Welcome to episode 368 of The Cloud Pod, where the forecast is always cloudy! Justin, Matt, and Ryan are in the studio this week, and the major story is the GitHub outage – are you still digging out from that one too? We have MANY thoughts. Plus, we have news from EKS, CloudShell, and some major Microsoft changes to the Copilot ecosystem. There’s a lot to cover, so let’s get started!
Titles we almost went with this week
- Amazon Quick Crashes Microsoft’s Copilot Party
- Bin-Packing Pods Like a Kubernetes Tetris Champ
- AWS Agents Go GA and Grab Your Wallet
- AWS Finally Shows You The Money Trends
- AWS Hands Out Power (User Access) Like Candy
- AWS Builds Lofts, Developers Build Everything Else
- Front Door Now Checks IDs Before Letting Traffic In
- CloudShell Ditches Vim, Editors Rejoice Everywhere
- AWS Sign-In Gets a Facelift, Scripts Get Nervous
- Azure Front Door Gets Mutual TLS, Trust Issues Resolved
- One Copilot to Rule Work and Play
- GPT-5.6 Sol Hits Warp Speed With Cerebras
- OpenAI Ditches Overnight Batches for Ultrafast Gratification
- Ultrafast API Proves Speed and Smarts Aren’t Rivals
- Terraform Plans Meet Their IAM Autopilot Match
- AWS Autopilot Now Reads Your Terraform Tea Leaves
A big thanks to this week’s sponsors:
We’re sponsorless! Want to get your brand, company, or service in front of a very enthusiastic group of cloud news seekers? You’ve come to the right place! Send us an email or hit us up on our Slack channel for more info.
Follow Up
01:02 Microsoft confirms GitHub is down worldwide
- GitHub confirmed a widespread Github outage starting at 9:40 AM EDT on August 17, 2026, affecting web, API, Actions, Pull Requests, Issues, Webhooks, and authentication services including SAML, OIDC, and SCIM.
- As of the 11:42 AM EDT update, GitHub has moved into mitigation mode, but error rates remain unchanged at roughly 20% for web and API traffic and approximately 50% for archive and raw repository content downloads.
- Copilot was added to the list of affected services at 10:31 AM EDT, extending impact beyond core Git functionality into GitHub’s AI coding tools.
- Git Operations, Packages, Pages, and Codespaces remain listed as operational, indicating the outage is concentrated in specific service areas rather than the entire platform.
- GitHub has not disclosed a root cause, and the incident remains under investigation, meaning listeners relying on CI/CD workflows through Actions should expect continued disruption until further updates are posted.
- Complicating factors that impeded recovery included a number of scraping attacks on codeload endpoints.
- To prevent recurrence, our follow-up actions include:
- Correcting autoscaling policies to account for service-mesh sidecar concurrency and capacity.
- Auditing Istio request, concurrency, and scaling limits across affected services.
- Reviewing retry limits and backoff behavior across gateways and clients.
- Addressing the VS Code retry behavior that amplified Copilot token traffic.
- Improving load-balancer capacity monitoring and regional failover safeguards.
01:15 Justin – “What’s left? Just call it. It’s all down.”
AI Is Going Great – or How ML Makes Money
11:24 New in Claude Managed Agents: self-hosted sandboxes and MCP tunnels
- Anthropic added two new capabilities to Claude Managed Agents: self-hosted sandboxes (public beta) and MCP tunnels (research preview), both aimed at keeping agent tool execution and data within enterprise security boundaries.
- Self-hosted sandboxes split the architecture so Anthropic’s infrastructure handles agent orchestration and context management, while actual tool execution, code, files, and data stay on the customer’s own infrastructure or with managed providers like Cloudflare, Daytona, Modal, or Vercel.
- MCP tunnels let Managed Agents connect to internal databases, private APIs, and ticketing systems without exposing them publicly; a lightweight gateway makes a single outbound connection, requiring no inbound firewall rules or public endpoints, with end-to-end encryption.
