Seven Backend Lessons From Building a First Microservices Mobile App

·1 views

A developer building their first mobile app on a microservices architecture has shared seven backend lessons learned through experience. The core advice covers owning your data, making retries safe, enforcing rules in the database rather than only in application code, centralizing authentication, versioning API contracts, observing systems before scaling, and shipping a minimal working backend before hardening it. The author argues these practices are not especially clever but determine whether a backend remains maintainable over time. The post is presented as part of ongoing writing about backend systems, with longer pieces published on Substack.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Docker Bypasses UFW, Exposing Denied Ports to the Internet

A developer found that Postgres, Redis, and an internal admin dashboard were reachable from the internet despite explicit UFW deny rules on their VPS. The cause is that Docker publishes container ports through NAT rules that are evaluated before UFW's INPUT chain, so the packets are forwarded to containers and never checked against UFW. The author describes a five-minute reproduction on a test VM showing UFW reporting a port as denied while Docker still served it. Recommended fixes include not publishing internal ports, binding them to 127.0.0.1, setting a loopback default in daemon.json, or filtering traffic in the DOCKER-USER chain. Disabling iptables in Docker is discouraged because it breaks container networking.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

18,020 Exposed MLflow Servers Prompt Review of Experiment Tracking Security

Researchers found that ZoomEye indexed 18,020 assets matching an MLflow fingerprint on 28 October 2026, though the index does not reveal authentication status or whether a given server is vulnerable. The flaw, tracked as CVE-2026-116690, affects MLflow versions 3.10.0 through 3.16.1 and lets a prompt-tagged model version use a schemeless local path that the server later serves with its own process permissions. An unauthenticated default server could expose remote file reads, and even basic-authentication setups may be reachable by users allowed to create registered models. The fix is available in version 3.17.0, and administrators are advised to verify the running version, review who can create model versions, and audit the credentials the process can access. The guidance stresses that an indexed server should not be presumed compromised, and that incident evidence should come from the server's own logs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Eleven Unlinked Tickets from One Customer Reveal Gaps in AI Support Deduplication

A single customer complained eleven times over nine days about one delayed shipment, but the AI support system opened a separate ticket for each message without linking them. Because most helpdesks auto-close silent tickets, six closed as unresolved, while the dashboard counted them as solved. The author argues that duplicate tickets are a routing and trust problem, not just a storage issue, creating multiple queue entries and conflicting responses. He proposes a strict four-part duplicate test covering identity, subject, stage, and new content, and recommends linking related tickets instead of merging them when any condition fails.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Crossplane Matures as Kubernetes-Native Infrastructure-as-Code Platform Engine

Crossplane, an open-source framework that turns cloud infrastructure into Kubernetes resources, has become a central engine for Internal Developer Platforms. Originally released by Upbound in 2018 and now a CNCF-graduated project, it has drawn over 3,000 contributors from more than 450 organizations and passed 100 million cumulative downloads. Unlike Terraform or OpenTofu, which rely on external state files, Crossplane models resources such as databases or IAM roles as native Kubernetes objects managed through GitOps tools like Argo CD or Flux. The v2.0 release in August 2025 introduced namespaced resources inheriting Kubernetes RBAC, along with Composition Functions written in Go, Python, or CEL. Following these changes, the project has continued releasing updates on a roughly three-month cadence.

0 comments Read more at DEV Community