// Articles
Guides, tutorials, and comparisons to help you build better backend applications.
Run a Dockerized backend on EKS or GKE against RDS or Cloud SQL: the manual setup, what you still own, and how infrastructure from code removes most of it.
Five alternatives to Port, from open source portals to scorecard tools, ranked by how much you still have to build before a developer can ship a new service.
Design the audit log behind a healthcare API: log every read of patient data in the same transaction that returns it, include denied and break-glass access, make the table append-only in Postgres, answer access-history questions and purge only after the retention period, with the data in your own AWS account.
Design the backend behind instant freight quotes: parallel carrier rate calls with per-carrier API keys, quotes that expire, a booking step that cannot double book or book a stale price, confirmation events, and bills of lading stored in your own bucket, built by hand on AWS or in TypeScript with Encore.
Load the payment provider's daily settlement report, keep the original file, match each line against the payments your webhooks recorded, and flag missing or mismatched transactions with a job that is safe to rerun.
How one Amazon ECS service finds another: Cloud Map DNS records, Service Connect short names through a managed proxy, and an internal Application Load Balancer, with Terraform for each, the failure modes that come with them, and how Encore handles service-to-service calls in code.
Hold stock while a customer pays without overselling: an available-stock check in one Postgres UPDATE, per-cart reservations that are safe to retry, holds that expire, and release on payment failure through Pub/Sub with a cron sweep behind it.
Terraform for the IAM role an application service runs as: a trust policy with confused deputy conditions, a scoped inline policy, a shared managed policy, a permissions boundary, exclusive policy management to catch console drift, and a cross-account role the service assumes, plus how Encore handles service roles.
Give a Fargate task read and write access to one S3 bucket: the task role policy, a bucket policy that only accepts TLS and VPC endpoint traffic, a gateway endpoint that keeps S3 traffic off the NAT gateway, and how Encore sets up the bucket and the service role from Go code.
Terraform for EventBridge Scheduler: a schedule group, an execution role with confused deputy protection, cron and rate schedules in a time zone, flexible time windows, Lambda and SQS targets, retries and a dead-letter queue, one-time at() schedules, and how Encore runs scheduled jobs from code.
Move the data in a Railway Redis service to ElastiCache in your own AWS account, either by copying keys lazily on first read while both run, or by seeding a new cluster from an RDB snapshot during a write freeze.
Terraform for a Standard Tier Memorystore for Redis instance on private services access, with AUTH, in-transit encryption, read replicas and persistence, the AUTH string in Secret Manager, and a Cloud Run service that reaches it through Direct VPC egress, plus how Encore provisions Memorystore from code.