241 published guides across 4 roadmaps and 25 phases, ordered so each one only assumes what came before. Every tutorial ships complete, runnable code.
From Spring Boot developer to Agentic AI engineer
Refresh the modern Java and Spring Boot foundations every AI integration builds on: records, virtual threads, reactive streams, and containers.
The Java 17-to-21 features that matter most for AI work: records, sealed classes, pattern matching, text blocks and virtual threads — each shown with a concrete AI use case.
Read tutorialFunctional Java refreshed for AI work: streams for document pipelines, Optional for safe metadata access, and CompletableFuture for concurrent model calls — with practical examples.
Read tutorialProject Reactor for AI developers: Mono, Flux, back-pressure and WebFlux — and the one place they are genuinely the right tool, streaming LLM tokens to a browser.
Read tutorialMicroservices patterns that matter for AI systems: API gateway, circuit breakers around model calls, the saga pattern for agent workflows, and where an AI service fits in the topology.
Read tutorialContainerize and deploy a Spring Boot AI application: a production Dockerfile with layered JARs, Kubernetes deployment with secrets for API keys, health probes and resource limits.
Read tutorialMaven and Gradle for Java AI projects: managing Spring AI and LangChain4j versions with BOMs, multi-module layout for projects with separate ingestion and serving, and dependency hygiene.
Read tutorialWire large language models into Spring Boot with Spring AI — chat clients, embeddings, RAG, tool calling, structured output, and production observability.
What Spring AI is, how its abstractions map onto Spring concepts you already know, when to choose it over LangChain4j, and a working ChatClient example in under five minutes.
Read tutorialA complete Spring Boot + OpenAI setup: dependencies, API key management, model options, timeouts, retries and the five errors every developer hits on the first run.
Read tutorialMaster the Spring AI ChatClient: system messages, prompt templates, streaming with SSE, chat memory, advisors and per-call options — with complete Spring Boot code.
Read tutorialPrompt engineering explained for engineers, not marketers: system prompts, few-shot, delimiters, output contracts and grounding — each as testable Spring AI code, not vibes.
Read tutorialHow embeddings and vector stores work in Spring AI, with a complete pgvector Spring Boot setup — schema, indexes, metadata filtering, dimensions and the mistakes that force a re-ingest.
Read tutorialBuild a production RAG pipeline in Spring Boot: document ingestion, chunking, pgvector retrieval, the QuestionAnswerAdvisor, citations, evaluation and the failure modes nobody warns you about.
Read tutorialHow Spring AI function calling works, with complete @Tool examples: registering tools, typed parameters, error handling, the agent loop, and how to stop a tool-using model doing damage.
Read tutorialTurn LLM responses into typed Java objects with Spring AI: BeanOutputConverter, .entity(), generic lists, enums and validation — the reliable alternative to parsing text by hand.
Read tutorialSend images and audio to vision models from Spring Boot with Spring AI: the Media API, image analysis, document extraction from scans, and handling multimodal input safely.
Read tutorialRun local LLMs in Spring Boot with Spring AI and Ollama: setup, model selection, offline development, cost and privacy trade-offs, and when a local model is the right call.
Read tutorialInstrument Spring AI with Micrometer and OpenTelemetry: token and cost metrics per feature, latency tracking, tracing model calls, and dashboards that catch a cost problem before the invoice does.
Read tutorialSecure a Spring Boot AI application against the OWASP LLM Top 10: prompt injection defenses, output validation, rate limiting, PII handling and safe tool authorization — with code.
Read tutorialHow to test non-deterministic AI code in Spring Boot: mocking the ChatModel for unit tests, golden datasets for retrieval, property-based assertions, and LLM-as-judge for quality.
Read tutorialMaster LangChain4j end to end: AI Services, document loaders, splitters, embedding stores, retrievers, memory, and tool-using agents.
A complete LangChain4j introduction for Java developers: core abstractions, the AiServices declarative style, memory, tools and retrieval — plus an honest comparison with Spring AI.
Read tutorialConfigure chat models in LangChain4j: OpenAI, Anthropic Claude, Google Gemini, Mistral and Ollama — with streaming, timeouts, retries and how to swap providers without touching your code.
Read tutorialCompose multi-step LLM workflows in LangChain4j: sequential chains, routing by classification, and building custom chains from AI Services — when to chain and when a single call suffices.
Read tutorialLoad documents into LangChain4j from files, URLs, S3, GitHub and more, and parse PDF, DOCX and HTML with Apache Tika — the ingestion front-end for any RAG pipeline in Java.
Read tutorialChunk documents effectively in LangChain4j: the recursive splitter, chunk size and overlap tuning, splitting code and markdown, and why chunking is the highest-impact decision in RAG.
Read tutorialConfigure embedding models in LangChain4j: hosted models like OpenAI and Cohere, free in-process ONNX models, dimension matching, and choosing an embedding model for RAG.
Read tutorialStore and search vectors in LangChain4j: the in-memory store for tests, PgVector for production, Redis and Elasticsearch, plus metadata filtering and picking the right store.
Read tutorialBuild RAG in LangChain4j with ContentRetriever: attach retrieval to AI Services, transform queries, re-rank results, and assemble an advanced RAG pipeline with the RetrievalAugmentor.
Read tutorialBuild tool-using agents in LangChain4j: the @Tool annotation, how the agent loop works, bounding iterations, safe write tools and the ReAct pattern — with production-ready code.
Read tutorialAdd conversation memory to LangChain4j AI Services: message and token windows, per-user memory with @MemoryId, persistent stores, and why unbounded memory breaks in production.
