Search
30 results for “css”
Search results
CSS Box Model & Stacking Context
Why box-sizing changes what "width" actually measures, and why a z-index of 9999 can still render below an element with z-index 5 once stacking contexts are involved.
CSS Grid vs Flexbox
When to reach for CSS Grid versus Flexbox, the one-dimensional vs two-dimensional distinction, with syntax and layout examples for each.
Name three CSS properties, besides z-index with positioning, that create a new stacking context, and why does that matter when debugging a layering bug?
Opacity below 1, any non-none `transform`, and `filter` or `backdrop-filter` with a value other than `none` all create a new stacking context, along with several others like `isolation: isolate` and `will-change` naming a stacking-context property. This matters when debugging because a completely unrelated-looking style change, adding a fade transition via opacity, or a hover effect via transform, can silently create a new stacking context and change how that element's children layer against the rest of the page, a z-index layering bug that has nothing to do with z-index values themselves, but with an accidental new stacking context somewhere in the ancestor chain.
What does box-sizing: border-box actually change about how width and height are calculated?
With the default `content-box`, `width` applies only to the content area, so padding and border are added on top, a 200px-wide box with 20px padding and a 5px border renders at 250px total. `border-box` makes `width` include content, padding, and border together, so that same 200px `width` stays 200px total regardless of padding or border, the content area itself shrinks to make room instead. This is why most modern projects apply `box-sizing: border-box` globally, it makes an element's declared width predictable and stable as padding/border change, instead of recalculating the total size by hand every time.
An element has z-index: 9999 but still renders behind another element with z-index: 5. How is that possible?
z-index values are only compared within the same stacking context, they are not globally comparable numbers. If the z-index: 9999 element sits inside a parent that itself created a new stacking context (say, that parent has opacity less than 1, or z-index: 1), the entire parent, and everything inside it, is treated as a single unit when compared against sibling stacking contexts elsewhere in the document. A useful mental model is version numbers: an element at z-index 6 inside a parent context at z-index 4 effectively renders at "4.6", which is still below a sibling element at z-index 5 ("5.0") in the root context, no matter how high the inner z-index value looks in isolation.
What is the core difference between Grid and Flexbox?
Flexbox lays items out along a single axis (row or column) and is content-driven, items can wrap, but each row or column sizes independently based on its own content. Grid lays items out on a two-dimensional row-and-column track system defined up front, so rows and columns can be aligned to each other across the whole layout. The practical rule: reach for Flexbox when you are arranging items in a line, Grid when you need rows and columns to line up together.
Can Grid and Flexbox be used together in the same layout?
Yes, and in practice most real layouts use both, Grid for the overall page or component structure (header, sidebar, main content, footer), and Flexbox inside individual grid areas for things like a horizontally arranged button group or a centered card. They are complementary tools, not competing ones.
How does the fr unit in Grid differ from flex-grow in Flexbox?
Both distribute available space proportionally, but fr operates on Grid tracks (rows/columns) as part of an explicit track list, `grid-template-columns: 1fr 2fr` splits width into three parts with the second column taking two of them. flex-grow operates on individual flex items along the main axis and only kicks in for leftover space after each item's base size is accounted for. fr is about defining the track structure; flex-grow is about how items compete for remaining space within it.
What is a managed identity, and what problem does it solve compared to a service principal with a client secret?
A managed identity is an Entra ID identity automatically managed by Azure for a resource (a VM, an App Service, a Function), with credentials that Azure handles entirely, no client secret is ever stored, retrieved, or rotated by the application. A traditional service principal with a client secret requires that secret to be stored somewhere (a config file, a key vault) and rotated manually or via automation, which is itself a credential-management burden and a leak risk. Managed identities remove that burden for the common case of "this Azure resource needs to authenticate to another Azure service," which is why they're preferred whenever the workload runs on Azure compute.
Why does wrapping several statements in `BEGIN`/`COMMIT` matter, even for a multi-step operation that's logically one action?
Without an explicit transaction, PostgreSQL commits each statement independently the moment it succeeds; if a multi-step operation (debit one account, credit another) fails halfway through, the database is left in an inconsistent, partially-applied state with no way to undo the completed step. Wrapping the statements in `BEGIN`/`COMMIT` groups them so they can be committed or rolled back together, but that alone isn't automatic protection against every failure mode: PostgreSQL only aborts a transaction on its own when a statement raises an actual SQL error, an `UPDATE` that runs successfully but matches zero rows (a mistyped account id, for instance) is not an error at all, and would otherwise be committed as if the transfer had actually happened. Making the transaction genuinely safe means checking that each `UPDATE` affected exactly the one row expected and issuing an explicit `ROLLBACK` if either check fails, only issuing `COMMIT` once both checks pass.
A component's state is preserved when a prop changes, but reset when a completely different element renders in the same spot. What determines which happens?
