Le blog Workstation
Tous les articles
Guides pratiques sur l'infrastructure IA, le MLOps, les modèles et la mise en production.
Code as infrastructure: one reviewed path for every production change
Infrastructure as code made servers into files. Code as infrastructure goes further: desired state, policy, pipelines and AI agent access all live in Git, are checked by policy, applied by automation and watched for drift. A practical playbook.
Decoupling Network Policy in Kubernetes: One Owner per Rule
Network rules scattered across annotations, app config and stray NetworkPolicies slow every change. Here is how to split them into layers with one owner each, using ClusterNetworkPolicy, NetworkPolicy and Gateway API, plus a step-by-step migration playbook.
Observability for Agentic AI: Tracing, Evaluating and Auditing Agents
AI agents fail quietly: a confident answer from the wrong document, a tool called with the wrong argument. Learn how to trace every model, retrieval and tool step with OpenTelemetry, attach quality scores, and keep the records auditors ask for.
Trading costs with agents: what an AI agent really costs to run
AI agents move cost rather than remove it. Learn why the token bill grows with the square of loop steps, how caching and compaction bend the curve, and a playbook for pricing, budgeting and capping an agent before it reaches production.
The energy cost of LLM code optimisation, and when it pays back
A 2026 study found LLM-optimised code used more energy per run than the human reference in 42 of 44 configurations. Learn the break-even rule, how to measure joules per run on Linux, and a workflow for keeping only the rewrites that pay back.
What an AI Factory Actually Delivers: One Rack, 32 Blackwell Ultra GPUs and the Work It Does for You
An AI factory turns your own data into answers, agents, forecasts and trained models on hardware you control. Here is what goes in, what comes out, how the work flows every day, and what a rack of four Compal SGX30-2 servers with 32 NVIDIA Blackwell Ultra GPUs needs to run.
Balinder WaliaLire 
One Sign-In for Every App, Run on Our Own Cluster
Five demo apps in five languages never see a password and never talk to Google: they send users to a self-hosted OpsAPI, which signs them in and hands back a token the app checks with one API call. What it costs to add an app, why admin dashboards belong behind a VPN or zero-trust broker, and the honest limits.
Balinder WaliaLire 
Keep Your Test Sites Private: VPN at the Edge, One Sign-In for Every App
Staging and test sites hold real-looking data, yet they're often protected by an IP allowlist alone. Here's how two layers keep them private: a VPN checked at the edge proves where a request came from, and one OpsAPI sign-in with MFA proves who sent it, across every app.
Balinder WaliaLire 
Put Internal Apps Behind Your VPN, Without Rebuilding Them
Staging sites and admin panels are often 'private' because of an IP allowlist. Put them behind the wslvpn Zero Trust VPN, enforced at the WSLProxy edge: check the tunnel and the person, fail closed, and see why someone was blocked. One field per domain, no app changes, no reload.
Balinder WaliaLire 