# kcearns.tech > Kevin Cearns writes about AI infrastructure, agents, self-hosted models and the platforms underneath them. Long-form engineering guides, a portfolio of systems built, and a model card instead of a résumé. Every post is also available as raw markdown by appending `.md` to its URL. ## Pages - [Writing](https://kcearns.tech/writing): all posts - [Work](https://kcearns.tech/work): selected systems - [Model card](https://kcearns.tech/model-card): about Kevin Cearns ## Series - [Building a Hybrid LLM Platform on EKS](https://kcearns.tech/writing/series/eks-hybrid-llm): From an empty VPC to GPU node pools, vLLM, KEDA and a cloud-vs-local inference router, built as reproducible AWS CDK you can deploy and tear down yourself. - [Running a Fleet of Firecracker microVMs for eve.dev Agents](https://kcearns.tech/writing/series/eve-firecracker-fleet): Turn one Firecracker host into a fleet: a control plane that places agents onto bare-metal AWS hosts on demand, and a routing layer that gets requests back to them. ## Work - A Firecracker fleet for AI agents: A control plane that places eve.dev agents into Firecracker microVMs across a fleet of bare-metal AWS hosts, plus the routing layer, snapshot-based warm starts, a deploy CLI with per-PR preview agents, and the FinOps view of cost per agent. - Hybrid LLM platform on EKS: VPC to GPU node pools to a TypeScript router that sends each request to local vLLM or to Claude, with KEDA scaling GPUs to zero overnight and Langfuse showing the dollar cost of every call. - AI demos on Cloudflare's free tier: Document Q&A with citations, invoice reading, agent-drafted quotes with human approval, and a shop assistant, all on Workers AI, Durable Objects, Workflows and D1, each with a per-request cost ledger and a budget in front of every model call. - An integration pipeline that copes: Retries with backoff, a circuit breaker per destination, duplicates delivered once and a dead-letter list, written in Effect and run on Workers, Queues and Durable Objects, with infrastructure defined in the same program via Alchemy. - Hardening self-hosted LLMs: An auth and rate-limit gateway, gVisor sandboxing for agent tools, prompt-injection guardrails, scoped secrets and signed model weights, mapped to the OWASP LLM Top 10. - The agent control plane: Frontier models plan and decompose; a Kubernetes worker pool of local models executes. A shared task ledger, lane-based routing and KEDA autoscaling hold it together. - CI/CD as code with Dagger: A containerised pipeline in Dagger's TypeScript SDK that runs identically on a laptop Kind cluster and in GitHub Actions, promoting builds from develop to staging to production on EKS. - FlagSignals: A full-stack feature-flag platform with A/B testing and billing, built with Claude Code as a pair programmer: an early field test of how far AI-assisted development goes. ## Posts - [Run Your Own Buzz: A Local Community on Hardware You Control](https://kcearns.tech/writing/self-hosting-buzz-local-community.md): Buzz is a self-hostable workspace where people and AI agents share the same rooms, built as a Nostr relay. A hands-on walkthrough: standing up a local community, the host-binding gotcha that will stop you cold, and adding an agent backed by OpenRouter, a local Hermes model, or Claude Code. - [What It Takes to Own Your Agent Platform: The Firecracker Fleet Series in One Read](https://kcearns.tech/writing/eve-firecracker-fleet-recap.md): A capstone to the seven-part series on running eve.dev agents on a fleet of Firecracker microVMs in AWS. The whole platform in one picture, a guided tour of the parts, and the design threads — bare-metal constraints, desired-vs-actual state, event-driven placement, and packing-as-economics — that hold it together. - [Running a Fleet of Firecracker microVMs for eve.dev Agents, Part 3: Packaging an Agent as a microVM Image](https://kcearns.tech/writing/eve-firecracker-fleet-agent-images.md): Part 3 of the hands-on series. We turn an ordinary eve agent directory into a bootable ext4 rootfs with a build-rootfs.sh, store it in a versioned S3 artifact bucket the hosts pull from, inject secrets per-microVM with MMDS, and use Firecracker snapshots to turn a cold multi-second boot into a warm sub-second resume. - [Running a Fleet of Firecracker microVMs for eve.dev Agents, Part 4: The Control Plane](https://kcearns.tech/writing/eve-firecracker-fleet-control-plane.md): Part 4 of the hands-on series. We build the scheduler that turns a deploy request into a running agent — API Gateway and Lambda over a DynamoDB registry of hosts, agents, and placements, a race-safe bin-packing placement algorithm, and EventBridge decoupling the API from the work, all in AWS CDK. - [Running a Fleet of Firecracker microVMs for eve.dev Agents, Part 6: The Deploy Workflow](https://kcearns.tech/writing/eve-firecracker-fleet-deploy-workflow.md): Part 6 of the hands-on series. We turn the moving parts into one command — a deploy