- Four sandbox providers offer different tradeoffs: Cloudflare uses microVMs with zero-trust egress control, Daytona provides long-running stateful sandboxes with SSH access and pause/restore, Modal targets AI workloads with sub-second startup and GPU support at scale, and Vercel offers millisecond startup with credential injection at the network boundary.
- Early adopters include Amplitude (Design Agent on Cloudflare), Clay (GTM agent Sculptor on Daytona), and Rogo (financial analyst agent on Vercel Sandbox), signaling enterprise use cases where data residency and compliance requirements matter for agentic AI deployment.
11:42 Justin – “Music to Ryan’s ”
14:59 Previewing Ultrafast mode: GPT‑5.6 Sol at up to 14X the speed
- OpenAI is previewing Ultrafast, a new API service tier for GPT-5.6 Sol that runs up to 14x faster than standard processing, generating up to 750 output tokens per second, powered by Cerebras hardware.
- Unlike prior speed tradeoffs that required smaller or more specialized models, Ultrafast delivers the full GPT-5.6 Sol model at high throughput, meaning developers no longer have to sacrifice intelligence for latency.
- Early customers including Jane Street are testing Ultrafast across incident response, financial research and fraud detection, customer support, commerce, and iterative research workflows, with OpenAI citing internal use for log analysis and rapid experimentation loops that previously ran overnight.
- The service is currently in limited preview with a select group of customers, and OpenAI is accepting signups for notifications as access and capacity expand, so pricing and general availability details are not yet public.
- The Cerebras partnership highlights a broader trend of AI providers pairing with specialized inference hardware to reduce latency for real-time use cases, which could shape how cloud providers position GPU versus alternative accelerator offerings for latency-sensitive workloads.
15:48 Ryan – “I imagine there’s some beefy infrastructure behind this.”
Cloud Tools
16:42 Announcing: Docker VMM Public Beta
- Docker replaced its third-party virtualization layer with a first-party VMM built in-house, giving them full control over the stack that sits between host hardware and containers on Mac and Windows Docker Desktop installs.
- The switch targets concrete pain points: faster container startup, faster file I/O for edit-compile-test loops, and memory returned to the host when containers are idle rather than held indefinitely.
- Windows developers get a notable change here, moving to a VMM built and maintained directly by Docker, aiming for Hyper-V-level isolation combined with WSL2-like speed.
- The same engine also powers Docker Sandboxes, so improvements and future enterprise admin controls or governance features land in both products simultaneously, part of a stated longer-term goal of a unified runtime across laptop, cloud, and on-prem environments.
- Rollout is opt-in now via Docker Desktop v4.86 with no waitlist, beta running through fall, and GA targeted for end of October 2026 when it becomes the default engine across Mac, Windows, and Linux.
17:42 Matt – “I stopped using Docker when they changed all their licensing; I just use Podman for most of my personal stuff without any real problem.”
19:12 Packer V1160 Brings Verifiable Provenance To Machine Images
- Packer 1.16.0 adds SLSA provenance attestation to machine image builds, providing teams with a verifiable record of how an image was built, including the source, build steps, and the environment used.
- This addresses supply chain security concerns by allowing organizations to cryptographically verify that a machine image was built as expected, without unauthorized modifications, before deploying it to production.
- The provenance data includes metadata about the build environment, plugin versions, and configuration, which can be checked against SLSA framework standards for build integrity.
- Integration works within existing Packer workflows, so teams adopting this feature do not need to significantly restructure their existing image-building pipelines.
- For engineers managing compliance requirements or working in regulated industries, this provides an audit trail for machine images similar to software bill of materials practices already common in application security.
21:06 Matt – “It’s always amazing the additional features they slowly keep adding to these tools. Packer’s been around for 10+ years, and they rewrote it from Ruby to Go again…”
AWS
22:51 How AWS IAM role manager rethinks the starting point for IAM roles
- IAM role manager automates role creation and attachment for supported services like Lambda and EventBridge, eliminating the manual step of writing trust policies and attaching permissions before building.
