Security
Magento 2 Patch Installer: Composer Patches Checked Against Disk
A Composer plugin that applies Magento 2 and Adobe Commerce patches, re-checks them against the files on disk on every Composer run, and fails the build when one is missing.
Magento 2 DevOps
CI/CD pipelines, deployment automation, infrastructure as code, and operational best practices for Magento 2 — from a Cardiff-based engineer with 8+ years in the Magento ecosystem.
Running Magento 2 in production demands more than just good code - it requires reliable CI/CD pipelines, automated deployments, infrastructure as code, and solid monitoring. The gap between a Magento store that's deployed manually via SSH and one backed by a mature DevOps practice is the difference between hoping things work and knowing they do.
This hub brings together production-tested Magento DevOps content covering the full operational lifecycle: from GitHub Actions and Bitbucket Pipelines for continuous integration, to Ansible and Terraform for infrastructure provisioning, to Sentry and NewRelic for monitoring and observability. Every guide is based on real-world experience operating Magento stores for UK agencies and merchants.
Whether you're setting up your first deployment pipeline, automating Magento's quarterly patch cycle with Dependabot, or building ephemeral feature environments for your development team - you'll find practical, immediately applicable guidance. I've optimised static content deployment build times, built automated update pipelines that handle Magento's complex dependency graph, and designed chaos engineering approaches for ecommerce platforms.
Magento DevOps Articles
Blog posts covering deployment, CI/CD, infrastructure, and operational practices for Magento 2.
Magento 2 E2E Testing: A Playwright Suite You Configure, Not Fork
An open source Playwright end to end testing suite for Magento 2.4.7 to 2.4.9 and Mage-OS, with Luma and Hyvä supported out of the box, adapted to a store through five JSON config files instead of a per-client fork.
m2-meta-security-patches Swaps vaimo for a New Patch Installer
m2-meta-security-patches now applies patches through samjuk/magento-patch-installer instead of vaimo/composer-patches. Two config lines, one composer update, and it coexists with vaimo or cweagans.
StyleSmuggler and September's Isolated Patch Land in m2-meta-security-patches
Adobe shipped two Magento 2 security patches a day apart — the StyleSmuggler emergency fix (VULN-39341 / APSB26-146) and September's routine isolated patch (2026-09-001 / APSB26-138). Both are now wired into m2-meta-security-patches.
APSB26-92: Adobe Commerce's August 2026 Isolated Patch
APSB26-92 is Adobe Commerce's August 2026 isolated security patch, stacking on top of July's. Here's what's in it, WAF rules for the account takeover, the July packaging problems now fixed properly, and a vaimo/composer-patches bug that silently reverts your patches.
APSB26-73: How to Apply Adobe Commerce's July 2026 Isolated Security Patch
APSB26-73 is Adobe Commerce's July 2026 isolated security patch, covering 2.4.6-p15, 2.4.7-p10, 2.4.8-p5 and 2.4.9. Here's what's in it, the non-cumulative gotcha that trips people up, and the fastest way to apply it.
Operational Maturity Before AI Velocity: What Your Magento Team Needs First
AI is a force multiplier for Magento development — but it multiplies whatever processes you already have. Here's the operational stack your team needs before leaning heavily into AI-generated output.
Adobe's Isolated Patch Strategy: A Community Response
Adobe's new monthly isolated patch approach for Magento creates maintenance burden. Here's how a community meta-package can help restore sanity to security patching.
Cloudflare Outage November 2025 - Retrospective
Cloudflare accidentally took half the internet down for half a day, right before Black Friday. What can we learn from this, and how can we engineer more resilient infrastructure to survive similar outages in the future?
How to efficiently patch Magento 2 deployments at scale
Approaches to simply deploying patches across a large inventory of Magento 2 deployments
DevOps & Infrastructure Docs
Step-by-step guides for pipelines, automation, and infrastructure management.
CI/CD Pipelines
Pipeline architecture and automation strategies
GitHub Actions
Workflows, artifact cleanup, SSH config, and Dependabot
Bitbucket Pipelines
Bitbucket-specific pipeline configuration and Renovate
Ansible Automation
Provisioning and patching automation for Magento servers
Terraform Infrastructure as Code
Cloudflare and infrastructure management with Terraform
Monitoring & Observability
NewRelic optimisation and monitoring best practices
Automated Magento Updates
Dependabot-driven update workflows for Magento
Optimise SCD Build Process
Speed up Magento static content deployment
Magento Patching
Patching strategies and composer-based workflows
Module Config Diff
Diff Magento module state between config files or git refs in CI
Infrastructure & Monitoring
Broader infrastructure and observability content relevant to Magento operations.
