How to Read This Handbook

This is not a tool manual. Tools change every eighteen months; the architecture behind them changes roughly once a decade. This handbook teaches the architecture.

Who this is for

Platform engineers, security engineers, SREs, and architects who design or operate the path software travels to production — and anyone who has to answer “how do we know this is safe to run?”

Every chapter follows the same structure so you can navigate it years from now:

Why this exists — the problem that forced the industry to invent it
Mental model — the core idea that simplifies the topic
Architecture — how mature organizations implement it
Trust boundaries — what is trusted, and what isn’t
Threat model & compromise scenarios — how an attacker approaches it, and what happens if it breaks
Defensive controls — how the blast radius is reduced
Real-world implementations — how Google, GitHub, Microsoft, Stripe and others approach it conceptually
Common mistakes — designs that look secure but aren’t
Design review questions — what an architect should ask
Implementation examples — Jenkins, GitHub Actions, EKS, ArgoCD, Cosign, SPIFFE, and friends
Key takeaways — the enduring principles
Architecture Conversation — a Socratic dialogue between a senior platform architect (A) and an engineer (E) that questions the trust assumptions until the design becomes resilient

The single question this entire book answers:

When a container starts running in production, why should anyone believe it is the code the developer wrote?

Every chapter is one link in the chain of custody that answers that question.