the desktop app. So that's a pretty nice improvement. So yeah, yeah, basically this completes the GPT-6 family. So their equivalent of Haiku, Claude, and Sonnet. And we are now going to the next one. I'm sure after this, which would be probably GPT-6.5 or 7 sometime in probably about 2 weeks.

22:17 Yeah.

22:18 Based on the track record, you know.

22:19 We'll be talking about it soon. Though Haiku hasn't been updated in 4.5. I just realized now that you said it.

22:25 Haiku, they said, So actually in the announcement for Opus 5.5, they did say Sonnet 5.5 and Claude Haiku 5.5 are coming in the next few weeks.

22:34 Oh, okay.

22:35 Which will carry similar performance and efficiency improvements. So yeah, it has been a while since we've seen a new Haiku, but they did promise one is coming very soon.

22:42 I just assumed they were killing it and trying to make Sonnet the low-end model at this point, but I guess not. I missed that in the announcement.

22:49 I don't think they want to kill it because it does do a lot of good, really good work. It just needs more it, it does good work if you give it very firm instructions. So like one of the things I do a lot of subagents, I think you've moved into subagents now, but you know, the reason why I use Fable or using, um, Opus at the top level is it does my command tier and everything I have it do is actually with subagents that it either kicks off with Haiku because it, it's compartmentalized the work into small enough tasks that Haiku can handle it, or it puts it into Sonnet where it does it and then it just does all the QA at its level. And that's how I'm able to, you know, move around pretty quickly between a bunch of different projects and things, uh, by being able to use subagents and that model.

23:26 That's pretty much what my model is. We've talked about for a while having our, hey, how are we doing our AI DLC? Uh, you know, of what we, we are doing and we should definitely have a follow-up on that, whether it's an after show or a dedicated episode.

23:43 Yeah, we should definitely do a dedicated show for it. And we try to get some more people too, like, uh, I've got a, you know, Jonathan of course is really big on his, um, you know, his local models and using his own GPUs. I know somebody else who's building a router to do kind of a similar thing. You know, we could maybe get a couple other people on who have more QA background, et cetera. So there's lots of opportunities for us to kind of bring a couple different dimensions of this conversation, cuz I think everyone's sort of on different places in the journey. Um, and the journey's really interesting.

24:13 When you do it. Yeah. So, because I know for a while I wasn't doing it and now I have like a standard slash command that solves 80% of my problems. I use, I'm really original with my naming. I call it /ship and just spins off my workflow and what I need to do. And I actually have it at like my, my root level and then it funnels into every project and then projects I work on more on, I have specific ones. But yeah, we should definitely need to get that scheduled.

24:42 Agreed. All right, moving on to AWS. AWS Step Functions are now automatically adding SDK integrations for new AWS services within weeks of release, eliminating the wait for manual updates that customers previously experienced. The first integration includes AWS Lambda microVMs and Lambda Core, which let developers orchestrate adjunctic workflows using isolated secure execution environments for individual agent tasks without writing custom coordination code. Built-in features include automatic retries for failed environment starts, parallel task execution via Step Functions parallel or map states, and automatic termination of microVM environments once tasks complete. Lambda Core handles private networking configuration, allowing microVM environments to securely connect to internal databases or APIs in the same workflow. Additional integrations announced include AWS Partner Central revenue measurement, AWS Resilience Hub v2, AWS Support Authorization, and Amazon SageMaker Job Runtime. And AWS will stop, will keep posting new what's new posts for future SDK integration updates as they roll out. So keep an eye on those if needed.

25:42 I like how they kind of refactored it and made it just be default versus custom.

25:47 Yeah.

25:48 Integrations for each of these things. So they really abstracted out, 'cause for the longest time, Step Functions, while I loved, and I think, you know, you loved and Ryan loved, it was great at just orchestrating like Python scripts. Is kind of where the way I used it. And having it, you know, you, there was times I was like, okay, write a Python script that does this thing that then goes here and does these things. You know, that really was just kicking off like other Amazon services that it wasn't able to do. So I think it's really great that they're integrating everything so that it's not, you know, Lambda spackle in the middle of everything.

26:22 Yeah, agreed. Definitely nice to take away some unnecessary toil for sure.

26:27 Okay, we definitely need to start doing our show titles at the end. AWS Step Functions finally gets rid of Lambda spackle.