React associates state with a component's position in the render tree, not with the component instance or its props specifically. If the same component type renders at the same tree position across a re-render, its state is preserved regardless of what props changed. If a different component type (or a different element entirely) renders at that same position, React treats it as a genuinely different thing, destroys the old state, and starts fresh. This is why toggling a prop on the same `<Counter />` keeps its count, but swapping `<Counter />` for a `<p>` at that same spot in the tree resets it entirely, even though from the JSX it might look like a small, local change.
How to Configure Secure File System Management with NTFS Permissions and Mapped Drives in a Windows Server Domain (Lab Guide)
This lab demonstrates how to design and implement secure file system management in a domain environment using Active Directory, Windows Server 2019, and Hyper V. The focus is on enterprise style file sharing, using NTFS permissions, group based access control, and mapped network drives, all aligned…
How to Configure Site-to-Site VPN Connection on Azure
In many real world cloud environments, organizations need to securely connect their on premises network to Azure. This is especially common during cloud migrations, hybrid deployments, or when extending existing infrastructure into Azure without exposing services to the public internet. This tutori…
Cloud Service Models
What actually distinguishes IaaS, PaaS, and SaaS, why the boundary is "who manages what," and how the shared responsibility model determines what you're on the hook for at each layer.
LLM Fundamentals: Tokens, Context Windows & Sampling
Why a token isn't a word, what actually happens when a request would exceed the context window, and what temperature and top_p each control during generation.
When would you choose Azure App Service over a Virtual Machine for hosting a web application?
App Service is a fully managed PaaS; it handles OS patching, runtime installation, and built-in scaling and deployment slots, so you only manage application code and configuration. A Virtual Machine is IaaS, full control over the OS and everything installed on it, but you own patching, scaling configuration, and availability yourself. Choose App Service when the workload is a standard web app/API in a supported runtime and the team wants to minimize operational burden; choose a VM when you need OS-level control, unsupported runtimes/dependencies, or specific compliance requirements that mandate managing the host directly.
What is the difference between Blob Storage, File Storage, and Disk Storage in Azure?
Blob Storage is object storage for unstructured data (images, backups, logs), accessed via HTTP/HTTPS APIs, not mounted as a filesystem. File Storage provides fully managed file shares accessible via the SMB or NFS protocol, usable as a network drive that multiple VMs can mount simultaneously. Disk Storage provides block-level storage attached to a single VM, functioning as its virtual hard disk. The choice depends on access pattern: Blob for API-driven unstructured data at scale, File for shared network-drive-style access across machines, Disk for a VM's own persistent local-feeling storage.
Why can animating transform or opacity skip layout and paint entirely, while animating top or width cannot?
transform and opacity don't change an element's geometry, its size or position in the document flow, or repaint its actual pixel content, they only change how an already-painted layer is displayed (moved, scaled, faded) during compositing. Because nothing about the element's layout or pixels actually changed, the browser can skip straight to the composite stage, the cheapest, fastest path in the pipeline, and handle it on the compositor thread. `top` and `width` do change geometry, so there's no way to skip layout, the browser has no shortcut for "the size changed but skip figuring out the new size."
What is the cloud shared responsibility model, and why does it matter for security?
It's the explicit division of security obligations between the cloud provider and the customer, and where that line falls depends on the service model. The provider is always responsible for "security of the cloud", physical data centers, host infrastructure, and (for managed services) the underlying platform. The customer is always responsible for "security in the cloud", for IaaS, that includes OS patching, network configuration, and IAM; for PaaS, it narrows to application code, data, and access control; for SaaS, it's mostly just access control and data. Misunderstanding this line is one of the most common causes of real cloud security incidents, assuming the provider handles something they explicitly don't.
What does a container image scanner actually check, and how does it know an image is vulnerable?
A scanner builds a software bill of materials (SBOM) for the image, an inventory of every OS package and application dependency baked into its layers, then matches that inventory against a continuously updated vulnerability database. A match means a known CVE affects a specific version of a package present in the image; the scanner doesn't analyze the application's own logic, it identifies known-vulnerable versions of things the image happens to include, which is why keeping the dependency and base-image inventory small and current matters as much as running the scanner at all.
Why would you choose session pooling over transaction pooling even though it scales to fewer concurrent clients per server connection?
Session pooling is the only mode of the two that supports every PostgreSQL feature without exception, prepared statements, session variables set via SET, LISTEN/NOTIFY, session-level advisory locks, because the server connection genuinely stays with the client for as long as their session lasts. If an application depends on any of those session-level features and can't be refactored around them, session pooling is the correct choice despite its lower connection-reuse efficiency, trading raw scalability for full feature compatibility rather than working around broken session state.
What is the practical difference between SELECT ... FOR UPDATE and SELECT ... FOR SHARE?
