DevOps and Platform Engineering Services for Cloud Applications
DevOps is the engineering that moves your code from a commit to a running, observable, patched production system, and keeps it there without a person in the loop for every step. The definition has held. What a buyer can reasonably check has changed.
In 2026 three questions decide whether a platform is well built. What does it cost to run, in engineer-hours and in cloud spend. Can you prove where a given binary came from. And who files the incident report when something is actively exploited. Tool choice matters far less than it did in 2021, and answering those three well matters far more.
The market context explains the shift. Cloud demand is running well ahead of what the hyperscalers can build out. Azure and other cloud services grew 43% and Azure passed $100 billion in annual revenue for the first time, with Microsoft Cloud at $59.3 billion (Microsoft FY26 Q4 press release, 29 July 2026), and the other large providers are reporting comparable growth while guiding capital expenditure sharply upward. Capacity, not unit price, is the scarce input now, which changes how a launch date gets planned.
Mixcore Studio has been building and running software for 8+ years with a team of about 20, across 320+ delivered projects. Our DevOps practice works primarily on AWS, Azure and DigitalOcean, and takes on the migration work that came out of Heroku's shift to sustaining engineering.
Platform engineering, not Kubernetes for its own sake
Kubernetes won the argument about what runs container and AI workloads, and at the same time stopped being a thing worth selling on its own. 82% of container users now run Kubernetes in production (The CNCF Annual Cloud Native Survey: The Infrastructure of AI's Future, published 20 January 2026), and the same survey puts people, culture and organisational alignment ahead of technical concerns as the limiting factor in cloud native adoption. The hard part moved from the cluster to the people using it.
So the deliverable is a paved road, not a cluster handover. Golden paths, templates, a portal your developers can operate without learning etcd, and a stated operating cost.
- Managed control planes by default — EKS, AKS, GKE or DOKS. A self-managed control plane is now an exception you justify with a specific requirement such as an air gap or a regulator, not a starting posture.
- A supported Kubernetes minor, with the upgrade in the contract — the supported minors as of August 2026 are 1.36, 1.35 and 1.34. Version 1.34 reaches end of life on 27 October 2026, 1.35 on 28 February 2027 and 1.36 on 28 June 2027, and v1.37 is scheduled for 26 August 2026. Anything at or below 1.33 is already unpatched.
- Dynamic Resource Allocation for accelerators — resource.k8s.io/v1 went GA in Kubernetes v1.34 and is the current mechanism for scheduling GPUs and other specialised hardware. The older device-plugin pattern is legacy.
- An internal developer platform in front of the cluster — Backstage remains the dominant open-source portal layer in the CNCF ecosystem. The point is that a developer ships a service without a ticket and without reading a cluster manual.
- AI conformance where inference actually runs — the CNCF runs a Kubernetes AI Conformance Program that certifies platforms against a defined set of AI and inference requirements, and the certified list keeps growing. If you are buying a platform to run inference on, ask whether it is certified rather than taking the claim on trust.
The honest half of this section. For a small service count, Kubernetes is usually the wrong answer, and we will say so before quoting. A managed container platform, plain containers behind a load balancer, or serverless will cost less to run and less to hand over. If we do recommend Kubernetes, you should ask what the platform costs in engineer-hours per month, and we should have a number ready. A vendor who puts a five-service system on a bespoke cluster without that answer is selling complexity.
Supply chain security, and the 11 September 2026 deadline
Proving where software came from stopped being a security nicety and became a dated obligation. From 11 September 2026 the EU Cyber Resilience Act requires manufacturers of products with digital elements to report actively exploited vulnerabilities and severe incidents, through the reporting platform established under the Act and on a staged timetable that runs from an initial early warning to a fuller notification to a final report (European Commission, Shaping Europe's Digital Future). Full CRA application follows on 11 December 2027, and the reporting duty applies to products already on the EU market, not only to new ones. Confirm the exact deadlines and the designated recipient authority against the Commission's implementation guidance before you build the rota around them.
The second driver is worms in the package ecosystem. CHAINDROP, discovered on 4 August 2026, compromised the maintainer of keyv and backdoored more than 400 npm packages, including keyv at over 600 million monthly downloads and flat-cache at 580 million (Elastic Security Labs, August 2026). Elastic identified it as a return of the Shai-Hulud campaign, and the mechanism has been consistent across that lineage: harvest secrets from CI environments, environment variables and cloud metadata endpoints, then republish packages to self-propagate. Long-lived npm and GitHub tokens are no longer defensible in a build system.