26:34 I don't know if it gets completely rid of Lambda spackle, so, but yeah, I get it. AWS is rolling out a simplified account creation flow targeting fast-moving builders and AI-assisted development, letting users sign up with Google, GitHub, or Apple credentials and skip credit card entry with $100 in free credits included. The new experience distracts away IAM setup entirely. Team members are invited by email with automatically scoped project permissions. Remove the need to configure users, roles, or policies manually. Coding agents are a core part of the workflow. After signup, users get a prompt to paste to their agent, which configures the AWS CLI and agent toolkit for AWS, and then can deploy resources like Lambda, DynamoDB, and API Gateway with permissions handled automatically. Spending is controlled via per-project monthly limits starting at $20, with usage-based billing up to that cap and automatic pausing if a limit is reached, giving predictable cost control for early-stage projects. Users aren't locked into the simplified tier long-term with advanced AWS features like multi-region support and AWS organization policies can be activated later at no extra costs. So yeah, if you're a developer and you need someplace to run your shiny new agent and you were like, oh, setting up AWS and VPCs and IAM is a pain in the butt, this service is for you to make it the easy road onto cloud. And then please call Matt or I at SaaSleven to help you fix this problem when you need assistance. 'Cause once you need to scale out of this sandbox, you might need some help and we can help you.

27:57 It's like we've done this a few times.

28:00 Just a few, just a few.

28:01 It's a great on-ramp. I get where they're going. They're trying to get people on their cloud early on, get rid of any complexity of the cloud. It's interesting to me that they call them projects 'cause I hear projects and I think GCP, but maybe that's just me. So I get where they're going with it, And why, but it feels like what I would have expected like Lightsail more to be back in the day, which was like your come on and then use that as a way off, but people got stuck on it. And I'm afraid people are just going to get stuck in this like limbo state and then migrating production workloads always is a pain in the butt. So how do you do that? When do you do it? Do you have to, do you do this just for your POC and then move afterwards once you have real customers on it or vice versa? So I like what they're doing. I get why they're doing it. I'll be talking to you soon.

28:51 Yeah, exactly. Uh, well, Amazon's largest and most popular service has a new cluster mode, and that would be Beanstalk. Elastic Beanstalk cluster mode lets teams run multiple applications on shared EKS infrastructure with single operational baseline, reducing per-application costs as your portfolio grows. Is aimed at teams managing many apps rather than single application deployments. Supports source code in Java, .NET, Python, Node.js, PHP, Ruby, or Go with automatic containerization via cloud-native buildpacks. So no Dockerfile or re-architecting is required for legacy or new applications. New capabilities include AI-powered health diagnostics and troubleshooting recommendations, OTEL-based observability, traffic-splitting deployments with automatic rollback, event-driven autoscaling, and built-in compliance with HIPAA, PCI DSS, and SOC 1, 2, and 3. Standard mode, which is EC2-based, remains supported and runs alongside cluster mode within the same application. On gradual migration, standard is still recommended for single applications, Windows/.NET IIS workloads, or spend under $500 a month where EKS overhead isn't offset. No additional charge for the cluster itself, but customers pay for underlying resources, including the EKS control plane fee, EKS Auto Mode compute, ECR, and CloudWatch, not eligible for the AWS Free Tier and available now in all regions where Beanstalk operates.

30:07 So it's managed EKS with managed worker nodes with just another abstraction layer for developers just to say, here's my stuff, go run it for me. That's kind of what it is at this point. Like, it's another way to run containers on AWS. I get it. I don't mind it. Good luck debugging this. This will suck at one point in the future.

30:36 Yeah. And again, you'll need experts like us to help you unstuck this. I mean, it is, if you have a relatively an application that fits into Beanstalk quite nicely, I can see the benefit. I can see the value, but as soon as you get outside of the sandbox or you need more advanced features, I think you run into a lot of sharp edges very quickly. But the fact that it's moving away from native EC2 to EKS-based I think that's just a reflection of the fact that, you know, containerization is the future of software development. It's very clear at this point that microservices have won, are not going back other than some very specific workloads. And so I think, you know, this being more EKS-driven, I think is a nice improvement and makes me more interested in Beanstalk actually, to be honest, even though I don't really want to use it. But if I needed a containerized workload, I just want to focus on shipping quickly. I think this is really interesting and I can see between this and some of the other announcements they're doing around the rapid onboarding, how, you know, these lead to probably some very interesting re:Invent announcements.