Read tutorialReturn typed objects from LangChain4j AI Services: POJO and record return types, enums, lists, JSON schema mode and validation — no manual parsing of model responses.
Read tutorialGo from LLM calls to autonomous systems: ReAct, plan-and-execute, reflection, agent memory, multi-agent orchestration, evaluation and guardrails.
A clear, hype-free explanation of agentic AI: how it differs from generative AI, the five components of an agent, when autonomy is worth it, and when a plain workflow is the better engineering choice.
Read tutorialThe core agent architecture patterns explained with Java: ReAct, plan-and-execute, reflection, orchestrator-worker and routing — when to use each, and why simpler is usually better.
Read tutorialHow agents use tools well: designing tool schemas, dynamic tool selection, composing tools into workflows, error recovery, and keeping the tool set small enough to choose from.
Read tutorialHow agents plan and reason: task decomposition, hierarchical planning, chain-of-thought and tree-of-thought — with Java examples and honest guidance on when planning helps.
Read tutorialHow agent memory works beyond a chat window: working, episodic and semantic memory, vector-based recall, memory consolidation, and implementing persistent agent memory in Java.
Read tutorialBuilding multi-agent systems in Java: orchestrator-worker coordination, agent handoffs, communication protocols and conflict resolution — and the honest case for when one agent is better.
Read tutorialA practical comparison of agent frameworks for Java developers: LangChain4j, Spring AI, and how the Python ecosystem (LangGraph, CrewAI, AutoGen) compares — plus when to use no framework at all.
Read tutorialDesign autonomous coding agents in Java: code generation with verification, review agents that bias for precision, refactoring and test-generation agents — with the guardrails they need.
Read tutorialHow to evaluate and test AI agents: trajectory analysis, benchmarking, hallucination detection, outcome verification and human-in-the-loop evaluation — with Java patterns.
Read tutorialAdvanced RAG where the model controls retrieval: self-RAG, corrective RAG, adaptive retrieval and query planning — when to let an agent decide whether and what to retrieve, in Java.
Read tutorialDesign human-in-the-loop AI systems in Java: approval flows for agent actions, escalation patterns, confidence thresholds and feedback loops — how to deploy autonomy without accepting unbounded risk.
Read tutorialTake agents to production: per-run budgets and step caps, guardrails, durable execution, scaling on the JVM, cost control and the operational patterns that keep agents from causing incidents.
Read tutorialBuild responsible AI agents: managing bias, ensuring transparency and accountability, designing for contestability, and the engineering practices that make agents safe and fair.
Read tutorialThe model-side knowledge that separates an integrator from an AI engineer: transformers, fine-tuning, vector search internals, evaluation and LLMOps.
Understand the foundation models you build on: GPT, Claude, Gemini, Llama and Mistral families, how they differ, and a practical framework for choosing a model for your Java application.
Read tutorialThe transformer architecture explained for engineers, not researchers: self-attention, multi-head attention, positional encoding and why it explains context limits, token cost and hallucination.
Read tutorialUnderstand fine-tuning for engineers: LoRA and QLoRA, instruction tuning, RLHF and DPO, and the crucial decision of when to fine-tune versus when retrieval or prompting is the better tool.
Read tutorialHow vector databases work under the hood: the HNSW index, approximate nearest-neighbour search, cosine vs Euclidean distance, product quantization and metadata filtering — for Java developers.
Read tutorialHow embedding models power semantic search: bi-encoders vs cross-encoders, re-ranking, hybrid search combining keywords and vectors, and choosing embeddings for retrieval quality.
Read tutorialAdvanced prompt engineering techniques: prompt chaining, meta-prompting, self-consistency, structured reasoning and prompt optimization — beyond the basics, for reliable production prompts.
Read tutorialUnderstand tokens and context windows: how BPE tokenization works, why code costs more tokens, managing the context budget, and the token math behind LLM cost — for Java developers.
Read tutorialHow to evaluate LLMs and LLM applications: what public benchmarks like MMLU and HumanEval measure, their limits, and building a custom evaluation suite that reflects your real task.
Read tutorialMake models smaller and faster: quantization (GGUF, GPTQ, AWQ), knowledge distillation, the accuracy-vs-efficiency trade-off, and when self-hosting a compressed model makes sense.
Read tutorialBuild guardrails around LLMs: input filtering, output validation against schemas and rules, content moderation, jailbreak defense and layered safety — deterministic controls in Java.
Read tutorialThe operational practice of running LLM features: prompt versioning, evaluation in CI/CD, model registries, A/B testing and canary rollouts of prompt and model changes — for Java teams.
Read tutorialRun generative AI on the major clouds from Java: Amazon Bedrock, Azure OpenAI and Google Vertex AI compared, with Spring AI and LangChain4j integration and how to choose.
Read tutorialArchitectural patterns for shipping AI inside real systems: streaming APIs, event-driven pipelines, semantic caching, multi-tenancy and low-latency serving.
Design robust AI REST APIs in Spring Boot: streaming with Server-Sent Events, async processing for long tasks, timeouts, back-pressure and the API patterns that make AI features reliable.
Read tutorialBuild event-driven AI systems with Kafka and Spring Boot: async AI processing pipelines, decoupling model calls from request threads, dead-letter handling and back-pressure for LLM workloads.
Read tutorialIntegrate AI into CI/CD pipelines: automated code review, test generation, documentation and PR triage — with the precision discipline and guardrails that keep these bots useful, not noisy.
Read tutorialBuild AI-powered search in Java: hybrid keyword-plus-vector search, faceted filtering, query understanding, personalization and re-ranking — beyond both keyword search and naive RAG.
Read tutorialDesign production chatbots in Java: intent classification, dialog state management, slot filling, multi-turn context, tool integration and handoff to humans — beyond a single ChatClient call.