- Provenance produced by the pipeline — SLSA v1.2 attestations, released as the Approved Specification on 24 November 2025, signed with Sigstore. Cosign for signing, Fulcio for short-lived certificates, Rekor as the transparency log.
- An SBOM per build, not per audit — generated at build time and stored with the artefact, so the question "does this release contain the compromised version" takes minutes rather than a week.
- OIDC trusted publishing and short-lived credentials — no static registry or cloud tokens sitting in CI. There is nothing long-lived to steal, and nothing long-lived to remember to rotate.
- Dependency soak periods and lifecycle-script containment — new versions wait before adoption, and npm 12 blocks dependency lifecycle scripts by default unless the root package's
allowScriptspolicy permits them. Both are direct answers to how the Shai-Hulud family propagates. - A named incident path before September — who drafts the early warning, who submits the notification to the designated authority, and what the on-call rota is. Buyers selling into the EU increasingly want this written into the contract rather than discovered during an incident.
- Compliance evidence emitted by CI — SOC 2, ISO 27001 and CRA readiness as artefacts the pipeline produces continuously, instead of screenshots assembled the week before an audit.
Instrumentation and spend are now the same conversation
OpenTelemetry is a CNCF Graduated project and the vendor-neutral standard for instrumentation. Tracing and metrics are stable across the major language SDKs, the Collector and semantic conventions are production-ready, logging is stable in some SDKs and still in development in others, and Profiles is not yet stable in any of them. New instrumentation written against a single vendor's proprietary agent is technical debt at the moment it is merged.
Instrumentation belongs in the same discussion as the bill because it is a cost lever. OTel decouples what you measure from whoever is charging per host or per gigabyte, which is what makes a vendor change a commercial decision rather than a re-instrumentation project.
On the bill itself, the discipline widened. 98% of FinOps practitioners now manage AI spend, up from 31% in 2024, and 78% of FinOps teams report to the CTO or CIO (FinOps Foundation, State of FinOps 2026, 1,192 respondents representing $83B+ in annual cloud spend). The discipline's scope has widened beyond cloud to cover SaaS, licensing, private cloud and data centre. Meanwhile Flexera's 2026 State of the Cloud Report puts wasted IaaS and PaaS spend at 29%, the first increase after five straight years of decline, with cost management at 85% and security at 82% the top cloud challenges (753 respondents surveyed winter 2025). Inference workloads made forecasting structurally harder, and the waste number moved for the first time in half a decade.
- OpenTelemetry as the instrumentation layer — SDKs and Collector, with vendor agents treated as the legacy path and removed as they are touched.
- Unit economics before scale — GPU-hour and token cost per feature and per customer, so a spike attributes to a cause instead of arriving as a monthly surprise.
- Budgets, alerts and a named owner — an anomaly should page someone specific, not appear in a reconciliation later.
- Retention and sampling decided deliberately — tail sampling and tiered retention, because observability pricing per host and per gigabyte is a top-three line item for a lot of teams.
- Capacity confirmed, not assumed — with accelerator supply tight across the major providers, availability, region and lead time get checked before a launch date is committed.
Where it runs, and what to do about Heroku
We work across three primary platforms, each with its own page in this section. The fourth technology this page used to lead with needs a different answer than it did a year ago.
Heroku has moved to a Sustaining Engineering model, stated in its own March 2026 update: the stated mission is now to provide the most stable, secure and reliable environment for existing apps and data, and new work is scoped to that goal. Heroku is not shutting down, existing apps are still patched, features aligned with those goals do still ship, and list pricing is unchanged (Eco $5/mo, Basic $7/mo, Standard-1X $25/mo, Standard-2X $50/mo, Performance-M $250/mo up to Performance-2XL $1,500/mo). What changes is the roadmap assumption behind a greenfield build: you would be buying a platform being maintained rather than one being expanded, so we would want a specific reason before recommending it for a new 2026 project. If you are already on it, the sensible advice is to plan the exit rather than panic-migrate, and to price the add-ons, the Postgres migration and the parts of the application that assume an ephemeral filesystem and a 30-second request limit, because that is where the real cost of leaving sits.
- AWS — serverless grew a stateful dimension with Lambda durable functions, which checkpoint multi-step workflows, run for up to a year and suspend during waits without incurring compute charges, Lambda Managed Instances, which extend the Lambda programming model onto EC2 compute while AWS manages instance lifecycle, OS patching, routing, load balancing and autoscaling, and Lambda tenant isolation mode for per-tenant execution environment isolation. For EU residency questions, the AWS European Sovereign Cloud is live with its first Region in Brandenburg, Germany, physically and logically separate from other AWS Regions, with day-to-day operations controlled by AWS employees residing in the EU.