31:31 Yes. And I kind of, like you said, want to play with this. I have a couple, you know, old customers that I keep in touch with that run Beanstalk. They're small apps. Look, it makes sense for them. And this could save them money because right now they're running 3, 4 Load Balancers because that's the way it works with different front ends, you know, for all of them, even though they don't really need it. And this would get rid of some of that overhead that they have. So, you know, it is nice for small and medium. I think it might save some money, but, you know, they do call out there might be a premium depending on how, what you have set up.

32:09 Agreed. Well, if you are a longtime listener, you might have remembered the episode 342, 8 Minutes to Midnight, when AI helps hackers speedrun your AWS account. We discussed new images, the C8id, M8id, and R8id. And we don't really talk about new images, you know, instance types as much just because there are so many of them now and they're typically very GPU heavy. And so we aren't really talking about it as much as we used to. But you know, one of the things that we talked about was how old the T3 was and that, you know, the T4g had moved to Graviton2, but that hasn't really been updated either. And we were saying, You know, so the, the quote was that T-Series was a great idea that never got the investment because it never caught on the way AWS probably hoped it would. And then, uh, magically today we got new T8i burstable instances, uh, delivering up to 30% better price performance and up to 70% higher compute performance with the previous generation T3 instances, powered by custom 6th Gen Intel Xeon Granite Rapids processors on the AWS Nitro cards. Uh, migration from T3 is straightforward since T8i retains the same CPU credit system, standard and unlimited mode options. And vCPU to memory ratios are the same. And I adopted it this morning. So I rolled it out for our bots. So Vault now runs on top of the T8i. I was doing, been doing some refactoring, like I said earlier, to reduce some costs. 'Cause you know, you have an AWS account and you just keep throwing stuff into it and then next thing you know, your bill's $300 or $400 and you're like, that's a lot for a hobby project. I should probably bring that down. So that's what I've been doing, bringing that back into order. And so I was doing my analysis, it was like, well, you have this box, and, uh, you could do this or that. And I was like, well, what if you moved it to the new T? And I was like, oh, that's a great idea. You could save some money and do it this way. So yeah, that's what I did. And it's working great. Uh, and Boltz is not stateful, so it can be replaced at any time with Spot instances. So it's just a great little choice for me to use until all of you guys learn about it and start using all those Spot instance capacity. But for now, I'm very happy with this.

34:05 I mean, I always thought the T instance family was undervalued. I understand people always worried about the credits and everything along those lines, but if you knew your workload, you could get a lot of value out of the T with relatively low costs, you know, because you were handling that burst, you were leveraging it. And if you put some additional monitoring on, especially once they had like the credits and everything else, you, you could get notified and scale, you know, differently than you normally would if you were not on them. But originally even within Amazon, people were like, these aren't for production. And then I remember at one point I was talking with the t-Instants family and they were like, no, no, these are meant for production workloads. We all have these small little things that, you know, running for our organizations that they're great for. And I just think everyone looks at them and goes, oh no, no, no, no, we can't do them. It's too scary. And I truly think they have a lot of value.

35:00 I agree. So glad to see it. Definitely take a look at it for your workloads. I think it is very interesting and does give you some options over the Flex because the M8i Flex is also available to you as well. But those get pretty big. So new tunnel endpoint type for PrivateLink lets customers share entire CIDR ranges instead of creating individual resource configurations for each resource, simplifying vendor access to multi-resource networking segments. Using the GENEVE encapsulation to tunnel across VPC and account boundaries within shared, uh, sharing managed through the AWS Resource Access Manager. Addresses a common pain point for enterprises working with external vendors or partners who need access to multiple resources within a defined network range, rather than one-off endpoint configurations. Pricing follows standard PrivateLink model with hourly charge for tunnel endpoint plus per gigabyte data processing fees.

35:48 I like the idea. I really hate RAM, as we talked about last week. That's all I got.

35:54 But again, like some, if they make RAM better and they keep improving it, it solves a real issue. So I mean, I still hate SSM, but there are some really nice SSM features that I love. So yeah, if RAM can get a couple features that I like quite a bit, then you know, I'm not so upset about it. But it's still very awkward to use.

36:09 Yeah, it's just, you know, awkward orchestration, everything along those lines. I think it's great that you can share this, you know, if you have a VPC that you use just for, you know, entry point into stuff, So you're not really worried about, you know, security and accidentally exposing, you know, your database or anything else from one to the other, then great. But use it carefully still, is I guess my point. Agreed.