Read tutorialApply LLMs to data engineering in Java: text-to-SQL with safety guards, AI-assisted data cleaning, schema mapping and anomaly detection — where AI helps and where it must be constrained.
Read tutorialObserve LLM applications in production: distributed tracing of model and retrieval calls, LangFuse and OpenTelemetry GenAI conventions, span attributes, and cost dashboards for Java teams.
Read tutorialBuild multi-tenant AI systems in Java: strict tenant isolation in retrieval, per-tenant quotas and rate limits, cost allocation, and data residency — keeping tenants apart safely at scale.
Read tutorialCut LLM cost and latency with caching: exact-match caching, semantic caching by embedding similarity, provider prompt caching, and invalidation — with Redis and Java examples.
Read tutorialServe LLMs with low latency: time to first token, streaming, continuous batching, vLLM and TGI, speculative decoding, and the latency levers available whether you self-host or use an API.
Read tutorialWhere the field is heading: multimodal agents, GraphRAG, small language models, enterprise agent platforms, regulation, and your career roadmap.
Build multimodal agents that reason over images, audio and screens: vision-language agents, document-understanding agents, computer-use patterns and the guardrails they need.
Read tutorialHow AI code generation works and how to use it well: repository context, code LLMs, evaluating generated code, and the judgement to accept, verify or reject what the model produces.
Read tutorialApply AI to DevOps and SRE in Java: incident investigation agents, LLM log analysis, alert correlation and runbook automation — with the read-only-first, human-approved discipline ops demands.
Read tutorialGo beyond vector RAG with GraphRAG: knowledge graphs in Neo4j, entity and relationship extraction, graph retrieval for multi-hop questions, and when a graph beats a vector store.
Read tutorialWhen smaller models win: SLMs like Phi and Gemma, on-device and edge AI, model routing between small and large models, and the cost and latency case for not always reaching for the biggest model.
Read tutorialDeploy AI agents in the enterprise: integrating with SAP, Salesforce and ServiceNow, SSO and identity, audit trails, approval workflows and the governance enterprise agents require.
Read tutorialPrivacy-preserving AI techniques for engineers: federated learning, differential privacy, PII redaction, secure processing and the practical patterns for handling sensitive data with LLMs.
Read tutorialWhat developers need to know about AI regulation: the EU AI Act risk tiers, GDPR for AI, ISO 42001 and the NIST AI RMF — and the engineering practices that keep AI systems compliant.
Read tutorialChoose an AI model strategy: open-weight vs proprietary hosted models, total cost of ownership, vendor lock-in risk, hybrid approaches and migration paths — a decision framework for Java teams.
Read tutorialThe Java developer to AI engineer career path: the skills that matter, how to build a portfolio, where the field is heading, and how to keep learning in a fast-moving space.
Read tutorialFrom Spring Boot novice to enterprise architect
Stop treating Spring Boot as magic. Auto-configuration, the IoC container lifecycle, AOP proxies, caching, scheduling, JPA and Redis — how each one actually works, and what breaks when it does not.
How Spring Boot auto-configuration actually works: the import selector, the @Conditional family, ordering rules, the --debug report, and how to write your own starter.
Read tutorialThe Spring container from the inside: the full bean lifecycle in order, what BeanPostProcessor actually intercepts, every bean scope, and how circular dependencies are resolved.
Read tutorialType-safe configuration with @ConfigurationProperties, the full property precedence order, relaxed binding rules, profile groups, and keeping secrets out of your YAML.
Read tutorialSpring AOP from pointcut syntax to proxy mechanics: the five advice types, writing annotation-driven aspects, aspect ordering, and why self-invocation silently does nothing.
Read tutorialEvery Actuator endpoint worth exposing, writing custom health indicators for Kubernetes probes, adding Micrometer metrics that answer real questions, and securing it all.
Read tutorialA test strategy that stays fast: when to use @SpringBootTest versus a slice, real databases with Testcontainers and @ServiceConnection, stubbing HTTP with WireMock, and context caching.
Read tutorialA consistent error contract for a Spring Boot API: an exception hierarchy worth having, @ControllerAdvice done properly, RFC 7807 ProblemDetail, and validation errors clients can act on.
Read tutorialSpring cache abstraction in practice: @Cacheable key design, choosing between Caffeine and Redis, per-cache TTLs, cache stampedes, and a two-level cache that survives a Redis outage.
Read tutorialScheduled tasks and async methods done properly: fixedRate versus fixedDelay, sizing executors, exception handling that does not silently swallow, and distributed locking with ShedLock.
Read tutorialEntity mapping that scales: relationship pitfalls, diagnosing and fixing the N+1 problem, derived queries versus Specifications, pagination that stays fast, and JPA auditing.
Read tutorialRedis beyond caching: choosing the right data structure, distributed locks that are actually safe, Redis Streams as a queue, and configuring Lettuce for Sentinel and Cluster.
Read tutorialJakarta Bean Validation in Spring Boot: the full constraint set, custom validators, validation groups, cross-field rules, method validation and where each layer belongs.
Read tutorialLogging that helps at 3am: choosing levels that mean something, MDC correlation IDs across threads, structured JSON output, async appenders, and what must never be logged.
Read tutorialHandling uploads and downloads safely: multipart limits, detecting real content types with Tika, streaming large files, S3 and MinIO integration, and presigned URLs.
Read tutorialDesign APIs other teams enjoy consuming: correct resource modelling and status codes, versioning that survives contact with real clients, pagination, rate limiting, RFC 7807 errors, GraphQL and WebSockets.