Copy Fail 2 / DirtyFrag (CVE-2026-31431): Container Escape & LPE Follow-Up
The sequel to CopyFail: DirtyFrag extends the CVE-2026-31431 exploit chain to container escape. Covers the new attack surface, detection, and mitigations beyond the algif_aead workaround.
CopyFail (CVE-2026-31431): Linux Kernel LPE — Detection, Mitigation & Distro Patch Status
CVE-2026-31431 is a Linux kernel local privilege escalation via algif_aead. Covers exploit mechanics, detection, the algif_aead mitigation, and patch status across Ubuntu, Fedora, Debian, RHEL, and more.
Consolidating My Online Presence: Moving Blog and Docs to One Home
Why I’m consolidating my blog and documentation into my main site: reducing infrastructure, improving clarity, and strengthening my personal brand and SEO.
Is Self-Hosted Sentry Worth It? An Honest Review After Running It in Production
The real maintenance burden, resource requirements, what breaks, and when you should just pay for cloud — after running self-hosted Sentry in production.
Delete GitHub Actions Artifacts Automatically: Reusable Cleanup Workflow
GitHub Actions accumulates artifacts fast. How to automatically delete old artifacts using a reusable workflow — with age filters, size limits, and per-repo scheduling.
Self-Hosted Sentry in 2026: Docker Compose Setup, Requirements & Honest Review
Step-by-step guide to running Sentry self-hosted with Docker Compose. Covers prerequisites, resource requirements, install steps, and an honest take on whether it's worth the maintenance burden.
DevOps Tools & Projects
Open-source CI/CD tooling, Docker images, and infrastructure automation for Magento.
Featured CI & testing
Magento 2 & Mage-OS Compatibility Matrix: magento.works
Magento 2 and Mage-OS compatibility matrix from 4,057 real Docker installs: which PHP, MySQL, MariaDB, OpenSearch and Redis versions each release runs on.
Security
Magento 2 Isolated Security Patches Through Composer
A Composer meta-package and installer that apply Adobe's isolated and emergency Magento 2 security patches and fail the build when one goes missing.
CI & testing
Magento 2 GitHub Actions: Reusable CI Workflows for Modules
Reusable GitHub Actions workflows for Magento 2 and Mage-OS modules: Composer validation, PHP lint, PHPCS, PHPStan and PHPUnit across a shared list of supported releases.
Featured CI & testing
Magento CI Docker Images: Pre-Installed Magento and Mage-OS
Signed Docker images with Magento 2.4.2 to 2.4.9 and Mage-OS pre-installed across PHP 7.4 to 8.5, for fast Magento module and project CI pipelines.
Infrastructure
Self-Hosted GitHub Actions and Bitbucket Runners in Docker
Docker images that register a self-hosted GitHub Actions or Bitbucket Pipelines runner on start and remove it on shutdown, scaled with Docker Compose or Swarm.
Frequently Asked Questions
What CI/CD tools work best with Magento 2?
GitHub Actions and Bitbucket Pipelines are both excellent choices. GitHub Actions offers better marketplace integration and Dependabot support, while Bitbucket Pipelines integrates well with Atlassian tooling. Both can handle Magento's composer-based builds, static content deployment, and automated testing.
How can I speed up Magento 2 deployments?
Key strategies include: optimising Static Content Deploy (SCD) with targeted locale and theme builds, parallelising build steps in your CI pipeline, using Docker-based build environments for consistency, and implementing zero-downtime deployment with symlink switching or Magento Cloud-style build/deploy phases.
What is the best way to automate Magento 2 updates?
Use Dependabot or Renovate to create automated pull requests for composer dependency updates. Combine this with a comprehensive CI pipeline that runs unit tests, integration tests, and static analysis. This approach catches breaking changes early and reduces the manual effort of quarterly patch cycles.
How do I monitor a Magento 2 store in production?
A robust monitoring stack includes: application performance monitoring (NewRelic or Datadog), error tracking (Sentry), uptime monitoring, Varnish cache hit rate tracking, and infrastructure metrics (CPU, memory, disk I/O). Alerting should cover response time thresholds, error rate spikes, and deployment events.
How do I run Magento 2 on AWS?
AWS is a strong choice for Magento 2 hosting. A typical production setup uses EC2 or ECS for the application tier, RDS (MySQL/Aurora) for the database, ElastiCache for Redis and session storage, and S3 for media assets behind CloudFront CDN. Terraform makes this reproducible and versionable. For smaller deployments, Lightsail or a single EC2 instance behind an Application Load Balancer is a pragmatic starting point.
Magento DevOps & infrastructure
I’ve been building and operating Magento platforms at scale for UK agencies and merchants, based in Cardiff, Wales. I work across CI/CD pipelines, infrastructure automation (Terraform, Ansible), monitoring, and incident response. Happy to connect with other engineers working on similar challenges.