--- title: "Caro for SREs & On-Call Engineers" description: "Your 3 AM incident companion. Validate dangerous commands before they touch production. Generate safe shell commands during high-pressure incidents. 52+ dangerous patterns blocked." url: "https://caro.sh/use-cases/sre" markdown_url: "https://caro.sh/use-cases/sre.md" lang: "en" type: "website" image: "https://caro.sh/og/use-cases/sre.png" --- SRE & On-Call # Your 3 AM Incident Companion When you're sleep-deprived and production is on fire, Caro validates every command before it can make things worse. Pattern-based safety that doesn't depend on AI judgement. "Caught a recursive delete pattern I would have missed at 2 AM during an incident. The warning was specific enough that I understood WHY it was dangerous." — Michael T., Senior SRE (Series C Fintech) [Get Started Free](https://caro.sh/use-cases/sre#download) [See Real Examples](https://caro.sh/use-cases/sre#scenarios) ## Jobs Caro Does for SREs What you hire Caro to do ### [Safe Production Command Execution](https://caro.sh/use-cases/sre#safe-execution) Pain: 5/5 Daily Validate commands against 52+ dangerous patterns before they can destroy production. **Trigger:** Running any command on production systems ### [Incident Response Acceleration](https://caro.sh/use-cases/sre#incident-response) Pain: 5/5 Weekly Generate diagnostic commands instantly during high-pressure incidents. **Trigger:** PagerDuty alert at 3 AM ### [AI Hallucination Protection](https://caro.sh/use-cases/sre#ai-protection) Pain: 5/5 Daily Catch when AI tools suggest dangerous commands with deterministic validation. **Trigger:** Using any AI assistant for shell commands ## Real Scenarios You'll Face See how Caro handles actual production situations ### The 2 AM Log Cleanup Caught by Caro **Context:** Production server running out of disk space. You need to free space fast. Terminal $ caro "delete all log files to free disk space" Caro: find /var/log -name "\*.log" -type f -delete CRITICAL: Recursive delete in system directory without age filter Use -mtime +7 to only remove logs older than 7 days Safer alternative: find /var/log -name "\*.log" -type f -mtime +7 -delete **Lesson:** Caro warns you before wiping logs you might need for post-incident analysis. ### The Database Cleanup Caught by Caro **Context:** Need to clean up old backup files from the database server. Terminal $ caro "remove all backup files from database directory" Caro: rm -rf /var/lib/postgresql/backups/\* HIGH RISK: Bulk deletion in database directory Consider keeping recent backups, use --dry-run first Safer alternative: find /var/lib/postgresql/backups -name "\*.sql.gz" -mtime +30 -delete **Lesson:** Pattern matching catches operations in critical system paths. ### The Permission Fix Caught by Caro **Context:** Application can't write to its data directory after a botched deployment. Terminal $ caro "fix permissions on the app directory" Caro: chmod -R 777 /opt/app HIGH RISK: chmod 777 creates security vulnerability Use specific permissions (755 for dirs, 644 for files) Safer alternative: chmod -R u=rwX,g=rX,o=rX /opt/app **Lesson:** Security anti-patterns are caught even when they "fix" the immediate problem. ### The Kubernetes Cleanup Safe to Run **Context:** Evicted pods cluttering the cluster, need to clean them up. Terminal $ caro "delete all evicted pods in production" Caro: kubectl get pods -n production --field-selector=status.phase=Failed -o name | xargs kubectl delete -n production Safe: Targets only failed pods with explicit namespace **Lesson:** Complex k8s commands generated correctly with proper selectors. ### The Network Debug Safe to Run **Context:** API latency issues, need to find which endpoints are slow. Terminal $ caro "show all established connections to port 443 with latency" Caro: ss -tnp state established '( dport = :443 )' | awk '{print $4}' | sort | uniq -c | sort -rn Safe: Read-only network inspection **Lesson:** Complex pipe chains generated correctly without memorizing ss/awk syntax. ## Incident