The decisions that make an API pleasant to consume: resource naming, method semantics and idempotency, choosing the right status code, HATEOAS, and the Richardson maturity model.
Read tutorialEverything a Spring controller can bind, how ResponseEntity builds responses properly, content negotiation, custom argument resolvers, and keeping controllers thin.
Read tutorialGenerating documentation people actually use: springdoc-openapi setup, annotations worth adding, grouping large APIs, documenting errors and auth, and the API-first workflow.
Read tutorialComparing URI, header, query and media-type versioning honestly, deciding what counts as breaking, running two versions at once, and retiring one without breaking clients.
Read tutorialPagination that stays fast at depth: why OFFSET degrades, keyset and cursor pagination, dynamic filtering with Specifications, safe sorting, and the RFC 8288 Link header.
Read tutorialThe five rate-limiting algorithms compared, distributed limiting with Redis and Bucket4j, per-tier quotas, and the response headers clients need to behave well.
Read tutorialDesigning an error contract on RFC 7807: the standard fields, extension properties worth adding, an error catalogue, internationalised messages, and errors across service boundaries.
Read tutorialCalling other services without taking yourself down: WebClient configuration, the four timeouts that matter, connection pool sizing, retry with backoff, and testing against a real socket.
Read tutorialBuilding a GraphQL API with Spring for GraphQL: schema-first mapping, solving N+1 with batch mapping, field-level authorisation, and the query limits every public endpoint needs.
Read tutorialReal-time push in Spring: STOMP over WebSocket, broadcasting and user-targeted messages, authenticating the handshake, scaling with an external broker, and when SSE is the better fit.
Read tutorialThe whole distributed-systems toolkit: decomposing by bounded context, discovery, gateways, resilience, sagas and the outbox pattern, tracing, containers, Kubernetes and service mesh.
Finding service boundaries that hold: decomposing by business capability and subdomain, context mapping patterns, the anti-corruption layer, and the strangler fig migration.
Read tutorialClient-side versus server-side discovery, running Eureka properly including self-preservation, Consul as an alternative, and why Kubernetes usually makes a separate registry unnecessary.
Read tutorialBuilding an edge gateway: route predicates, the filter catalogue, custom global filters for auth and correlation, Redis rate limiting, and circuit breakers at the edge.
Read tutorialChoosing how services talk: synchronous REST and gRPC versus asynchronous messaging, the coupling each creates, correlation propagation, and graceful degradation.
Read tutorialResilience4j in production: how the circuit breaker state machine works, tuning the sliding window, combining retry and bulkhead correctly, and the decorator order that matters.
Read tutorialDistributed tracing that actually helps: spans and trace context, W3C propagation across HTTP and messaging, sampling strategies, and correlating traces with logs and metrics.
Read tutorialWhy two-phase commit fails in microservices, choreography versus orchestration sagas, compensating transactions, the transactional outbox, and idempotent consumers.
Read tutorialDesigning events that last: domain versus integration events, Avro and schema registry compatibility, event sourcing basics, ordering guarantees and schema evolution.
Read tutorialA testing strategy for distributed systems: where the pyramid changes shape, consumer-driven contract testing, component tests with Testcontainers, and why end-to-end tests fail you.
Read tutorialBuilding small, fast, secure Spring Boot images: multi-stage builds, BuildKit cache mounts, layered jars, JVM container awareness, distroless bases and vulnerability scanning.
Read tutorialRunning Spring Boot on Kubernetes properly: liveness versus readiness probes, JVM memory inside cgroups, resource requests and limits, autoscaling, and zero-downtime rollouts.
Read tutorialWhat a service mesh moves out of your application: automatic mTLS, VirtualService routing, outlier detection, authorization policies, fault injection and progressive delivery.
Read tutorialAssembling logs, metrics and traces into something usable: PromQL that answers real questions, the Grafana stack, golden signals, and alerts that mean something.
Read tutorialSecuring a distributed system: authentication at the edge, mTLS and workload identity between services, token propagation without over-trust, API keys and secret management.
Read tutorialCentralised configuration done safely: Config Server with a Git backend, client bootstrap and fail-fast, @RefreshScope, encrypted values, and when Kubernetes ConfigMaps are enough.
Read tutorialBoth brokers, properly. AMQP exchanges and routing, Kafka partitions and consumer groups, Spring AMQP and Spring Kafka, Kafka Streams, Connect, production operations — and a framework for choosing between them.
The vocabulary and patterns every broker shares: point-to-point versus publish-subscribe, competing consumers, acknowledgement modes, dead-letter queues and delivery guarantees.
Read tutorialAMQP 0-9-1 from the ground up: the four exchange types and when each fits, queue properties, bindings and routing keys, prefetch and fairness, and publisher confirms.
Read tutorialSpring AMQP in production: RabbitTemplate and message converters, @RabbitListener containers, manual acknowledgement, retry with backoff, and a dead-letter topology that works.
Read tutorialBeyond basic queues: quorum queues and Raft, clustering and partition handling, federation and shovel for multi-datacentre, priority and lazy queues, and delayed delivery.
Read tutorialHow Kafka actually works: the partitioned log, leaders and in-sync replicas, producer acks and idempotence, consumer groups and rebalancing, and offset management.
Read tutorialSpring for Apache Kafka in production: KafkaTemplate, @KafkaListener containers, JSON serialisation without trusting the wire, DefaultErrorHandler with backoff, and dead-letter topics.
Read tutorialStream processing without a cluster: KStream and KTable semantics, stateless and stateful operations, windowing, joins, exactly-once v2 and testing with TopologyTestDriver.
Read tutorialMoving data in and out of Kafka without writing code: source and sink connectors, Debezium change data capture, single message transforms, and running Connect in distributed mode.