36:34 Amazon ECS will now show you real-time deployment observability directly in the console, consolidating timeline tracking, health signals, and troubleshooting for linear, canary, and blue/green deployment strategies into a single view. Live deployment timeline displays traffic shift distribution between source and target revisions, current lifecycle stages, and task launch termination progress as it happens. Health monitoring data that previously required checking multiple tools is now centralized with Circuit Breaker status, deployment alarm state, container and Load Balancer health checks, and lifecycle hook status will appear alongside the timeline. Or you troubleshoot it like I do with The Cloud Pod and realize the website's down and has been down for 3 days.

37:08 I just tell Claude to go tell me what the status is.

37:11 I mean, I've been doing that too. Yeah, just Claude, watch this deployment, make sure the container starts up and that everything's working the way we expect it to. Uh, and that Prometheus works pretty well as well.

37:19 I mean, it's nice that they're adding it. I haven't played with it that much yet. Honestly, I don't plan to, because like you said, and I said, I just use the CLI and it gives me all the information I need.

37:29 Or you just look at the container log. That's what I typically watch and I see, and my container starts up or it fails, and then it sends up another container and does the same thing. And so it becomes pretty clear that my container is broken if I watch the console. So, but it is nice. I mean, when I have had to do that, it is nice. When you're like, what's happening? And you had to go click between CloudWatch consoles or turn on Advanced Container Insights, which is super expensive just to look at basic things. This is—

37:53 I've made that mistake.

37:54 This is nice to have this available to you. Yeah. Also enhanced EC2 monitoring. That's another one. Don't do that one.

38:02 Yeah.

38:03 That one's expensive as well.

38:05 I don't remember when they released that, but the tailing of CloudWatch logs is really nice. Especially 'cause if you do it on the CLI, it's fantastic.

38:13 Well, and you can highlight keywords like I'm looking for this word and it'll highlight a different color in the tailing log. That's super handy. Yeah.

38:20 So I've never done the tailing log in the UI. I've only done in the CLI.

38:24 Oh, in the UI it's actually quite nice. It has a, has the ability for you to select multiple log groups and then you can select, I wanna look for this. So if you have like 3 or 4 log groups for like a transaction across 4 systems and you have transaction ID, you can basically put in a transaction ID and it'll highlight across the logs as the data transfers through the Event Hub. So it's, it's kind of nice.

38:44 Oh, that's cool.

38:45 Yeah, I also use the CLI for the tailing as well, which is also great. So very helpful.

38:50 Definitely look it up for BoltBot.

38:52 Oh yeah, it's nice for Bolt to see what's going on. Moving on to GCP, Borderless Lakehouse Cross-Cloud Caching and Connections is now in preview. It's a borderless lakehouse letting BigQuery cache frequently accessed Iceberg data locally, so repeat queries against S3 or ADLS retransferring data across the cloud, which is bad for sustainability reasons. There's an example in the post showing a follow-on query hitting a 94.8% cache rate, pulling only 1.33 gigabytes from S3 instead of re— rereading the full dataset. Caching works at sub-file block granularity, pulling only the specific Parquet column chunks a query needs rather than the whole file, and the cache entries are encrypted at rest with GMAK and isolated by project, catalog, and region for compliance purposes. Combined with standard Iceberg ZSD compression, Google estimates organizations may need to transfer under 3% of total data processed across clouds, which roughly reduces partner across-cloud interconnect transfer costs at large scales. So that's nice. And this, this feature is already great, but you still had to do some data transfer across. So being able to cache it in Google from the data sources that are remote is a nice kind of middle ground. So you don't have to move everything, but you can just move the cached data over.

40:01 Yeah, definitely will save you all those EKS fees, all the compute fees. Cache is one of those things that people never, I feel like, think about until they need it and then they realize how amazingly beneficial it is.

