Ruslan Islamov@ruslan_islamov579
1
Events attended
1
Submissions made
Russian Federation
20+ years of experience
About me
Storage & virtualization engineer, 20+ years in server infrastructure — 8 of them as Technical Consultant at HPE (3PAR/Primera, Synergy, SimpliVity, VMware). Now independent, moving into AI/LLM engineering: I run my own agent infrastructure — RAG knowledge base on PostgreSQL + pgvector, skill/subagent framework, FastAPI deploys. Solo team "SRE Incident Agent" at the Vultr Agent Rush hackathon — an AI agent that triages enterprise storage incidents with sandboxed LLM execution.
🤓 Latest Submissions
SRE Incident Agent — Blast Radius Zero
The problem. An on-call SRE facing a cryptic 500-line log spends 20–40 minutes of manual grep/correlate work to know what broke and what to do first. LLM assistants can draft guesses, but executing LLM-generated code on a real system is the classic blast-radius problem: run it blind, with network access and secrets in the environment, and a hallucinated diagnostic becomes an incident itself. What we built. SRE Incident Agent closes the loop safely. Paste a log — the LLM plans a diagnostic step, the step runs as real Python in an isolated Docker container, the verified stdout and exit code feed back into the agent's context, and after ≤5 steps it returns a triage report: findings backed by numbers from executed code, three ranked root-cause hypotheses, and an ordered runbook. Nothing the LLM claims is trusted unless an executed snippet printed it. Blast radius zero. The LLM-written code is the attack surface, closed in layers: a static guard refuses subprocess, sockets, URL fetches, file writes, eval/exec and host paths before anything runs (shown as BLOCKED · contained); each snippet runs in a one-shot container with --network none, 256 MB RAM, 1 CPU, 64 pids, read-only rootfs, uid nobody, no-new-privileges — destroyed after every run; secrets never enter the container; a hard 20 s kill per step. The video shows a live containment moment: a hallucinated exfiltration snippet blocked pre-execution. On Vultr. The full backend runs on a Vultr Compute VM (Amsterdam): FastAPI, the Docker sandbox runner, Caddy/TLS. All LLM calls go to Vultr Serverless Inference — primary deepseek-v4.1-flash-1017, whole-step fallback retries on mimo-v2.6-flash. Business case. The author supports storage systems and virtualization fleets already off vendor support, where every incident is triaged manually: this cuts incident triage from ~30 min to ~60 s, with evidence attached.
8 Nov 2026