Read tutorialRunning Kafka for real: partition and cluster sizing, retention versus compaction, the metrics that predict incidents, the CLI tools worth knowing, and geo-replication.
Read tutorialA practical comparison across throughput, latency, ordering, replay, routing and operational cost — with the use cases each one clearly wins, and when to run both.
Read tutorialOne programming model over Kafka and RabbitMQ: functional bindings, destination configuration, per-binder tuning, dead-letter handling and the in-memory test binder.
Read tutorialEverything between "it works on my machine" and "it survives Black Friday": pipelines, Docker, Kubernetes rollouts, Terraform, OpenTelemetry, Flyway, JVM tuning, load testing and disaster recovery.
A pipeline that stays fast as the codebase grows: stage design, GitHub Actions with dependency and Docker caching, test parallelisation, and quality gates that catch real problems.
Read tutorialContainer builds that are fast and trustworthy: BuildKit cache and secret mounts, tagging strategy, registry choice, vulnerability scanning, SBOM generation and image signing.
Read tutorialShipping without downtime: rolling update mechanics, blue-green switching, canary with automated analysis, and GitOps reconciliation with Argo CD.
Read tutorialProvisioning the infrastructure a Java service needs: Terraform state and locking, reusable modules, managed databases and brokers, and where Pulumi fits.
Read tutorialAssembling a production observability stack: the OTel agent and collector pipelines, Mimir, Loki and Tempo, alerting strategy that avoids fatigue, and runbooks that get used.
Read tutorialConfiguration that survives production: the 12-factor principles applied to Java, property precedence, fail-fast validation, feature flags, and graceful shutdown done properly.
Read tutorialSchema changes you can deploy safely: Flyway naming and ordering, repeatable migrations, baselining an existing database, and expand-and-contract for zero downtime.
Read tutorialDiagnosing and fixing JVM performance: the memory model, choosing and tuning a collector, reading GC logs, profiling with JFR and async-profiler, and container-aware settings.
Read tutorialFinding your limits before users do: the five load test types, writing k6 and Gatling scenarios, the metrics that matter, and turning results into a capacity plan.
Read tutorialPlanning for failure: defining RPO and RTO honestly, replication trade-offs, multi-region topologies and their costs, DNS failover, and testing recovery before you need it.
Read tutorialThe senior-engineer layer: GoF patterns as Spring actually uses them, CQRS and event sourcing, DDD in practice, transaction semantics, API security, gRPC, sharding and enterprise integration patterns.
The GoF patterns as Spring actually implements them, the ones worth writing yourself, and modern Java alternatives using records, sealed types and pattern matching.
Read tutorialSeparating reads from writes: CQRS without event sourcing, event stores and aggregate replay, building projections, snapshots, and an honest account of when not to use either.
Read tutorialDDD applied rather than described: choosing aggregate boundaries, value objects that enforce invariants, repositories, hexagonal architecture, and running an event storming session.
Read tutorialTransactions beyond the annotation: every propagation mode and when it applies, isolation levels and the anomalies they prevent, transaction-bound events, and why XA lost to sagas.
Read tutorialThe API-specific vulnerability classes and their Spring fixes: broken object-level authorization, mass assignment, unrestricted consumption, SSRF, and API inventory management.
Read tutorialgRPC for internal service calls: Protocol Buffers and schema evolution, the four RPC types, deadlines and interceptors, Spring Boot integration, and an honest comparison with REST.
Read tutorialScaling past one database: read replicas and routing, choosing a shard key you will not regret, hash versus range sharding, cross-shard queries, and migrating without downtime.
Read tutorialThe vocabulary of system integration: routers, splitters, aggregators, content enrichers and the claim check, implemented with Apache Camel and Spring Integration.
Read tutorialFrom basic authentication to zero-trust architecture
The filter chain, and every way to prove who someone is: passwords, JWT, OAuth 2.0, OIDC, SAML, LDAP — plus the authorisation models and cryptography you build on top of them.
How Spring Security actually works: the filter chain and its ordering, SecurityContextHolder, the AuthenticationManager delegation model, and where to plug in custom logic.
Read tutorialStoring passwords properly: choosing between BCrypt, Argon2 and scrypt, DelegatingPasswordEncoder for zero-downtime migration, strength rules, and breached-password checks.
Read tutorialThe two classic authentication mechanisms: when Basic is appropriate, configuring form login properly, custom success and failure handlers, logout, and account lockout that is not a DoS.
Read tutorialWhere user credentials live: in-memory users for tests, JdbcUserDetailsManager and its schema, writing a custom UserDetailsService, and seeding an initial administrator safely.
Read tutorialJWTs done safely: structure and claims, why RS256 beats HS256, key rotation with JWKS, the alg=none and key-confusion attacks, and how to revoke a stateless token.
Read tutorialOAuth 2.0 without the confusion: the four actors, the grants that still matter, why PKCE is mandatory, refresh token rotation, and what OAuth 2.1 removed.
Read tutorialRunning your own OAuth 2.1 and OIDC provider: registering clients, persisting authorizations, JWK sources and key rotation, custom claims, and the consent page.
Read tutorialValidating tokens correctly: NimbusJwtDecoder configuration, issuer and audience validators, mapping claims to authorities, opaque token introspection and multi-tenant decoding.
Read tutorialThe identity layer on OAuth 2.0: what an ID token is and how to validate it, standard scopes and claims, discovery, and single logout across relying parties.
Read tutorialAdding sign in with Google, GitHub and Microsoft: client registration, mapping provider profiles to your user model, safe account linking, and the onboarding flow afterwards.