40:13 Exactly. You don't know you need it until you need it, but then it's amazing. Google's multi-cluster GK inference gateway pools accelerator capacity across regions into a single logical endpoint addressing GPU TPU scarcity by letting teams use whatever capacity is available across data centers rather than being limited to one cluster. Our next layer includes global routing with memory-aware scheduling, using KV cache tokenization as the routing signal instead of traditional round robin, so traffic shifts to healthy regions once a cluster crosses a 40% utilization threshold. Benchmarks on a 17,000-node deployment across 3 regions showed less than 1% routing overhead and 99.5% of direct local cluster throughput, plus near-linear throughput scaling with a 99.9% success rate as clusters were added. System integrates with Kubernetes constructs like leader-worker set to correctly route to leader pods and distributed inference topologies. Avoiding the need for custom proxy infrastructure for multi-node model serving. And this is all cool. And if you need to do large-scale model hosting, like, this is a neat, uh, solution and value. I've been looking at some architectures that have this type of setup, and, uh, it's pretty impressive how much Kubernetes is able to help support these workloads. You know, we, we mock it a lot for all the complexity at bay, but the fact that, you know, you can have all these GPUs and all these Kubernetes nodes, you can use this capability to then inference across them through via Gateway and not have to actually address them locally. There's just so much benefit here at pretty low latencies, which is impressive.

41:36 Well, yeah, I assume you're just leveraging the backend of Google, which is why, but that's part of it.

41:41 Yes.

41:43 I mean, Azure tried to do this with the global, um, I mean, theirs was more the next level up on the model level, you know, where you, they essentially had a global, like, you know, let's just say, you know, Opus 5.5, you know, lives in their global zone and then you would, it would route to wherever they had GPUs or TPUs. So you didn't know if your query was starting, you know, in the US and ending up in, you know, Australia or, you know, the UK. It just was wherever they had capacity for it, which brought into a whole compliance nightmare if you ever use that. But with that being said, this is down a level, which is very nice, where if you are training and doing stuff like that, you don't have to deal with it.

42:27 The Google Cloud Secure Source Manager adds two general available features aimed at reducing supply chain risk, coming as Wiz reports supply chain attacks more than doubled in first half of 2026 versus the second half of 2025. Network-level access controls now block unauthorized access to CI/CD systems, version control, build tools, and artifact storage, even if the corporate network is compromised, addressing scenarios where attackers alter deployment scripts to inject malware. The new code owner system provides granular pull request approval requirements at the per-file and per-branch level, including glob-style path matching, branch-specific rules without merge conflicts, nestable code owner files for sub-team ownership, and independent multi-department sign-off sections. Using a section name syntax. A new Developer Connect integration like SSM to Cloud Build via private Service Connect keeps repositories, build pools, and artifact storage inside a private network, with VPC service controls adding defense in depth for proxy endpoints. Practical next steps for listeners include following Google's Private Network Integrations Guide to set up private CI/CD blueprint and creating a root code owners file to replace broader IAM approver roles with file-specific ownership controls. So yeah, if you haven't checked out some of these capabilities that are available to you in Code Owners and what you can do in access controls for IAM, Um, this is a great white paper to go read the blueprint, understand how Google suggests you do it, and then apply it to your infrastructure that'll improve your security dramatically.

43:44 Yeah, they definitely have dramatically expanded the Code Owner's file, you know, which is great because I think it's important that people actually review stuff and, you know, you don't really want, you know, a random developer reviewing, you know, your security, you know, packages or anything else like that that you're pulling in. So, I think it's great that they continue to expand upon it in different ways. I think the interesting part for me isn't just, you know, because I don't use Google Cloud on a daily basis, but is the fact that supply chain attacks, which honestly makes perfect sense, is up so high. And it really just shows you that it's not just patching. We talked a week or two ago, I can't keep track of it, where like Microsoft had like, what, 900 vulnerabilities this month. You know, it's not just the OS level, it's every package you have on top of it. And every one of these attacks, you know, into all these different systems all need to be patched. So I pour one out to every sysadmin and every person out there that is perpetually fighting these games, because I have been one of them before, but it just really shows how important all that is. And even within your software development, making sure that every package, every library, I saw Pi-Hole, somebody's like, what updated? I didn't see any release notes. And the release notes came out after, 'cause it was 4 high vulnerabilities that they fixed. I think it was like today or yesterday in Pi-Hole, you know? So keeping all that updated too, you know, and it, for the, for the developer really becomes more and more important too.