Response Runbooks Common alerts and the commands you need CRITICAL: API Response Time > 5s 1 Check current load `uptime && free -h && df -h` Quick system overview - load, memory, disk 2 Find slow processes `ps aux --sort=-%cpu | head -20` Top CPU consumers 3 Check connection counts `ss -s && ss -tnp | wc -l` Socket summary and total connections 4 Check recent logs for errors `journalctl -u api-server --since "5 minutes ago" --priority=err` Recent error-level logs from systemd **With Caro:** Just describe what you need. Example: `caro "show me what's using the most CPU"` CRITICAL: Disk Usage > 95% 1 Find what's using space `du -sh /* 2>/dev/null | sort -rh | head -10` Top-level directory sizes 2 Find large files `find / -type f -size +100M -exec ls -lh {} \; 2>/dev/null | sort -k5 -rh | head -20` Files larger than 100MB 3 Check log file sizes `find /var/log -name "*.log" -size +50M -exec ls -lh {} \;` Log files that might need rotation 4 Find old files to clean `find /tmp -type f -atime +7 -exec ls -lh {} \;` Temp files not accessed in 7 days **With Caro:** Just describe what you need. Example: `caro "show me what's using the most CPU"` CRITICAL: Pod CrashLoopBackOff 1 Check pod status `kubectl get pods -n production | grep -E "Error|CrashLoop|ImagePull"` Find problematic pods 2 Get pod events `kubectl describe pod -n production | tail -20` Recent events (OOM, liveness failures, etc) 3 Check previous container logs `kubectl logs -n production --previous --tail=100` Logs from crashed container 4 Check resource usage `kubectl top pods -n production --sort-by=memory | head -10` Memory usage across pods **With Caro:** Just describe what you need. Example: `caro "show me what's using the most CPU"` ## When AI Gets It Wrong Real examples of AI hallucinations Caro catches ### AI Suggests Destructive Command You asked an AI: "Clean up the project directory" AI Assistant `rm -rf ./*` Marked as "Safe" → Caro Safety Layer CRITICAL: rm -rf with wildcard - could delete entire directory contents Be specific about what to delete: rm -rf ./build ./node\_modules ### AI Misses Context You asked: "Restart the service to apply changes" AI Assistant `systemctl restart nginx && systemctl restart postgresql` Marked as "Safe" → Caro Safety Layer HIGH: Service restart affects production traffic. PostgreSQL restart causes connection drops. Consider graceful reload: systemctl reload nginx ### AI Uses Wrong Platform Syntax You asked: "Find files modified today" (on macOS) AI Assistant `find . -mtime 0` Marked as "Safe" → Caro Safety Layer Platform mismatch: -mtime 0 behavior differs between BSD (macOS) and GNU (Linux) On macOS: find . -mtime -1 (within last 24h) ### Why Pattern-Based Beats AI-Based **Deterministic** Same input = same result. No randomness, no "sometimes catches it." **Auditable** You can see exactly which pattern triggered. Essential for post-incident review. **Can't Hallucinate** Regex patterns don't make things up. They match or they don't. **Fast** <50ms validation. No API call, no waiting. ## 52+ Patterns We Block A sample of what Caro catches `rm -rf /` System destruction `rm -rf ~` Home directory wipe `:(){:|:&};:` Fork bomb `dd if=/dev/zero of=/dev/sda` Disk wipe `chmod -R 777 /` System-wide permission change `mkfs.ext4 /dev/sda1` Filesystem format `> /etc/passwd` Critical file truncation `mv /* /dev/null` Mass file destruction `wget -O- | sh` Piped remote execution `curl | bash` Piped remote execution Plus: privilege escalation, network backdoors, history clearing, and more. [See full list →](https://github.com/wildcard/caro/blob/main/src/safety/patterns.rs) ## Try Caro in 30 Seconds No account. No API key. No data collection. Just safer shell commands. `bash <(curl --proto '=https' --tlsv1.2 -sSfL https://setup.caro.sh)` Then run: `caro "find files modified in the last 7 days"` Installs to \~/.cargo/bin Single binary, no dependencies Uninstall anytime: cargo uninstall caro Prefer to build from source? [See all installation options →](https://github.com/wildcard/caro#installation)