- Enable it via IAM console account settings, or control access at the org level with an SCP.
- For services with unpredictable permission needs, such as Lambda functions running custom code, role manager attaches the PowerUserAccess managed policy, which excludes IAM, Organizations, and account settings management, giving broad service access without full admin rights.
- Roles created by role manager are standard IAM roles that customers fully own and can view, edit, or delete; each role retains a reference to its source template, visible via GetRole and ListRoles, and creation events are logged in CloudTrail.
- AWS recommends disabling role manager before production deployment and using IAM Access Analyzer to scope roles down to least privilege; disabling grants 90 days of unused access analysis at no additional cost.
- Positioned as a tool for development and sandbox environments to accelerate prototyping, with the tradeoff that broader permissions (like PowerUserAccess) need tightening before production use, shifting security review to a later stage in the workflow rather than eliminating it.
24:16 Ryan – “I wish that the managed roles that it was attaching and building were a little more granular… and not so permissive.”
26:44 Introducing advanced Kubernetes control plane configuration in Amazon EKS
- EKS now exposes direct configuration of API server, scheduler, and controller manager settings, letting admins tune pod placement, event retention, and node port ranges without maintaining a custom scheduler or workaround infrastructure. This targets teams migrating from self-managed Kubernetes who need to preserve tuned settings.
- The MostAllocated scoring strategy is a notable addition, allowing clusters to bin-pack pods onto already-utilized nodes rather than the default spreading behavior, which can reduce the number of active nodes and lower compute costs for batch, CI/CD, and AI/ML workloads.
- Event retention (eventTtl) is now configurable, letting customers shorten the default one-hour window to reduce etcd storage pressure on high-churn clusters, or lengthen it for extended debugging, with the tradeoff being a narrower window for kubectl get events and describe pod history.
- The horizontalPodAutoscalerSyncPeriod parameter requires an EKS Provisioned Control Plane and pairs with a separate improvement increasing HPA sync concurrency up to 40x the default Kubernetes value, aimed at faster scaling reactions for large clusters with many HPA objects.
- Configuration is managed through existing CreateCluster and UpdateClusterConfig APIs with console, CLI, and CloudFormation support today, eksctl, ACK, and Terraform support planned, at no additional charge beyond standard EKS and Provisioned Control Plane pricing.
- Available on Kubernetes 1.31+ clusters across commercial, GovCloud, and China regions.
27:40 Justin – “I appreciate this, but also, if this is your problem, think about maybe separating your blast radius.”
30:29 Monitor on-premises and multi-cloud AI agents with AgentCore Observability
- AWS extends Bedrock AgentCore Observability beyond native AWS runtime, enabling monitoring of AI agents running on-premises or on other clouds like GCP and Azure using AWS Distro for OpenTelemetry (ADOT). Auto-instrumentation, so teams no longer need separate monitoring stacks for agents deployed outside AWS.
- The solution requires three components: ADOT auto-instrumentation for the agent framework, IAM credentials for SigV4 authentication, and specific OpenTelemetry environment variables to route telemetry to the CloudWatch OTLP endpoint, giving a unified observability dashboard regardless of where agents run.
- AWS validated the approach on both on-premises setups and Google Cloud Shell, confirming identical telemetry output, including sessions, traces, span metrics, token usage, and latency, whether the agent runs on AgentCore runtime or a competitor’s cloud.
- This matters for multi-cloud and hybrid AI deployments where visibility into agent reasoning chains, tool invocations, and model outputs is needed to detect hallucinations, monitor for harmful outputs, and track token usage for cost governance across distributed environments.
- For production use, AWS recommends IAM Roles Anywhere over long-lived access keys for on-premises workloads, and the underlying cost comes from standard Amazon Bedrock, CloudWatch, and X-Ray usage rather than a separate fee for the observability capability itself.