45:12 Agree. Moving on to Azure, there's 3 stories for Foundry. We'll combine them together 'cause otherwise Well, I talked about Foundry 3 times and no one needs that here. First up, you can now publish Foundry agents to Microsoft 365 Copilot and Teams. This allows you to eliminate the need for building separate deployment pipelines, bot registrations, and app manifests that were previously required. Feature addresses the distribution gap with agents built in Foundry previously had no native path to reach end users within the Microsoft 365 apps they already use daily, right? There was a way you'd have to create a Teams bot and it was a big pain, so This is much improved. They also provide you network egress controls for hosted agents in public preview, letting customers govern outbound connections via ordered rules, match on destination host or fully qualified domain names, including wildcard support like *.contoso.com. Enforcement happens inside the Foundry managed agent sandbox where traffic leaves the runtime, so basic allow listing doesn't require a separate network appliance, simplifies deployment for the agent. And finally, you can now enable and disable controls within the agent 365 governance surface in Microsoft Admin Center. Allowing admins to manage agent availability without needing developer involvement. This brings Foundry agents into the same governance framework as other agent types in Admin Center, giving IT and security teams a consistent way to manage the full agent estate and meet the compliance requirements.

46:29 All great improvements. I get kind of where they're going with it, you know, whether they're adding the more controls, direct integration, leveraging Azure Firewall is clearly what they're doing there because they've added that feature a few weeks ago. In there, or a few months ago, can't keep track of life anymore, with the wildcard egress, you know, for FQDN. So it's great to see Microsoft actually building on their own tools and giving administrators the ability to actually control them.

46:57 Yeah, that's nice. I mean, there's, there's also lots of interesting things too, like there's more and more parts of Microsoft Copilot 365 that are moving into like GitHub Copilot and into Foundry. So To bring governance back to Microsoft 365 makes sense for the runtime, but the building places is not going to necessarily be inside of the Microsoft 365 Copilot application anymore. It's going to move, it's going to distribute out into Foundry or into GitHub. So that's, that's interesting. You can even, you can still do it the old way, but they actually hide it in a message like build agent other way now in Microsoft 365 Copilot. So they're definitely clearly moving you towards the things that cost more money. but also are more feature complete. So it's a, a curse and a blessing at the same time. Azure has released a feature that AWS doesn't actually have. GCP does, but AWS doesn't. The Azure Application Gateway now supports HTTP/3 over QUIC in public preview, aimed at reducing connection setup time and latency for web apps, APIs, and mobile experiences. This is by changing the way the TCP handshake occurs on your HTTP/3 request versus the TCP handshake based HTTP/2 connections because it is UDP-based. Configuration happens at the listener level, giving customers granular control to enable HTTP/3 selectively on basic listeners rather than the gateway-wide. During preview, setup is available through the Azure portal or REST API. They have no pricing details in this announcement, but I assume it's going to be relatively free or maybe a slightly higher CPU cost.

48:26 No, if anything, it's slower because it's UDP and they don't need to track all the sessions. So it should reduce your CPU and memory utilization. On the application gateway.

48:35 That's what you'd think, but it doesn't mean they're going to.

48:38 So it was when they enabled HTTP/2 before.

48:42 It was. Okay, that's good.

48:44 I don't think there was a price for it, but I know when we enabled it, we saw a drop on our memory and CPU utilization on our app gateways. And that also was with the help of Azure too, looking at some backend metrics.

49:00 Now I think about it.

49:02 Yeah. You know, it's a great thing AWS does have it on the Network Load Balancer and CloudFront. They just don't have it on the ALBs yet from our pre-show research that we did. So I find it interesting that they're slowly adding it, but I assume it will be on the ALBs soon.

49:18 Yeah. I mean, the Network Load Balancer makes sense because it's, it's targeted at UDP. The challenge with the ALB is it's very heavily focused on HTTP and TCP, and it does support up through HTTP/2, but if you know, it doesn't natively support UDP, it does sort of limit their capabilities. But again, this might be a great re:Invent announcement. I'm probably not a main stage re:Invent announcement. It's not good for predictions, but in the network roadmap, yeah, 100%. Or State of the Union for networking. I could see it there.

49:44 I was just saying I could see it getting dropped the week before.

49:47 That too. One of those things. And in terrible naming of the week, Azure Policy custom policy versioning is now available. I don't know what this does and I don't really care, but You use policy twice. That's just bad form, Azure.

50:03 So this Azure Policy is like the best way to describe it is like SCPs.

50:08 Okay.

50:08 So now you can actually version them and roll them out. It's like, I get what it is. It is good, terrible way to describe it.

50:15 Yeah.

50:16 We're gonna give you Azure Policy custom policy versioning.