- Azure — Azure passed $100 billion in annual revenue in FY2026. Microsoft Foundry is the current platform for building and running agents on Azure, including a hosted Foundry Agent Service, and Azure's own Arm-based Cobalt silicon continues to expand across the Linux VM families.
- DigitalOcean — the smaller-surface option, and a credible one. Q2 2026 revenue was $281 million, up 29% year over year, with $93 million in incremental ARR (DigitalOcean Q2 2026 results). AI and inference is the fastest-growing part of that business.
- Cloudflare Workers — the edge became a full application runtime rather than a request filter. Node.js compatibility is on by default for compatibility dates from 2026-08-04, Durable Object namespaces created through the declarative
exportsfield always use the SQLite storage backend, and that declarative flow has superseded the older imperative migrations array. - Infrastructure as code that travels — Terraform remains under the Business Source License after IBM closed its $6.4 billion acquisition of HashiCorp on 27 February 2025 (IBM newsroom, 27 February 2025), so describing it as open source is simply wrong. OpenTofu is the Linux Foundation fork, with independent features including native state encryption. On 4 August 2026 Pulumi shipped GA support for Terraform state, HCL as a first-class language and running Terraform modules against the Pulumi engine, which turned "which IaC tool" from a rip-and-replace decision into an incremental one.
- A costed exit, written down — portable IaC, no proprietary glue in the deployment path, documented runbooks and a migration estimate. The EU Data Act mandates the gradual withdrawal of charges for switching between data processing services, so asking what leaving costs is now a normal procurement question rather than an awkward one.
One position we will not take is that multi-cloud is an unqualified good. Duplicating infrastructure across three providers to avoid lock-in usually costs more than the lock-in it prevents. A named primary platform with a credible, costed exit plan is the better answer for most teams.
How we measure delivery, including AI-assisted delivery
DORA moved the goalposts and a lot of vendor material has not caught up. The report is now the State of AI-assisted Software Development, the four delivery metrics became five with the addition of deployment rework rate, and the Elite, High, Medium and Low tiers were replaced by a set of team profiles. If someone offers to make you an Elite team against four metrics, they are quoting a model DORA retired.
The 2025 edition's headline finding is that AI acts as an amplifier, and that the greatest returns come from improving the underlying sociotechnical system rather than from adding generation capacity. AI adoption shows up alongside higher delivery throughput and, at the same time, higher instability, meaning more change failures, more rework and longer recovery. AI amplifies whatever delivery discipline already exists. That is the argument for fixing the pipeline before adding more generation capacity to it.
- Five metrics, reported together — deployment frequency, change lead time, failed deployment recovery time, change fail rate and deployment rework rate. Three throughput, two instability. Reporting velocity without the instability pair is how a team convinces itself it is improving while breaking more.
- Deployment rework rate baselined early — it is the metric that catches AI-assisted churn, and it is meaningless without a before-and-after measurement.
- Profiles used as diagnosis, not as a score — DORA's team profiles describe distinct combinations of throughput, stability and team wellbeing rather than ranking every team on one axis. They tell you which constraint to work on, which a tier label never did.
- Review gates that survive AI volume — trust in generated code is far from universal even among teams using AI heavily, so the pipeline has to assume unreviewed change is the norm and catch it, rather than assume good behaviour.
When DevOps work is the wrong thing to buy
Not every delivery problem is a platform problem, and platform spend on the wrong constraint is expensive and slow to unwind.
- You have a handful of services and no scaling pressure — a managed platform, plain containers or serverless will be cheaper to run and cheaper for someone else to take over. Build the platform when the service count or the team size makes it pay, not before.
- The bottleneck is upstream of the pipeline — if changes are slow because requirements churn or reviews queue for days, a faster deployment pipeline delivers churn faster. Platform engineering has been forecast for years as something most large engineering organisations would adopt, which makes it something to check against your own delivery data rather than a reason on its own to staff a platform team.
- You are pre-product-market-fit — a paved road for a product whose shape is still moving is optimisation of a path you may not keep. Ship on something managed, revisit when the architecture stops changing weekly.
- Running the platform is core to your business — if platform capability is a competitive asset, an outside team is the wrong permanent home for it. We would rather build the paved road, document it and hand it over than become a dependency you cannot remove.
- You want multi-cloud without a specific reason — regulatory requirement, a customer contract or a named single-provider risk are reasons. Avoiding a lock-in you have not costed is not.
The related question worth asking any vendor, including us, is who runs this at 3am and what the handover looks like. The answer should include a documented paved road, golden paths, a portal your team operates, runbooks and an on-call rota with names in it. If the answer is that the agency who built it will always be there, that is a dependency, not a platform.