- Sample code is available on GitHub here.
34:02 Amazon Quick for Microsoft 365: Agentic AI where you work
- AWS is bringing Amazon Quick’s agentic AI directly into Word, Excel, PowerPoint, and Outlook, letting users interact with connected enterprise data (QuickSight, Salesforce, Jira, SharePoint, Slack) without leaving Microsoft 365 apps.
- The extensions are agentic rather than simple chatbots, meaning the AI can directly edit documents, insert sections, generate charts from live data, and draft emails with full thread context, then track all changes via an audit trail with visual comparisons.
- Deployment requires no client-side installation since everything runs in the cloud; IT admins can push extensions through the Microsoft 365 admin center, and no additional licensing is needed for Quick customers on Plus, Professional, or Enterprise plans, though Outlook typically requires admin approval due to Graph API permission restrictions.
- Available now across seven AWS regions including US East, US West, three European regions, Sydney, and Tokyo, with data residency maintained in the selected region and no public egress from backend infrastructure.
- This positions AWS to compete more directly with Microsoft Copilot by embedding cross-platform data access (AWS plus third-party SaaS tools) into the Microsoft 365 experience customers already use daily, potentially reducing friction for enterprises using both AWS and Microsoft ecosystems.
34:45 Justin – “At least this doesn’t (apparently) install until you enable it in the marketplace first, which is slightly better.”
35:37 AWS Certificate Manager will discontinue email validation to prove domain validation for certificates
- ACM is discontinuing email validation for public certificates by September 30, 2027, requiring migration to DNS validation ahead of the CA/B Forum’s industry-wide March 15, 2028 deadline.
- Key milestones: no email validation in new regions starting January 1, 2027, no new email-validated certificate requests after March 31, 2027, and no renewals of email-validated certs after September 30, 2027.
- The new UpdateCertificateOptions API lets customers switch a certificate’s validation method from email to DNS in place, preserving the certificate ARN so no downstream resource changes are needed.
- After triggering the update, customers have 72 hours to add a provided CNAME record, with the certificate continuing to function on email validation during that window.
- DNS validation enables automatic certificate renewal as long as the CNAME record remains in place, removing the manual approval step required by email validation.
- For CloudFront-specific use cases, ACM also offers HTTP validation as an alternative, hosting a token at a well-known URL path.
- Customers can identify affected certificates via the ACM console (filtering by Validation method = Email and Type = Amazon Issued), or the AWS CLI, and Route 53 users get a one-click option to create the required validation records directly.
- This is a compliance-driven change tied to browser trust requirements, not an AWS-specific decision, so certificates issued via email validation after March 2028 won’t be trusted by browsers regardless of certificate authority.
- Listeners managing ACM certificates should audit their validation methods now, since AWS is providing roughly a year of buffer before the industry-wide deadline.
35:43 Justin – “Finally killing a piece of code that Jonathan wrote – almost 12 years ago – that would automatically click in the email ‘accept’”.
40:10 AWS Billing and Cost Management introduces Managed Dashboards
- AWS adds five preconfigured, read-only dashboards to Billing and Cost Management, covering cost overview and trends, compute, database, reservations, and savings plans, with data automatically populated for existing accounts.
- The Cost Overview and Trends dashboard provides 12 months of historical spending data broken down by service, account, and region, plus forecasting for future costs.
- The Reservations and Savings Plans dashboards quantify underutilization and coverage gaps in dollar terms, helping teams identify wasted commitment spend without manual analysis.
- Dashboards can be duplicated into fully editable custom versions, support adding individual widgets, and allow export to PDF or CSV for reporting purposes.
- Available at no additional cost in all commercial AWS regions, this lowers the barrier for teams starting FinOps practices or standardizing cost visibility across multiple accounts without initial setup work.
40:31 Justin – “I mean, thank you, but how about you make it so I can share those dashboards between accounts?”