50:18 Like what? Yeah.

50:20 It just makes no sense. I mean, nice to have it, glad it's there and glad to see they're catching up on some of the other features that others have.

50:27 Does AWS support versioning for SCPs?

50:30 I believe it does, yes. I'm doing a real-time follow-up here. Do, do, do, do, do. Oh no, it does not have a built-in native versioning or history system, but you can, you know, it's all infrastructure as code through Terraform. So I guess that's what I was thinking.

50:42 You can do that with AWS policy or Azure policies too. So, but this is a little bit more native, which is useful when you, you know, somebody's broken something and you're trying to figure out what happened.

50:52 I do have to say that, The fact that Amazon has now still rolling the policy syntax version, October 17th, 2012, and that's still the policy that's gone that long. That's an impressive track record on that policy. Like I kept expecting that someday that would get updated and it's just never been updated. And the worst part is you have to declare it in all these places. So it's not like it's something you could ignore because it's required in all the templates. But that's been around for a long time. Sorry.

51:18 There was a few before then, I thought. Like there was like a 2010.

51:22 Maybe there was. I, I only remember that one because it's the one I've always typed into CloudFormation and into other coding things.

51:28 So I feel like I saw at one point there was an older one, but maybe it was like for a specific service.

51:35 I mean, that would sort of make sense. It's just really the way that the JSON is formatted, correct?

51:41 I think so. I'm trying to see if there's an older version.

51:45 I'm asking as well. You get syntax errors if you try to put something else. There was a 10.17.2008 version.

51:53 Hmm. That's one. Told you it was 2010. Yeah. And a 10.9— 10.9.9. It looks like there's another one on. Oh no, it was just in the example.

52:03 It was, uh, it doesn't support policy variables and it was loose syntax validation. And the 2012 added the ability for policy variables and strict syntax validation. Yeah, it, it bad naming on that, I think too, because people see 2012 and they think, oh, this must be out of date. And it's like, nope, nope, that's current.

52:22 I remember when I first used AWS, I was like, oh, let me set this to today's date so I know when I last changed it. And I made that mistake and it errored out. And then I learned that this was not what I thought it was.

52:34 Yeah, exactly. Well, Cloudflare Workers have gotten a pretty big update this week. If you don't want to write JavaScript, TypeScript, or a WebAssembly language, uh, built on Rust, C, or C++, you can now finally use Python, which now makes CloudFront Workers something I actually want to use. Uh, they now treat Python as a first-class language alongside TypeScript on their worker platform with native support for bindings like R2D1 durable objects and queues without requiring JavaScript glue code. Popular Python frameworks include FastAPI, Django, and Flask now run directly in Workers by ASGI/WSGI connectors. Lambda developers use familiar tools while CloudFront's network handles scaling instead of requiring a traditional server like uvcorn or junicorn. DevOps connectivity was previously a limitation since WebAssembly sandboxes block POSIX socket calls, but CloudFront implemented custom socket syscalls using Connect API, enabling drivers like aio-mysql and asyncio to work with Hyper-Drive for PostgreSQL and MySQL access. Cloudflare has proposed the PEP-783 to standardize PyEmscripten as a platform for Python in browser runtimes, which was accepted after a year of community discussion. Aiming to let package maintainers build WebAssembly-compatible wheels that work across multiple platforms, not just Cloudflare Workers. So thanks. I'm looking forward to trying this one out.

53:49 It seems like a great feature to add and to have, you know, the ability. I would not have done it on Node.js. So I now have another tool in my belt if I need to ever do something like this. But I weirdly just stick with CloudFront. It works well enough for me.

54:04 Yeah. And there, there are a lot of benefits of Cloudflare for like DDoS and WAF protections. They're much more full-featured, I think, than Amazon's are. And so I typically use those and, you know, honestly, I've never really had a great use case for Lambda at the edge or Python Cloud Edge Workers, uh, through Cloudflare. But you know, the fact that it's available and there's more options, you know, maybe I do want it someday now that I can write it in Python and not have to write it in JavaScript.

54:29 I've, I've really only done it for like authentication type stuff, like quick authentication or blocking like IP addresses.

54:37 You know, validation of headers is one that I've used it for, or for like route rerouting people to different locations. Like, oh, you're actually coming from Europe, you should get routed to the European zone. Like there are some redirect rules you can do in Edge. So like those are things I've used it for, but yeah, I haven't had anything super sophisticated.