CLI that chains build, upload, place, and wait-for-URL; IAM auth on the control-plane API; and a GitHub Actions pipeline that ships an agent on merge and gives every pull request its own preview agent. - [Running a Fleet of Firecracker microVMs for eve.dev Agents, Part 2: The Host Fleet](https://kcearns.tech/writing/eve-firecracker-fleet-host-fleet.md): Part 2 of the hands-on series. We put the first machines into the network from Part 1 — an Auto Scaling Group of bare-metal EC2 hosts, a launch template whose user data installs Firecracker and a host-agent daemon, the IAM role each host runs under, and the capacity model that decides how many agents a host can hold. - [Running a Fleet of Firecracker microVMs for eve.dev Agents, Part 7: Fleet Operations](https://kcearns.tech/writing/eve-firecracker-fleet-operations.md): The final part of the series. We make the fleet operable — event-driven host autoscaling with lifecycle-hook draining, a reconciliation loop that reschedules agents off a dead host, per-agent logs and metrics rolled up across the fleet, and the FinOps view that turns packing density into cost per agent. - [Running a Fleet of Firecracker microVMs for eve.dev Agents, Part 5: Networking & Routing](https://kcearns.tech/writing/eve-firecracker-fleet-routing.md): Part 5 of the hands-on series. We make a placed agent reachable — per-microVM tap devices and NAT on each host, an internet-facing ALB with a wildcard certificate, a per-agent subdomain scheme, and a host-local front proxy that resolves an agent to its microVM wherever the control plane placed it. - [A 101 Guide: Running an Eve Agent in a Firecracker microVM on AWS](https://kcearns.tech/writing/eve-agent-firecracker-aws-cdk.md): A beginner's walkthrough of provisioning bare-metal AWS infrastructure with CDK TypeScript, then booting a Firecracker microVM to self-host a Vercel eve agent. - [Running a Fleet of Firecracker microVMs for eve.dev Agents, Part 1: Architecture & the Network Foundation](https://kcearns.tech/writing/eve-firecracker-fleet-architecture.md): Part 1 of a hands-on series turning a single Firecracker host into a fleet that hosts eve.dev agents on demand. We map the whole platform — a control plane that places agents onto bare-metal hosts, and a routing layer that gets requests back to them — then provision the VPC, subnets, and security groups in AWS CDK. - [A Quick Example: Building an Agent with Vercel's Eve Framework](https://kcearns.tech/writing/vercel-eve-agent-quickstart.md): A short, hands-on walkthrough of scaffolding, running, and deploying an AI agent with Vercel's open-source eve framework. - [Building a Hybrid LLM Platform on EKS, Part 5: Serving Local Models with vLLM and KEDA](https://kcearns.tech/writing/eks-hybrid-llm-platform-inference.md): Part 5 of our hands-on EKS series. We deploy vLLM model servers on the GPU pool from Part 4, load Qwen2.5-7B model weights from Amazon S3 via an init container, and wire KEDA autoscaling that scales replicas with live queue depth and drives GPU nodes to zero overnight. - [Building a Hybrid LLM Platform on EKS, Part 7: Observability and Cost Telemetry](https://kcearns.tech/writing/eks-hybrid-llm-platform-observability.md): Part 7 of our hands-on EKS series. We instrument the TypeScript router with OpenTelemetry, upgrade Prometheus to kube-prometheus-stack for GPU and vLLM metrics, add Grafana Tempo for distributed traces, and wire Langfuse so every request shows its backend, token count, and dollar cost. - [Building a Hybrid LLM Platform on EKS, Part 6: The Hybrid Router](https://kcearns.tech/writing/eks-hybrid-llm-platform-router.md): Part 6 of our hands-on EKS series. We build a TypeScript/Hono router that sits in front of both vLLM and the Anthropic API, routes each request to the right backend based on model name and complexity heuristics, and falls back to cloud when the local model is cold-starting. - [Building a Hybrid LLM Platform on EKS, Part 8: Testing, Load, and Examples](https://kcearns.tech/writing/eks-hybrid-llm-platform-testing.md): The final part of our EKS series. We write integration tests with Vitest, load-test the ALB with k6, build three real-world TypeScript workloads that prove the hybrid routing works, and use the Grafana and Langfuse dashboards from Part 7 to verify the platform under traffic. - [Building a Hybrid LLM Platform on EKS, Part 4: Platform Add-ons, the Load Balancer Controller, and Karpenter](https://kcearns.tech/writing/eks-hybrid-llm-platform-addons.md): Part 4 of our hands-on EKS series. We install the two add-ons every production EKS cluster needs: the AWS Load Balancer Controller so Kubernetes Ingress objects provision real ALBs, and Karpenter for cost-aware autoscaling — including the GPU NodePool that scales to zero between inference workloads. - [Building a Hybrid LLM Platform on EKS, Part 3: Node Groups, GPU AMIs, and the NVIDIA Device Plugin](https://kcearns.tech/writing/eks-hybrid-llm-platform-node-groups.md): Part 