42:14 Amazon EC2 Auto Scaling now supports batch instance termination
- EC2 Auto Scaling now allows batch termination of up to 100 instances in a single TerminateInstanceInAutoScalingGroup API call, cutting down the number of calls needed to scale down groups.
- Targeted at workloads with rapid scale-down needs, including AI/ML training jobs, container orchestrators, and event-driven architectures that spin up temporary fleets.
- All instances in a batch are validated atomically before termination starts, and existing behaviors like lifecycle hooks and load balancer connection draining still apply per instance.
- Available in all AWS Regions at no additional cost, making it a straightforward efficiency improvement for existing Auto Scaling users without requiring architecture changes.
- Reduces API call volume and potential throttling for customers managing large-scale, ephemeral compute fleets, which is useful for cost and operational overhead in high-churn environments.
44:57 In the works: AWS Builder Lofts in Berlin, Hyderabad, and São Paulo
- AWS is expanding its Builder Loft program with permanent locations in Berlin, Hyderabad, and São Paulo, following the first location in San Francisco, which opened in July 2025 and has hosted over 22,500 developers.
- These are free, permanent community spaces offering workshops, hackathons, pitch nights, and co-working areas for developers, students, and tech professionals, distinct from AWS’s earlier temporary Pop-up Lofts and Gen AI Lofts.
- City selection ties to regional strategy: Berlin will focus on digital sovereignty content following the AWS European Sovereign Cloud launch, Hyderabad targets AI and cloud-native upskilling, and Sao Paulo addresses Brazil’s cloud market, which AWS cites as growing 30% annually.
- Programming is community-driven, with local user groups and meetup organizers able to book space at no cost, while AWS provides the physical infrastructure and support staff.
- No specific opening dates were provided for the three new locations, with AWS stating further details will come in future blog posts, but you can check out planned events here.
47:48 Updates to your AWS Sign-In experience
- AWS is rolling out a redesigned sign-in page with a unified email entry point, replacing the current root user versus IAM user selection step; the system automatically detects the correct sign-in flow based on the email entered.
- The update also supports sign-in via third-party identity providers like Google, GitHub, Apple, or Amazon.com for accounts created with those providers, alongside existing IAM Identity Center and federation methods, which remain unchanged.
- A refreshed session selection page lets users view and manage multiple active account or role sessions in one place, showing account, role, and recent sign-in details, with options to switch sessions, sign out, or add a new session.
- The rollout is gradual and opt-in initially, with a banner on the current sign-in page allowing users to try the new experience before it becomes default; switching back requires clearing browser cookies.
- Organizations relying on browser automation or scripted workflows tied to the current sign-in UI should review the changes now, as the redesign could break existing scripts; AWS recommends using supported programmatic access options for more stable automation.
48:26 Ryan – “Oh look. It just looks like trash…”
53:56 AWS CloudShell now includes a built-in visual file editor
- CloudShell now includes a built-in visual editor, launched via a simple edit command, removing the need for Vim, Emacs, or local file downloads to make quick changes.
- The editor supports standard GUI features like syntax highlighting, find-and-replace, multi-line selection, and undo-redo, addressing a long-standing friction point for users editing scripts, Lambda functions, or CloudFormation templates directly in the browser.
- This is a workflow improvement rather than a new service, but it targets a common pain point for DevOps engineers and cloud administrators who use CloudShell for quick edit-and-run tasks without needing a full IDE setup.
- No additional cost since it is bundled into CloudShell, which is already free to use within its standard compute and storage limits.
- Available immediately in all regions where CloudShell operates, so there is no phased rollout for teams already using CloudShell to track.
56:01 Amazon Bedrock AgentCore payments is now generally available: Enabling agents to transact safely and autonomously at scale
- AgentCore payments moves from preview to GA, letting AI agents autonomously pay for APIs, MCPs, and web content using stablecoin wallets from Coinbase and Stripe Privy, with credentials secured via AgentCore Identity Secrets Manager rather than exposed to the agent itself.
