Show HN: PlayBooks – Jupyter Notebooks style on-call investigation documents (github.com)

Thank you.

If you get a chance to play around, would love to hear your thoughts on it :)

This is quite an interesting evaluation, thanks for sharing. We are piloting with a large enterprise (100+ SREs). Before us, they started implementing Jupyter Notebooks in a similar direction.

Writing one playbook in Jupyter is easy but creating a framework to enable their 100+ product teams to self-serve and create playbooks has been so intensive for them, they even started working on their internal SDK for it.

It was a lot of code and the lead felt like the Jupyter visual interface was harder to follow for instructions/runbooks.

With PlayBooks, we have tried to abstract out the entire execution engine and configuration to a intuitive user experience (our architecture is explained here -- https://slender-resolution-789.notion.site/PlayBooks-Documen... )

Slack has become so central to every on-call investigation, that it was like a dealbreaker for my cofounder, Dipesh, to have a fully functional Slack workflow in our MVP.

I did come across Speedrun a while back and was planning to give it a spin. Thanks for dropping a note, I'll drop you a mail sometime in the near future to discuss more on the topic. :)

Yes, we also support webhook based triggers so investigations can get initiated even before the SRE is on the laptop and by the time they reach there, they receive a summary upfront.

Isn't that already possible via normal Python scripts? I've worked a couple places where dev had a "don't wake us up" script that was programmed to detect known and common issues and either fix it or offer recommendations on next steps (including a couple of code paths that led to a "page everyone, immediately and repeatedly").

From the SRE side, far and away the most common reason I end up paging devs is because the issue is somewhere deep inside the system and I lack that depth. I'm supporting half a dozen services and can't keep track of the churn that happens at high enough granularity. Eg I know the app's downstreams and most of its upstreams, but if there's an issue with a particular field in an API response I'm unlikely to know whether that field comes from our database, a downstream, summoned by voodoo, etc.

Still interesting to see, I'd love to be proven wrong.

I'd like to get a bit more context on what you're thinking. How would Airflow help SRE teams with on-call investigations?

I was looking at using moment.dev for a very similar (internal) application but the lift of using TypeScript and how the whole tool worked was very daunting. Having a simple Jupyter notebook interface (in Python) is much more approachable for a devops background.

here, be blown away https://github.com/opral/monorepo/tree/main/lix

solving version control for files like jupyter notebooks brings collaboration to those files without the need to give up files in favor of the cloud. playbooks could leverage lix in 1-2 years to build a file-based version of their tool

You might also like Elixir Livebook! :) https://livebook.dev/

Thanks for your feedback.

> as a file that can be version controlled

PlayBooks are created using a UI and all state changes are tracked but we currently don't support moving back to a previous version of the PlayBook.

> where multiple people can be viewing/working on it at the same time

This is currently picked wherein we will be creating sessions for each time PlayBooks are run and sessions will have the data persistent in each cell for everyone with the link to see.

Connecting to GKE for k8s events/deployment info is WIP, we plan to pick up Stack Driver too soon.

> if I can automate a runbook can I not just make the system heal itself automatically

The runbooks are still codified by a human in the current scenario. We are experimenting with some data to see if we can generate accurate runbooks for different scenarios but haven't found much luck with it yet. I do think that some % of issues will be abstracted in near future with machines doing the healing automatically.

> you should invest in toil reduction to stop having those repeated problems.

Most teams I speak to say that they try their best to avoid repeating the same issue again. Users typically use PlayBooks for:

(a) A generic scenario where you have an issue reported / alerted and you are testing 3-4 hypotheses / potential failure reasons at once.

(b) You want to run some definitive sequence of steps.

A lot of on call teams lack the capability to do that automation, either because ops takes the pages and can't code (or can't code well enough) or because dev takes the pages and have no access or knowledge about the infra APIs they could use for self-healing.

These platforms can form a sort of "common ground" where dev can see the infra APIs and the "code" is simple enough for ops people that don't code to rig stuff up.

I don't think these platforms are built for the kind of places where being able to write a Python script to query logs from CloudFront are just table stakes for all ICs regardless of role.

Writing post-mortems is generally pretty kludgy. You might have a Slack bot that records the big picture items, but ideally, a post-mortem would include connections to the nitty-gritty details while maintaining a good high-level overview. The other thing most post-mortems miss is communicating the discovery process. You'll get a description of how an engineer suspected some problem, but you rarely get details as to how they validated it such that others can learn new techniques. At a previous job, I worked with a great sysadmin/devop who would go through a concise set of steps when debugging things. We all sat down as a team, and he showed us the commands he ran to confirm transport in different scenarios. It was an enlightening experience. I talked to him and other DevOps folks about Rundeck, and it was clear that the problem isn't whether something can be automated, but rather whether the variables involved are limited enough to be represented in code. When you do the math, the time it would take to write code to solve some issues is not worth the benefit.

Iterating on the manual work to better communicate and formalize the debugging process could fit well into the notebook paradigm. You can show the scripts and commands you're running to debug while still composing a quality post-mortem, as the incident is happening where things are fresh.

The other thing to consider is how often you get incidents and how quickly you need to get people up to speed. In a small org, devs can keep most things in their head and use docs, but when things get larger, you need to think about how you can offload systems and operational duties. If a team starts by iterating on operational tasks in Notebooks, you can hand those off to an operations team over time. A quality, small operations team can take on a lot work and free up dev time for optimizations or feature development. The key is that devs have a good workflow to hand off operational tasks that are often fuzzier than code.

The one gotcha with a hosted service IMO is that translating local scripts into hosted ones takes a lot of work. On my laptop, I'm on a VPN and can access things directly, where you need to figure out how to allow a 3rd party to connect to production backend systems. That can be a sticky problem that makes it hard to clarify the value.

> “rename step” functionality is not intuitive.

We deployed the change to make it intuitive (similar to what is suggested) yesterday. It's still in integration branch so awaiting merging in main on this.

> i thought perhaps it had executed the step, which the check mark indicating completion or success.

Noted.

> It wasn’t clear that it was an input box since it didn’t have focus, and it wasn’t clear that the check mark was a button.

Noted.

> It seems like it’s the “Data” field, although the name doesn’t make much sense.

It is indeed a dropdown list but we had hard-coded it for sandbox so user can't change the source of an existing step. It is changeable when you host your own version or when you add a new step in sandbox.

> There’s a “reload”(?) icon next to it, but I have no idea what that does.

In case user decides to add a new source on-the-go (say in another tab), reload helps fetch the same list again.

Overall, I do understand that some parts of it are unintuitive and is a focus area for us to improve it asap.