FOR UPDATE takes an exclusive row lock, it blocks other transactions from updating, deleting, or taking any competing lock (including another FOR UPDATE or FOR SHARE) on the same rows, appropriate when you're about to modify the row and need to ensure nothing else changes or locks it first. FOR SHARE takes a shared lock, it still blocks updates and deletes, but permits other transactions to also take FOR SHARE or FOR KEY SHARE locks on the same rows concurrently, appropriate when you only need to ensure a row doesn't change or get deleted while you read it, without needing exclusive access.
What is a shard key, and why does a low-cardinality shard key (few distinct values) cause a hot shard?
A shard key is the field (or fields) a sharded database uses to decide which shard each document or row actually lives on. If that field has few distinct values, say `country`, and the real data is skewed (80% of users in one country), the vast majority of documents route to the same shard regardless of how many shards exist in the cluster, overwhelming it with disproportionate read/write load and storage while other shards sit comparatively idle. Cardinality alone doesn't guarantee even distribution either, the values also need to actually occur with reasonably even frequency in the real data, not just theoretically have many possible values.
A client sends a payment request, the network times out before a response arrives, and the client retries with the same idempotency key. What actually happens on the server?
If the original request already completed (successfully or even with an error like a 500) before the retry arrives, the server returns the exact same result it returned (or would have returned) the first time, the same status code and response body, without re-executing the underlying operation, so the customer isn't charged twice just because the client never saw the first response. This is the entire point of an idempotency key: it lets a client safely retry an operation whose actual outcome it's genuinely uncertain about (did the first request even reach the server? did it complete before the timeout?) without that retry risking a duplicate side effect.
Why can't you rely on a Pod's IP address for service discovery?
Pods are ephemeral by design, Kubernetes kills and recreates them constantly (failed health checks, node drains, rolling deployments, autoscaling), and every new Pod gets a brand-new IP address. Hardcoding or caching a Pod IP breaks the moment that Pod is replaced. A Service solves this by providing a stable virtual IP and DNS name that always routes to whichever Pods currently match its label selector, regardless of how many times the underlying Pods have been replaced.
Why does explicitly telling a model it's allowed to say "I don't know" measurably reduce hallucination, and what's a second, complementary technique for the same problem?
Without that explicit permission, a model under an implicit expectation to always produce a confident, complete answer will sometimes fill a real information gap with a plausible-sounding but fabricated one; stating outright that uncertainty is an acceptable answer removes that pressure and lets the model surface "I don't have enough information" instead of guessing. A complementary technique for long documents is asking the model to first extract direct, word-for-word quotes relevant to the task before generating any analysis, grounding its response in verifiable text it actually has in front of it, and then citing which quote supports each claim, rather than generating an answer freely and hoping it stayed faithful to the source.
A client sends a sudden spike of requests that exceeds the configured rate, but the API doesn't immediately reject any of them. Why not, and when does rejection actually start?
The token bucket has accumulated capacity up to the burst limit, if the client had been under the rate limit recently, unused tokens built up in the bucket, and that reserve absorbs a short spike without any request failing, exactly the point of separating burst capacity from steady-state rate. Rejection (a 429 response) only starts once the bucket is actually empty, every accumulated token has been consumed and the spike is sustained long enough that the rate of token consumption keeps exceeding the rate of token replenishment. This is why a token bucket, unlike a hard per-second cap, tolerates brief bursts gracefully while still enforcing a real steady-state ceiling.
Why does using an array index as a list item's key cause state to attach to the wrong item once the list is reordered, and what's the fix?
With `key={i}`, React tracks each item's state by its position in the array, not by which real-world item it represents, so after reversing a list, the state that was originally at index 0 (say, an "expanded" toggle on the first item) stays at index 0 and now renders alongside whatever item ended up there after the reorder, not the original item it belonged to. The fix is using a stable, unique identifier from the actual data, `key={contact.id}`, so React can match each item to its correct state across renders regardless of how the list is reordered, added to, or filtered, rather than relying on a position that can shift under the data.
Why does a chunk like "The company's revenue grew by 3% over the previous quarter" cause a retrieval failure even if it's embedded correctly?
That sentence is only meaningful with context the isolated chunk doesn't carry, which company, which quarter, information that likely lived in a heading or preceding paragraph that didn't survive the chunking boundary. Embedded on its own, the chunk's vector represents a generic, context-free statement about revenue growth, which means it won't be retrieved reliably for a query about "ACME Corp Q2 2023 earnings" even though it's exactly the right chunk, because nothing in its embedding actually encodes that it's about ACME Corp or Q2 2023 at all.
Why is committing a secret to version control worse than a normal security mistake to fix?
Deleting the file or even force-pushing over the commit doesn't remove the secret's exposure, the value lives on in the repository's commit history, in any fork or local clone already made, and often in CI logs that referenced it. The only real fix is treating the secret as permanently compromised: revoke and rotate it at the source (the database, the cloud provider, the API), then clean up history as a secondary, defense-in-depth step, not the actual remediation. This is why prevention (pre-commit scanning, never typing a real secret into a tracked file) matters far more for secrets than for most other classes of bugs.