Mac Chaffee
macchaffee.com · Personal blog · on HN since 2020
Mac Chaffee is a site reliability engineer who writes about Kubernetes, platform engineering and security practices such as web application firewalls and secrets.
What HN saysHN commenters repeatedly cite "Dear friend, you have built a Kubernetes" as the standard warning that custom deployment tooling tends to reinvent Kubernetes.
30HN people shared it
11linked it in comments
34stories submitted
686story points
3 months agolast shared
2020people per year2026
Most-shared posts
- 1Dear friend, you have built a Kubernetes10 people · 342 points · first shared 2024 · 277 comments on HN
- 2Discouraging the use of web application firewalls6 people · 99 points · first shared 2023 · 43 comments on HN
- 3Plain Kubernetes Secrets are fine4 people · 12 points · first shared 2022 · discussion on HN
- 4Am I the problem? Interviewing another team to find out4 people · 5 points · first shared 2026 · discussion on HN
- 5Hacking Myself to Prove a Point3 people · 3 points · first shared 2023 · discussion on HN
- 6The Next Platform2 people · 10 points · first shared 2024 · 1 comments on HN
- 7Deno shows us there's a better way2 people · 9 points · first shared 2025 · discussion on HN
- 8Avoid Building a Security Treadmill2 people · 6 points · first shared 2025 · 2 comments on HN
- 9Tech and the Climate Crisis2 people · 5 points · first shared 2025 · discussion on HN
- 10Know Your Carrying Capacity1 people · 131 points · first shared 2022 · 26 comments on HN
- 11We've learned nothing from the SolarWinds hack1 people · 28 points · first shared 2023 · 10 comments on HN
- 12Under-Documented Kubernetes Security Tips1 people · 22 points · first shared 2022 · 1 comments on HN
- 13DDoS attacks can threaten the independent Internet1 people · 4 points · first shared 2024 · 1 comments on HN
- 14Please make your software engineering advice more specific1 people · 3 points · first shared 2020 · 2 comments on HN
- 15Security in the 2000s1 people · 3 points · first shared 2024 · discussion on HN
What HN people wrote when they linked it
stackskipton · 2026-05-05
SRE here, my thought is "Sure, Docker Compose is great for production assuming your needs are light and Docker Compose works well for you."
K8s as small time is overkill for sure but make sure you don't fall into this trap. https://www.macchaffee.com/blog/2024/you-have-built-a-kubernetes/
mac-chaffee · 2023-08-02
Location: NC
Remote: Yes
Willing to relocate: No
Resume: https://www.macchaffee.com/
Technologies: Kubernetes, Linux Admin., Security, Python, Ansible, SRE, Platform Engineering
Email: On resume
maxboone · 2026-06-24
Mandatory mention: https://www.macchaffee.com/blog/2024/you-have-built-a-kubernetes/
But yeah, pretty cool DNS resolving features in HAProxy, that's nifty
josevalerio · 2026-06-16
Dear friend, you have built a Kubernetes
https://www.macchaffee.com/blog/2024/you-have-built-a-kubernetes/
athrowaway3z · 2026-06-16
This cuts both ways.
At any stage of https://www.macchaffee.com/blog/2024/you-have-built-a-kubernetes/ a SOTA model can repackage it into Kubernetes.
If you're feeling extra spicy you don't even need the deploy scripts. Just a `llm` user account with the right permissions & ssh keys on all your servers.
monkpit · 2026-05-05
You have built a kubernetes…
https://www.macchaffee.com/blog/2024/you-have-built-a-kubernetes/
zbentley · 2026-05-05
https://www.macchaffee.com/blog/2024/you-have-built-a-kubernetes/
Like, if that works for you, more power to you. But that is a lot of moving parts in exchange for using a tool whose value prop is that it doesn't have many.
berkeleyjunk · 2026-05-01
SonOfLilit · 2025-04-25
I don't agree. WAFs usually add more attack surface than they remove.
https://www.macchaffee.com/blog/2023/wafs/
Of course, Wordpress is basically undefendable, so I'd never ever host it on a machine that has anything else of value (including e.g. db credentials that give access to much more than the public content on the WP installation).
KronisLV · 2024-11-25
What I really like are solutions that are simple to both install and maintain.
For example, look at Docker Swarm: https://docs.docker.com/engine/swarm/swarm-tutorial/create-swarm/ or Hashicorp Nomad: https://developer.hashicorp.com/nomad/tutorials/get-started/gs-start-a… or Kubernetes distros like K3s: https://docs.k3s.io/quick-start
Either of those would work better than a bespoke solution a lot of the time, for anyone who is not the original person writing that hodgepodge of shell scripts, because of how much information and documentation exists out there about those solutions.
Either of those would also work better than a very complex Kubernetes cluster that was built with HA in mind and tries to be web scale for anyone who isn't a DevOps engineer that's ready to spend a bunch of time maintaining it, given how complex things can get.
Curiously, a previous article by the author calls out Docker Compose as not being good enough https://www.macchaffee.com/blog/2024/docker-compose/ and also critiques Docker Swarm without much elaboration (because that's not the main focus):
> Single-node only. Many apps never reach a point where they need more than one node, but having to either rip out your entire existing deployment method or invest in Swarm are not good options.
I've seen both Docker Compose and Docker Swarm be used in production with good results - in problem spaces where minutes or hours of downtime (e.g. non-global audience, evenings) was acceptable and…