3 of our hands-on EKS series. We add worker nodes to the empty cluster from Part 2: a CPU system pool for add-ons and the hybrid router, a GPU pool for vLLM model servers, the NVIDIA device plugin DaemonSet, and the taints and labels that make scheduling predictable. - [Building a Hybrid LLM Platform on EKS, Part 2: The Control Plane, IAM, and IRSA](https://kcearns.tech/writing/eks-hybrid-llm-platform-control-plane.md): Part 2 of our hands-on EKS series. We provision the EKS cluster into the VPC from Part 1, wire up OIDC federation and IRSA so pods authenticate without static credentials, and end with a working kubectl connection to a real cluster. - [Securing Self-Hosted LLMs and AI Agents on Kubernetes](https://kcearns.tech/writing/securing-self-hosted-llm-agents-kubernetes.md): Harden self-hosted vLLM and AI agents on Kubernetes: an auth/rate-limit gateway, gVisor tool sandboxing, prompt-injection guardrails, scoped secrets, and signed model weights — mapped to the OWASP LLM Top 10. - [Building a Hybrid LLM Platform on EKS, Part 1: Architecture and the Network Foundation](https://kcearns.tech/writing/eks-hybrid-llm-platform-architecture-network.md): Part 1 of a hands-on series building the EKS-based hybrid LLM platform referenced throughout this blog. We map out the full architecture, then provision the VPC, subnets, NAT, and VPC endpoints with AWS CDK — the network foundation every later part builds on. - [Build a Personal AI Dev Environment: Hybrid Models, Local Inference, and a Workflow That Costs Almost Nothing](https://kcearns.tech/writing/personal-ai-dev-environment.md): The production patterns we deploy for teams — hybrid cloud/local routing, self-hosted models, agent orchestration — scaled down to a single developer's workstation. A practical guide to building a personal AI dev environment with Ollama, Claude Code, and a local router that keeps your token bill near zero. - [The Agent Control Plane: Frontier Models Plan, Your Kubernetes Fleet Executes](https://kcearns.tech/writing/multi-agent-orchestration-frontier-local-models.md): How to orchestrate a fleet of AI agents using a shared task queue — frontier models like Claude handle planning and decomposition, while a local Kubernetes worker pool runs the high-volume execution tasks. Covers the task ledger, dynamic task creation, lane-based routing, and KEDA autoscaling. - [Observability for LLM Applications on Kubernetes: Tokens, Traces, and Cost per Request](https://kcearns.tech/writing/llm-observability-kubernetes.md): How to instrument self-hosted and hybrid LLM workloads with OpenTelemetry, Prometheus, and Langfuse — tracking time-to-first-token, tokens per second, GPU utilization, and unit economics down to the individual request. - [The Hybrid AI Playbook: Cloud Models for Thinking, Local Models for Doing](https://kcearns.tech/writing/hybrid-ai-local-cloud-models.md): How to cut your AI costs by 60-80% using a hybrid approach — Claude or GPT for planning and complex reasoning, local models like Llama and Qwen for execution tasks like code generation, summarization, and data extraction. - [Self-Hosting LLMs on Kubernetes: A Practical Guide](https://kcearns.tech/writing/self-hosting-llms-kubernetes.md): How to deploy, serve, and autoscale open-source large language models on Kubernetes with vLLM — from GPU node pools and deployment manifests to KEDA-based autoscaling and production guardrails. - [Container Security on Kubernetes: A Practical Guide with Trivy, Falco, and Kyverno](https://kcearns.tech/writing/container-security-kubernetes-trivy-falco-kyverno.md): Most Kubernetes clusters are running containers with known vulnerabilities, no runtime monitoring, and no policy enforcement. Here is how to fix that with three open-source tools. - [Using AI to Monitor Kubernetes Clusters and Make Dynamic Scaling Decisions](https://kcearns.tech/writing/ai-driven-kubernetes-monitoring-scaling.md): How to move beyond static thresholds and use AI-driven observability to detect anomalies, predict traffic patterns, and automate scaling decisions across your Kubernetes infrastructure. - [Building a CI/CD Pipeline with Dagger That Deploys to Kubernetes](https://kcearns.tech/writing/cicd-pipeline-dagger-kubernetes.md): A practical guide to building a containerized CI/CD pipeline using Dagger's TypeScript SDK — from local Kind clusters to production EKS with GitHub Actions, AWS CDK, and multi-environment promotion. - [Building a Production Feature Flag Service with Claude Code](https://kcearns.tech/writing/building-feature-flag-service-claude-code.md): How we built FlagSignals, a full-stack feature flag platform with A/B testing and billing, using AI-assisted development. - [GPU Cost Optimization on Kubernetes: A Practical Guide](https://kcearns.tech/writing/gpu-cost-optimization-kubernetes.md): Learn how to reduce GPU infrastructure costs by up to 60% with proper Kubernetes scheduling, time-slicing, and right-sizing strategies.