- The service now supports multiple payment protocols, including x402 and the newly added Machine Payment Protocol (MPP), plus an “up to” spending-ceiling scheme that enables true pay-per-inference pricing rather than fixed-cost transactions.
- Built-in guardrails include payment sessions with configurable spend caps and expiry times, addressing the risk of non-deterministic agents misinterpreting responses or triggering duplicate payments; observability integrates with CloudWatch and AgentCore Observability for transaction audit trails and success-rate dashboards.
- Real customer deployments span multiple use cases: Anchor Browser for paywalled web content, BlockRun/SpreadX for pay-per-inference model routing, and Travala for conversational hotel booking through MCP servers, with Cloudflare’s Monetization Gateway providing broader content access.
- Developers can get started via the AgentCore console, CLI, or coding assistant skills (Claude Code, Kiro, Codex), with framework integrations for Strands Agents, LangGraph, and OpenClaw; full setup details are available at the AgentCore payments quick start guide.
- What could possibly go wrong?
56:36 Justin – “I love the fact that they’re like, ‘it’s not real money, it’s just stablecoin money! If you lose your fake money, you can’t get *that* mad… because it’s the wild, wild west of unregulated bitcoins/stablecoins; we can do terrible things that no one should ever care about when we lose your money for you.”
57:18 IAM Policy Autopilot now supports Terraform plan files
- IAM Policy Autopilot now accepts Terraform plan files as input, extending its scope beyond application source code to infrastructure deployment permissions, generating CRUD-scoped policies for the resources defined in a plan.
- This was reportedly the most requested feature since the tool launched at re:Invent 2025, addressing a gap where teams could scope application-level IAM permissions but had no equivalent tooling for the deploy-time permissions Terraform itself needs.
- Generated policies reference specific resource ARNs rather than wildcards where possible, which helps teams move away from overly permissive deployment roles that grant broad access across resource types.
- The tool complements existing Terraform-aware analysis that cross-references resource definitions with SDK calls in application code, so teams can now generate both runtime and deployment IAM policies from the same tool.
- IAM Policy Autopilot is open source, free to use, and runs locally rather than as a managed service.
- Available via the AWS Labs GitHub repository for teams to integrate into their CI/CD or local workflows. (Assuming Github it up when you go to look for it…)
58:44 Ryan – “So think about where you want to define your IM policy, where you wanna say, access to only the specific resource name or resource name asterisk, that kind of thing. So this way you couldn’t do that for anything that the AWS provider was gonna dynamically generate as it runs; this way you could, based off of the plan, it would all the data lookups and stuff would happen, but before they apply, so not everything, but you’d at least have that ability.”
GCP
1:02:04 Gemini 3.7 Flash: our most intelligent workhorse model
- Google released Gemini 3.7 Flash just three weeks after 3.6 Flash, showing measurable gains in coding tasks, with FrontierCode scores improving from 34.4% to 43.6% and DeepSWE from 49.0% to 65.3%.
- The model outperforms 3.6 Flash on WebDev Arena (1588 vs 1538 Elo) and shows notable improvement in document processing accuracy on the GDP.pdf benchmark, up from 22.0% to 34.0%.
- Pricing is set at an introductory rate through year-end of 0.75 dollars per 1M input tokens and 3.75 dollars per 1M output tokens, roughly half the cost of 3.6 Flash, making it more accessible for production agent deployments.
- The model powers Gemini Spark, Google’s personal AI agent available to AI Pro and Ultra subscribers in over 160 countries, with improved tool use for Workspace apps like drafting emails and consolidating files.
- Availability spans multiple access points including Google Antigravity, Gemini API via AI Studio and Android Studio for developers, plus Gemini Enterprise Agent Platform for business customers through Google Cloud console.
- Google updated safety safeguards specifically targeting CBRN and cyber offense misuse risks, reflecting ongoing frontier safety work alongside the performance improvements.