What our DevOps practice covers
- Managed Kubernetes And Paved Roads
- Supply Chain Provenance
- OpenTelemetry Observability
- Cloud Cost And Capacity
- Portable Infrastructure As Code
- Incident Response And CRA Readiness
How we run a DevOps engagement
Four stages, in order. The first produces numbers rather than changes, and the last one is a handover rather than a launch. If a stage cannot be evidenced when it ends, we say so instead of moving on.
- 01
Baseline before we change anything
We measure the five DORA delivery metrics as they stand, the current cloud spend broken down by service and by workload, the Kubernetes minor versions in use against their end-of-life dates, and where credentials live in CI. Without a baseline, every later claim of improvement is a story rather than a measurement.
- 02
Size the platform to the service count
We recommend the smallest platform that meets the requirement, and state its operating cost in engineer-hours per month. Managed control planes where Kubernetes is warranted, a managed container platform or serverless where it is not. If we propose a cluster you do not need, you should be able to catch it from this document.
- 03
Build the pipeline that produces evidence
CI emits an SBOM and SLSA v1.2 provenance per build, signs artefacts with Sigstore, publishes through OIDC trusted publishing with no long-lived tokens, and enforces a dependency soak period. OpenTelemetry instrumentation goes in at the same time, so the first deploy is already observable and already portable between vendors.
- 04
Hand over the runbooks and the rota
Golden paths and templates your developers use without a ticket, a developer portal your team operates, documented runbooks, an on-call rota with names in it, the incident-reporting path for CRA obligations, and a costed exit plan. The measure of success is that you could replace us without a rewrite.
Frequently asked questions
Should we still be building on Heroku in 2026?
Only with a specific reason. Heroku moved to a Sustaining Engineering model in its March 2026 update, which makes a stable, secure and reliable environment for existing apps and data the stated priority and scopes new work to that goal. Existing apps still run, are still patched, and list pricing is unchanged, so if you are already on Heroku the advice is to plan the exit on your own timetable rather than panic-migrate. For a greenfield build the question is whether you want a platform being maintained rather than expanded. The cost of leaving is usually in the add-ons, the Postgres migration, and the code that assumes an ephemeral filesystem and a 30-second request limit.
Do we actually need Kubernetes, or are we being sold complexity?
It depends almost entirely on service count and team size, and it is a fair question to press any vendor on. 82% of container users run Kubernetes in production according to the CNCF Annual Cloud Native Survey published in January 2026, but that describes organisations at a scale where it pays. For a handful of services, a managed container platform, plain containers or serverless is cheaper to run and cheaper to hand over. Ask for the platform's operating cost in engineer-hours per month before you agree to it, and treat an unclear answer as a signal.
What has to be in place before the EU Cyber Resilience Act reporting date on 11 September 2026?
Three things. A way to know what is in a build, which means an SBOM generated per build and stored with the artefact. A way to prove where the build came from, which in practice means SLSA v1.2 provenance signed with Sigstore. And a named incident path, covering who drafts the initial early warning, who submits the fuller notification to the designated authority through the reporting platform established under the Act, and who produces the final report. Confirm the exact deadlines against the Commission's implementation guidance when you set the rota. The obligation applies to products already on the EU market, not only to new releases.
How do you keep the AI and GPU bill predictable?
By modelling unit economics before scale rather than reconciling a bill afterwards. That means GPU-hour and token cost per feature and per customer, budgets and anomaly alerts with a named owner, and deliberate retention and sampling on observability data. The pressure is real and measurable. The FinOps Foundation's State of FinOps 2026 reports 98% of practitioners now manage AI spend, up from 31% in 2024, and Flexera's 2026 State of the Cloud Report puts wasted IaaS and PaaS spend at 29%, the first increase after five straight years of decline.
What did the npm worm campaigns change about how you handle CI credentials?
They ended long-lived tokens as a defensible practice. CHAINDROP, discovered 4 August 2026, backdoored more than 400 npm packages through a compromised maintainer account, including keyv at over 600 million monthly downloads, and the Shai-Hulud family it belongs to specifically harvests secrets from CI environments, environment variables and cloud metadata endpoints. Our default is OIDC trusted publishing with short-lived credentials so there is nothing static to steal, npm 12 or later so dependency lifecycle scripts are blocked by default, a soak period before adopting new dependency versions, and enforced 2FA on the registry.
Contacts
We are always happy to talk with you.
Feel free to contact us in any suitable way
Request a quote
Let's discuss your project!
Please, provide us with a brief description of what you
already have and what you are going to achieve.
Mail us contact@brainiacminds.com