54:53 Yeah, that's really about it. I mean, I saw like When it first came out, people were like, oh, you know, you can do all these really cool things. And I just never saw a real world use case for those things.

55:03 I think it's definitely a frontend thing, cuz it's, it's, it really lets you kind of manipulate things via the DOM inside the web browser quickly. And so that's where I think it has some value to people, but that I don't understand cuz I don't do frontend. So, uh, if I was a frontend developer, I'm sure I'd understand this better. Cloudflare is also launching worker previews, which get— giving every Git branch its own isolated environment with dedicated code, configuration, URL, observability, and state, rather than sharing a single staging setup. Durable objects and containers get automatic per-branch namespaces, preventing preview testing from accidentally modifying live production data or state, a real risk given durable objects use a singleton model. Configuration management uses a base plus override pattern, with teams setting a shared preview configuration once, then overriding specific values, per branch without touching production settings. I've done this on top of, uh, containers. So like I basically, my web containers run spin up, you know, some PR, its own URL and its own branch. And so you can do testing before you do merging into the dev main and then promotion to production. So I've done some more things like this. There are a bunch of gotchas, things like the database and how do you bootstrap the database. And so if you wanted to do like pure true isolation, like they're talking about here, Um, you would definitely have to make some, some investments in, uh, Bootstrap for this.

56:19 Yeah.

56:19 Normally it's, I've done it more for like frontend type stuff where it spins up like the PR, but it still connects to the same dev database. So I've left it like that. I've never done full isolation. I don't see why I couldn't. I just haven't had a need to like bootstrap the database, put caching layers and everything else like that. And it's, yeah, it was overkill for what we needed.

56:39 I mean, it gets pretty expensive if you're, if you're bootstrapping all of that in your dev environment per PR, like it, it can get pretty costly. So that's why I also have only ever really done a web tier, but it's nice to have the option when you need it. So, um, and it also allows you multiple people to have their own, you know, code line where they're testing and doing things without stepping on each other's toes like you would in a potentially a shared dev environment. So yeah, there's definitely use cases. Uh, and DigitalOcean is moving managed agents from private to public preview, offering purpose-built infrastructure for AI agents instead of forcing developers to adapt general-purpose VMs. This includes two integrated services, including the Harness runtime for durable execution environments and Action Gateway for governed access to over 16,000 tools across 500 providers. Per-second active CPU billing is a notable differentiator, with agents are only charged for CPU actually consumed. So idle time waiting on model responses or tool calls doesn't accrue compute charges. DigitalOcean cites an example where a 2vCPU session at 20% utilization costs 60 or costs 6 cents versus 12 cents for full capacity billing. Benchmark shows session creation to first response in 3.3 seconds and resume from pause in 305 milliseconds, which the company argues makes pausing idle sessions practical without sacrificing your responsiveness. So, I mean, this is one that I also have to play with a little bit to really feel out how well this works, but it sounds great for managed agents. I mean, another runtime environment is always a plus as we try to secure these agent fleets that are coming out everywhere.

58:05 Sounds great. I don't have a use case for it yet. Yeah.

58:10 I mean, if I didn't build it as a chatbot, I definitely could have built it as an agentic AI in a container, I suppose. Uh, but, you know, Bolt as a chatbot, it's a little bit more approachable versus just an agentic AI that's just things are happening to, and it's listening to a chat, but it's not taking necessarily direct instructions. So I, I see the value. I can see the architecture of how I would do it. I don't know that I'm ready for that autonomousness yet. I like the, the supervisor model.

58:34 Yeah. I don't know that I trust things yet. I still like to have a little bit of control of my AI.

58:39 Yep. All right. That's it, Matt. We made it to the end.

58:44 Hey, we still broke, uh, right around an hour. So I'll take that as a win.

58:47 Yeah, we're pretty consistent. Right about an hour, hour and 15 is kind of our sweet spot for most episodes these days. But, uh, it's all good. Well, we will see you next week here in the cloud.

58:59 See ya.

59:00 Another week of cloud news wrapped up. Boat will collect the news. Justin will get the notes. Jonathan will write some code. Ryan will watch the perimeter. And Matt will reluctantly watch Azure. Till next week for AI, Amazon, Google Cloud, and Azure. And hey, maybe even Oracle, who knows? Check out thecloudpod.net for our news. Join our Slack, message us on socials, or leave a review.