Read tutorialEnterprise SSO with SAML: the SP-initiated flow step by step, RelyingPartyRegistration, the assertion checks that matter, metadata exchange and single logout.
Read tutorialAuthenticating against a corporate directory: LDAP structure, bind versus password comparison, ActiveDirectoryLdapAuthenticationProvider, group-to-role mapping and LDAPS.
Read tutorialAuthorisation with roles: HTTP versus method security, role hierarchies, @PreAuthorize and @PostAuthorize, custom PermissionEvaluator, and where RBAC stops being enough.
Read tutorialWhen roles are not enough: the PDP/PEP model, Open Policy Agent and Rego, integrating OPA with Spring, and deciding between ABAC and a richer RBAC.
Read tutorialApplied cryptography without inventing anything: choosing AES-GCM, envelope encryption, encrypting database columns with an AttributeConverter, and Vault Transit for key management.
Read tutorialEach major web attack class, how it actually works against a Spring application, and the specific configuration or code that stops it — CSRF, CORS, headers, TLS, injection, XSS, uploads, SSRF and deserialisation.
How CSRF works, how Spring CsrfFilter stops it, SameSite cookies as a second layer, the double-submit pattern for SPAs, and exactly when disabling CSRF is correct.
Read tutorialUnderstanding the same-origin policy, what preflight actually checks, configuring CORS in Spring correctly, and why allowedOrigins star with credentials is refused.
Read tutorialEvery security header worth setting: what each one prevents, the values to use, Spring configuration, and how to roll out a Content Security Policy without breaking the site.
Read tutorialConfiguring TLS properly: the handshake, keystores and PKCS12, HTTP to HTTPS redirect, mutual TLS for service-to-service, cipher policy, and where to terminate.
Read tutorialHow SQL injection actually works, why parameterised queries stop it, the JPA and JdbcTemplate patterns that are safe, the ones that are not, and how to test for it.
Read tutorialStopping cross-site scripting: the three XSS types, why encoding must be context-aware, Thymeleaf escaping, OWASP Java Encoder, nonce-based CSP and sanitising rich text.
Read tutorialEvery attack a file upload enables and its defence: extension allowlists, real content-type detection with Tika, path traversal, polyglot files, SVG, and safe serving.
Read tutorialStopping server-side request forgery: why cloud metadata endpoints are the prize, validating URLs correctly, defeating DNS rebinding, and egress controls as a second layer.
Read tutorialWhy readObject on untrusted data is remote code execution, how gadget chains work, ObjectInputFilter as a mitigation, and the Jackson polymorphic typing configuration to avoid.
Read tutorialSecuring AI features in a Spring application: why prompt injection cannot be fully solved, treating model output as untrusted, capability scoping for agents, and cost-based denial of service.
Read tutorialBeyond the login form: TOTP and WebAuthn second factors, session fixation and concurrency control, remember-me token rotation, single sign-on, and Kerberos for domain-joined intranets.
Implementing a second factor: TOTP enrolment and verification, recovery codes, trusted-device handling, and why WebAuthn is the endpoint worth aiming at.
Read tutorialSessions done safely: creation policies, session fixation defence, concurrent session limits, cookie flags that matter, and distributed sessions with Spring Session and Redis.
Read tutorialKeeping users signed in safely: hash-based versus persistent tokens, series rotation and how it detects theft, cookie configuration, and invalidating on password change.
Read tutorialDesigning single sign-on across several applications: the trust model, choosing SAML or OIDC per tenant, silent authentication, single logout, and running Keycloak as the broker.
Read tutorialSeamless Windows domain authentication: how Kerberos tickets work, SPNEGO negotiation over HTTP, keytab and SPN setup, Spring configuration, and diagnosing the usual failures.
Read tutorialProving the controls work and keeping them working: spring-security-test, penetration testing methodology, pipeline security gates, threat modelling and secrets management.
Writing security tests that catch real gaps: @WithMockUser and @WithUserDetails, MockMvc request post-processors, testing method security, mock JWTs, and the negative tests that matter.
Read tutorialA structured approach to testing your own application: reconnaissance, authentication and authorisation testing, injection, business logic flaws, and the tools that help.
Read tutorialSecurity gates that catch real problems without blocking delivery: pre-commit secret scanning, SAST with FindSecBugs, dependency and container scanning, DAST, and tuning out the noise.
Read tutorialFinding design flaws before they ship: drawing data flow diagrams, applying STRIDE per element, prioritising with DREAD, and running a session that produces actionable work.
Read tutorialGetting secrets out of configuration: taking an inventory, Vault KV and dynamic database credentials, Kubernetes auth, the External Secrets Operator, and rotation that works.
Read tutorialWhat auditors and regulators ask for, and the architecture that answers them: GDPR data-subject rights, tamper-evident audit logs, zero-trust design and cryptographic key management.
Implementing the parts of GDPR that reach the code: data subject access and export, consent records, erasure through anonymisation, retention jobs, and breach notification.
Read tutorialBuilding an audit trail that stands up to scrutiny: what to record, a structured event format, hash-chained tamper evidence, Hibernate Envers, and shipping to a SIEM.
Read tutorialBuilding zero-trust in practice: the NIST model, workload identity with SPIFFE, mTLS everywhere, per-request authorization, micro-segmentation, and just-in-time access.
Read tutorialManaging keys across their lifecycle: generation, storage in HSMs and KMS, envelope encryption, rotation without re-encrypting everything, and the key hierarchy that makes it work.
Read tutorialThe capstone architecture: an auth server, security gateway, OPA policy engine, secrets service, audit service and self-service portal, and how they fit together.