1:02:52 Ryan – “Well, the only good thing is if it’s only going to be out there for 3 weeks, you don’t need to worry too much about migrating off 3.6, so that’s good.”
Azure
1:03:38 Public Preview: Azure Front Door mutual TLS
- Azure Front Door now supports mutual TLS in public preview, letting the service authenticate clients using X.509 certificates at the edge before requests reach the origin application, useful for B2B, IoT, financial services, and enterprise scenarios requiring client-level verification.
- Four validation modes give customers flexibility: require and validate, require without validation, validate when presented, and pass through to origin, so teams can decide whether Front Door or the origin server handles certificate checks.
- Client certificates are forwarded to the origin via the X-Azure-ClientCertificate header, meaning origin applications can access certificate details even in modes where Front Door skips validation.
- Both public and private certificate authorities are supported, with trusted CA chains stored in Azure Key Vault and tied to a Front Door custom domain, integrating this feature directly with existing Azure Key Vault workflows.
- This adds another layer of zero-trust-style security at the CDN and edge layer, worth discussing alongside other Front Door security features like WAF for a fuller picture of Azure’s edge security stack.
1:04:03 Justin – “My recommendation is to pass to origin and don’t make Azure Front Door do this, because as Matt will tell you, it takes potentially four to seven days to update your Azure Front Door, depending on the current outage situation of the process.”
1:05:14 Generally Available: Batch rule updates for Azure Front Door
- Azure Front Door Standard and Premium now support batch rule updates as a GA feature, letting customers add, update, delete, or reorder multiple rules in a rule set as a single atomic operation.
- The all-or-nothing approach prevents partial rule states and rule-order conflicts that previously occurred when rules were updated individually, which is particularly useful for teams managing complex rule sets via Terraform or other IaC tools.
- Customers must explicitly opt into batch mode when creating a new rule set and submit the complete desired configuration; existing rule sets default to classic rule management, so this is backward compatible and non-disruptive to current deployments.
- This addresses a practical pain point for DevOps teams: reducing deployment retries and rollback complexity when coordinating changes across large rule sets, improving overall deployment safety and predictability.
- No pricing changes are mentioned since this is a management capability rather than a new billable resource; it’s available now as part of standard Azure Front Door Standard and Premium tiers.
1:05:25 Justin – “Based on the prior comment about how long it takes to update these Azure Front Doors, that’s a blessing.”
1:06:27 Microsoft starts merging its Copilot consumer and business apps in advance of ‘Super App’ rollout
- Microsoft is merging its consumer and commercial Copilot apps into a single Microsoft Copilot app, a precursor to a broader Super App expected by the end of September that will combine chat, coding, Cowork, and AutoPilot agents.
- Rollout is phased: Windows Insiders this week, broader mobile and web worldwide in mid-August, Windows and Mac apps in mid-September. Commercial changes are largely cosmetic, including a name change and new URL (copilot.cloud.microsoft replacing m365.cloud.microsoft).
- Several consumer features are being retired on August 18, including Copilot Podcasts, Group Chat, and Deep Research.
- Deep Research’s replacement, Researcher, will only be available to Microsoft 365 Premium subscribers, not Personal or Family tiers.
- Microsoft states work and personal accounts remain logically separated within the unified app, with no data crossover and unchanged enterprise security and compliance controls, though IT admins will need to reapply Windows Recall exclusion settings since they won’t carry over automatically.
- Adoption context: Microsoft 365 Copilot has surpassed 30 million paid seats (about 7% of 450 million commercial M365 seats), while the consumer app has an estimated 38.5 million monthly users, compared to ChatGPT’s reported 1 billion monthly users, highlighting the competitive gap Microsoft is trying to close.
1:10:11 Azure Container Apps Sandboxes (Preview): Giving AI Agents a Safe Place to Work
- Azure Container Apps Sandboxes (Preview) provide hardware-isolated microVMs for running untrusted AI agent code, addressing the tradeoff between giving agents useful permissions and limiting security exposure. Sandboxes start in seconds, scale to thousands, and incur no compute charges while stopped.