Read tutorialFrom core Java recall to production war stories
The questions every Java interview opens with, answered at the depth that separates a memorised answer from an understood one: the equals/hashCode contract, string interning, generics erasure, exception semantics and class initialisation order.
Why overriding equals() without hashCode() breaks every hash-based collection, what the five contract rules guarantee, and the mutable-key bug that silently loses data.
Read tutorialWhy String is immutable and what that buys you, how the string pool and intern() really work, why == sometimes appears to work, compact strings, and when concatenation in a loop actually costs you.
Read tutorialThe OOP questions behind the textbook four: static vs dynamic dispatch, Liskov violations that compile cleanly, abstract class versus interface, and composition over inheritance.
Read tutorialChecked versus unchecked and when each is right, how finally silently discards an exception or a return value, and suppressed exceptions in try-with-resources.
Read tutorialThe exact order the JVM initialises a class, why a static final String can survive deleting the class that declared it, effectively final, and how two classes can deadlock while loading.
Read tutorialWhat the compiler removes and what it inserts, why you cannot create an array of a generic type, PECS explained by what it enables, bridge methods, and heap pollution from unchecked varargs.
Read tutorialThe five conditions for a genuinely immutable class, the leaked-collection bug that defeats final, why records are only shallowly immutable, and what final fields guarantee across threads.
Read tutorialNatural order versus external order, the total-ordering contract and the exception thrown when you break it, comparator chaining, the integer-overflow bug, and TimSort stability.
Read tutorialFunctional Java as an interviewer probes it — not "name three functional interfaces" but why a lambda is not an anonymous class, how a stream pipeline actually executes, when parallel streams make things slower, and what Java 9 through 21 added on top.
Every Java 8 feature an interviewer asks about, why each was added, and the one-sentence answer for each — lambdas, streams, Optional, default methods, java.time, CompletableFuture and Metaspace.
Read tutorialWhy a lambda is not an anonymous class, what invokedynamic and LambdaMetafactory do at first call, the allocation difference between capturing and non-capturing lambdas, and what this means.
Read tutorialThe four core shapes and how to derive the other thirty-nine, why primitive specialisations exist, compose versus andThen, and the checked-exception problem with a clean workaround.
Read tutorialHow a stream pipeline actually executes: why nothing runs until the terminal operation, what short-circuiting really means, stateful versus stateless operations, and why a stream is single-use.
Read tutorialThe collector API in depth: multi-level groupingBy, downstream collectors, the toMap duplicate-key exception, the null-value trap, teeing and flatMapping, and writing a Collector by hand.
Read tutorialWhy every parallel stream in your JVM shares one pool, which sources split well, the N times Q rule for deciding, and why a blocking call inside a parallel stream can stall the whole application.
Read tutorialWhat Optional was designed for and what it was not, the orElse versus orElseGet trap that evaluates the fallback every time, chaining with map and flatMap, and why Optional fields are a mistake.
Read tutorialWhy default methods were added, the three resolution rules when a class inherits conflicting defaults, calling a specific supertype with X.super.method(), and private interface methods.
Read tutorialChoosing between Instant, LocalDateTime and ZonedDateTime, Period versus Duration, what happens at a daylight-saving gap, and how to store timestamps so they survive a zone change.
Read tutorialWhat actually changed after Java 8 and why it matters in an interview: var, records, sealed interfaces, pattern matching for switch, text blocks, the module system and virtual threads.
Read tutorialWhat is actually inside the collection you picked: array growth and copying, hash buckets and treeification, red-black trees, the difference between a fail-fast and a fail-safe iterator, and the memory each structure really costs per element.
The interface hierarchy and what each contract promises, why some methods throw UnsupportedOperationException by design, and the differences between Arrays.asList, List.of and List.copyOf.
Read tutorialWhat each one stores in memory, the 1.5x growth and array copy, why LinkedList loses even at insertion in the middle, and the per-element overhead that makes cache locality decide the winner.
Read tutorialHow HashMap stores entries, why the hash is XORed with its own high bits, what happens during a resize, when a bucket becomes a red-black tree, and the Java 7 race that caused infinite loops.
Read tutorialHow ConcurrentHashMap achieves concurrency without a global lock, why segments disappeared in Java 8, the computeIfAbsent deadlock, and why size() is only an estimate.
Read tutorialHow TreeMap uses a red-black tree for sorted keys and range queries, how LinkedHashMap adds a doubly-linked list for ordering, and building an LRU cache in ten lines with removeEldestEntry.
Read tutorialWhy every Set is a Map underneath, how iteration order differs, the TreeSet comparator-equality trap, EnumSet as a bit vector, and choosing a Set for concurrent access.
Read tutorialThe three method families and why Queue has three ways to insert, choosing between ArrayBlockingQueue and LinkedBlockingQueue, PriorityQueue as a binary heap, and the SynchronousQueue handoff.
Read tutorialHow modCount makes an iterator fail fast, why removing inside a for-each throws, the four correct ways to remove while iterating, and what weakly consistent iteration actually promises.
Read tutorialA complete Big-O table for every common collection, what each one actually costs per element in bytes, why boxing dominates numeric collections, and a decision procedure that fits on one page.
Read tutorialThe Java Memory Model and everything built on it: happens-before, why volatile is not a lock, how to size a thread pool from measurements rather than folklore, composing CompletableFuture chains, and diagnosing a deadlock from a thread dump.
The six thread states and what moves between them, why calling run() directly is a no-op, what a platform thread actually costs in memory and switching, and the interrupt protocol done properly.
Read tutorialWhat the Java Memory Model guarantees, why reordering and visibility are separate problems, what synchronized actually does beyond mutual exclusion, and when ReentrantLock earns its extra complexity.