- Key controls include egress allow-listing to restrict network access, managed identities for secretless Azure authentication, and snapshots that capture a configured environment for reuse, reducing repeated setup time for long-running or recurring agent tasks. Newer features add VNet integration for private endpoint access and bring-your-own-storage for persisting data under compliance requirements.
- This is the same underlying compute fabric used by GitHub Copilot cloud sandboxes, Foundry Hosted Agents, and Azure Container Apps Express, now exposed directly for developers to build custom multi-tenant agent platforms.
- Templafy, an enterprise platform vendor, built a production Slack-based code exploration agent on Sandboxes, using restricted egress and snapshots to safely clone repos, run tooling, and resume warm workspaces for follow-up questions. They built a custom TypeScript SDK to drive the sandbox lifecycle before an official SDK existed.
- Relevant for teams building agentic workflows that need to execute code, browse internal codebases, or hit internal endpoints without inheriting the full blast radius of production infrastructure. Get started at sandboxes.azure.com, with documentation and samples available on GitHub at azure-samples/azure-container-apps-sandboxes.
54:46 Ryan – “More and more of this isolation and control from a platform level is the way to go.”
Oracle
1:11:09 Oracle and AWS Deepen Strategic Collaboration as Enterprise Adoption of Oracle AI Database@AWS Accelerates
- Oracle Exadata Database Service on Exascale Infrastructure is now generally available on Oracle AI Database@AWS, offering pay-per-use pricing and pooled storage that removes the need to provision dedicated database and storage servers.
- It’s worth noting that this brings Exadata economics to smaller workloads, not just large enterprise deployments.
- The expanded strategic agreement between Oracle and AWS focuses on accelerating migration, with the service now live in 22 AWS Regions just one year after general availability; listeners should weigh whether this reflects genuine enterprise demand or aggressive partner incentives (Migration Accelerator funding, channel partner private offers).
- Sub-200 microsecond latency (as low as 165 microseconds) using AWS EC2 placement groups is a notable technical claim for OLTP and ERP workloads, though hosts may want to scrutinize what conditions and configurations are required to actually hit that number in production.
- Zero-ETL integration with Amazon Redshift and direct access to Amazon Bedrock, SageMaker, and Quick services lets customers apply AWS AI tools to Oracle data without moving it, a practical selling point, but customers should evaluate lock-in and cross-cloud cost implications before committing.
- Customer references (CJ Olive Young, Kobalt Music Group, ATM Barcelona) point to real production use in regulated and latency-sensitive sectors, but as with most launch-anniversary announcements, concrete pricing details remain vague, and cost comparisons against native OCI or standalone AWS database services aren’t provided.
1:12:42 Justin – “I do kind of miss the Andy Jassey days when AWS and Oracle hated each other.”
1:13:07 Announcing the New OCI Service Limit Increase Experience
- Oracle redesigned the OCI service limit increase request workflow using its Redwood design standards, consolidating limits, quotas, and usage into a single console page under Governance and Administration.
- The new process adds a three-step guided workflow with service-specific questionnaires intended to reduce back-and-forth follow-up questions during evaluation, plus a unique request OCID for tracking and auditing.
- This is largely a UX and process update rather than a new capability, worth noting since it doesn’t change actual limit values or quota policies, just how customers request increases.
- All requests now funnel through one form on the Limits, Quotas, and Usage page, replacing any prior alternate paths, so admins should update internal documentation or runbooks referencing older request methods.
- No pricing is involved since this is a console workflow improvement, but Oracle is soliciting customer feedback via survey to guide future iterations, suggesting more changes are likely coming.
- Is it as good as Amazon’s? Yes. Yes, it is.
Closing
And that is the week in the cloud! Visit our website, the home of the Cloud Pod, where you can join our newsletter, Slack team, send feedback, or ask questions at theCloudPod.net or tweet at us with the hashtag #theCloudPod