Read tutorialWhat volatile guarantees and what it does not, why count++ is broken even when volatile, how compare-and-swap works, when LongAdder beats AtomicLong, and the double-checked locking idiom.
Read tutorialHow ThreadPoolExecutor decides whether to queue or grow, why newFixedThreadPool can exhaust the heap, sizing pools from measurements with Little law, and shutting down without losing work.
Read tutorialComposing async work without blocking: thenApply versus thenCompose, which thread runs each stage, combining with allOf and anyOf, timeouts, and how exceptions propagate through a chain.
Read tutorialThe four conditions every deadlock needs and how breaking one prevents it, reading a deadlock out of a thread dump, lock ordering and tryLock, and the pool-starvation deadlock with no locks at all.
Read tutorialThe coordination primitives in java.util.concurrent, when a latch beats a barrier, using a semaphore as a bulkhead, and the AbstractQueuedSynchronizer that all of them are built on.
Read tutorialHow a virtual thread mounts and unmounts from a carrier, why pinning on synchronized still matters, why pooling virtual threads is wrong, and what StructuredTaskScope adds over raw futures.
Read tutorialHeap, stack, metaspace and direct memory; every collector from Serial to ZGC and when each is the right answer; reading a GC log; the leak patterns that recur across every codebase; and the tooling that turns a guess into a measurement.
Every region the JVM allocates, which are per-thread and which are shared, why the heap is generational, where Metaspace lives since Java 8, and why total process memory always exceeds Xmx.
Read tutorialHow each collector works, the throughput-versus-latency trade-off that separates them, what G1 regions and pause targets really do, and how ZGC achieves sub-millisecond pauses on huge heaps.
Read tutorialEnabling unified GC logging, reading a G1 log line by line, calculating allocation and promotion rates, identifying every Full GC cause, and the tuning changes that are usually wrong.
Read tutorialThe seven leak patterns that recur in every codebase, why a garbage-collected language leaks at all, how each one is diagnosed from a heap dump, and the code change that fixes each.
Read tutorialEach OutOfMemoryError message, what it actually indicates, the most likely cause, and the first three things to check — plus why OOMKilled by the kernel is a different failure entirely.
Read tutorialCapturing a heap dump safely in production, the difference between shallow and retained size, reading the dominator tree, using path to GC roots, and OQL queries that answer real questions.
Read tutorialHow the JVM reads cgroup limits, why MaxRAMPercentage beats Xmx in a container, how CPU quota affects GC and pool sizing, and why CPU limits cause latency spikes through throttling.
Read tutorialRunning JFR continuously in production, why traditional samplers suffer safepoint bias, reading a flame graph, allocation profiling, and choosing between CPU and wall-clock sampling.
Read tutorialHow many bytes an object really costs, why compressed oops stop working above 32GB, how the JIT proves an object never escapes and removes the allocation, and what deoptimisation is.
Read tutorialNine outages, each told as it actually unfolds: the symptom on the dashboard, the commands that narrow it down, the root cause, the fix, and the guardrail that stops it recurring. This is the phase that gives you stories to tell.
The exact command sequence that turns a pinned CPU into a line number: top -H, converting the thread id to hex, matching nid in a thread dump, and the four causes it usually turns out to be.
Read tutorialThe incident where every request times out waiting for a connection: how to read the HikariCP exception, find the leak with leakDetectionThreshold, and why a bigger pool usually makes it worse.
Read tutorialWhen every worker thread is blocked and the queue grows without limit: reading it from a thread dump, why an unbounded queue turns a slowdown into an outage, and isolating with bulkheads.
Read tutorialWhy a lazy association turns one request into a thousand queries, how to detect N+1 in tests rather than production, JOIN FETCH versus EntityGraph, and the MultipleBagFetch and pagination traps.
Read tutorialA method for attributing p99 latency: correlating GC logs with request timings, why safepoint pauses hide outside GC, coordinated omission in load tests, and the causes that are not GC at all.
Read tutorialHow one slow dependency takes down an unrelated service, why retries amplify an outage, setting a timeout budget across a call chain, and the four defences that contain the blast radius.
Read tutorialWhat happens when a popular cache entry expires under load, single-flight loading and probabilistic early expiry, sharding a hot key across a Redis cluster, and getting invalidation right.
Read tutorialFinding the point where latency turns vertical, applying Little law to size pools and predict queueing, choosing headroom for failover and spikes, and running load tests that produce honest numbers.
Read tutorialThe order of operations during an incident, the USE and RED methods for narrowing a cause fast, writing a blameless postmortem, and how to turn a real outage into an interview answer that scores.
Read tutorialThe rounds themselves: the coding screen and the handful of patterns it keeps reusing, the Spring question bank, backend system design under a whiteboard clock, behavioural answers that survive follow-up questions, and an eight-week plan that fits around a full-time job.
The six patterns that cover most coding-screen questions, with Java templates, the language-specific traps that cost points, and how to talk while you code without losing your place.
Read tutorialThe Spring questions asked at every level answered with mechanisms: how auto-configuration decides, why self-invocation breaks @Transactional, proxy modes, bean scopes and testing slices.
Read tutorialA 45-minute structure that works: clarify and estimate, data model first, then the API, then scale what the numbers say to scale — plus idempotency, the outbox pattern and talking in numbers.
Read tutorialWhy the behavioural round is scored harder than candidates expect, the six stories that cover almost every question, how to quantify impact honestly, and surviving the follow-up questions.
Read tutorialA week-by-week plan that fits into eight hours a week: what to cover when, how to use spaced repetition on the topics you forget, when to start applying, and how to handle the offer stage.
Read tutorial