Incident status

Green on localhost. Red everywhere with customers.

Somewhere right now, QA has attached a screenshot, a timestamp, a video, the exact request payload, and perhaps a small notarized statement from three witnesses. A developer has looked at this evidence, run the feature once, and replied: “It works on my machine.”

01 // The immortal sentence

Not a fix. Technically an observation.

“It works on my machine” is funny because it is simultaneously true and useless. The developer is reporting a successful experiment: one version of the code ran on one laptop, under one operating system, with one mysterious collection of environment variables, globally installed packages, cached credentials, and background services accumulated since university.

The sentence feels defensive because software is personal. We built the thing. A bug report arrives sounding less like “the system reached an unexpected state” and more like “your child bit someone at daycare.” Reproducing the bug threatens a small part of our identity as competent people, so the brain offers a cheaper alternative: perhaps QA has used the internet incorrectly.

Certified local success One machine. One attempt. Infinite confidence.

02 // The lolage section

The five stages of bug denial

01 Denial

“That’s impossible. I just ran it.”

The bug has violated causality by existing somewhere the developer is not currently looking.

02 Blame

“It must be caching. Did you hard refresh?”

Every browser cache becomes a convenient offshore account for unexplained defects.

03 Gaslighting

“Are you sure you’re using the right environment?”

QA checks the URL for the fourth time and briefly questions the nature of reality.

04 The excuse

“Well… it works on my machine.”

The developer has won a case nobody was arguing: yes, the developer’s laptop is delighted.

05 Acceptance

“Wait. Do you have PAYMENTS_REGION set?”

A terminal opens. Slack becomes quiet. An undocumented environment variable enters the postmortem.

The mature version of this journey is shorter: believe the report, collect the difference between environments, and make the failure reproducible. The goal is not proving where the code works. The goal is explaining why it fails where it matters.

03 // Hall of fame

Classic excuses from the bug-avoidance cinematic universe

“That’s not a bug. It’s an undocumented feature.”
“It’s a known issue with the user’s browser. Tell them to install Chrome.”
“Nobody would click the buttons in that order.”
“The API is eventually consistent. How long did you eventually wait?”
“It passed CI.” CI quietly used a cached build from Tuesday.
“That endpoint is deprecated.” The mobile app currently sends 40,000 requests to it per hour.
“The test data is unrealistic.” The test data is a customer named O’Connor.
“Works as designed.” Nobody can locate the design.

These lines endure because each contains a grain of engineering truth. Browsers differ. Caches lie. Eventual consistency exists. Requirements can be ambiguous. Comedy begins when a possible cause is promoted directly to a verdict without evidence.

04 // The general-knowledge twist

How an excuse helped build an industry

Environment drift is older than Docker. Unix chroot, virtual machines, FreeBSD jails, Solaris Zones, and Linux namespaces and control groups all contributed to isolating processes and their resources. Docker did not invent the idea of a container. It made Linux container primitives dramatically easier for ordinary development teams to build, package, share, and run.

Isolation existed, but workflows were fragmented and often operations-heavy.

Solomon Hykes publicly demonstrated Docker at PyCon, framing the problem simply: shipping software to servers was hard.

The first Kubernetes commit arrived as teams confronted the next problem: operating many containers at scale.

Kubernetes 1.0 launched and the project joined the newly formed CNCF ecosystem.

A container image packages the application with its files, libraries, binaries, and configuration expectations. The running container remains dependent on the host kernel and runtime, so it is not literally your entire laptop. But the meme is directionally perfect: Docker is the industry putting the relevant parts of your machine in a standardized box, labeling the box, and shipping that box instead of an optimistic setup document.

Once every team had boxes, another question appeared: who starts them, restarts them, connects them, places them on machines, rolls out new versions, and stops one failed box from ruining Thursday? Kubernetes turned container orchestration into a broadly available platform, informed by Google’s earlier experience with Borg and Omega. The lineage from excuse to ecosystem is not a straight line, but the demand is clear: reproducibility became infrastructure.

That demand now supports a multi-billion-dollar industry of managed container platforms, registries, security scanners, observability products, certifications, and platform-engineering consultancies. One excuse did not create all of cloud computing, obviously. It did name the pain with unusual efficiency—and the industry has been productizing relief ever since.

The meme, translated into architecture

Developer: “It works on my machine.” Operations: “Fine. Please provide your machine as an immutable artifact with declared dependencies, health checks, resource limits, and a rollout strategy.”

05 // Containers are not holy water

You can package a bad assumption perfectly

Containers reduce environmental differences; they do not abolish them. CPU architecture, kernel behavior, mounted files, external databases, cloud permissions, DNS, secrets, network policy, and production traffic still differ. A container that expects a local database named postgres will fail consistently and portably when production calls it something else.

Reproducibility also requires discipline around the image itself. Pin base images by version or digest where appropriate, commit lock files, make builds deterministic, scan dependencies, keep configuration outside the image, and test the exact artifact that will be deployed. “It works in my container” can become merely the deluxe edition of the original excuse.

06 // Your machine is a lawless wasteland

A practical audit before blaming staging

  • Compare runtime versions.Check node --version, Python, Java, database engines, and CPU architecture against CI and staging.
  • Verify the package manager.npm, pnpm, and Yarn can resolve differently. Pin the package manager and commit the correct lock file.
  • Reinstall from nothing.Delete generated dependencies and perform the same frozen, clean install used by CI.
  • Audit global packages.Run the project without tools silently supplied by npm -g, system Python, Homebrew, or an ancient shell profile.
  • Diff configuration names, not secret values.Find missing environment-variable keys, unexpected defaults, whitespace, quoting, and staging-specific feature flags.
  • Check uncommitted files.Your local .env, generated certificate, ignored migration, or edited config may be the only thing keeping the app alive.
  • Inspect backing services.SQLite is not PostgreSQL. Local memory is not Redis. Match service types and versions where behavior matters.
  • Neutralize caches.Test a clean browser profile, rebuild artifacts, clear service-worker data, and confirm the deployed commit and image digest.
  • Reproduce the network.Latency, proxies, TLS, DNS, CORS, and restricted egress expose assumptions localhost politely ignores.
  • Start from a clean environment.A container, disposable VM, or CI job reveals every invisible dependency your laptop has been donating.

The Twelve-Factor App summarized the professional answer years ago: explicitly declare and isolate dependencies, and keep development, staging, and production as similar as possible. The best response to “it works on my machine” is not banning the sentence. It is making the machine reproducible enough that the sentence becomes useful evidence.

So yes, celebrate the local success. Then capture the versions, configuration contract, services, build inputs, and artifact that produced it. Your laptop is allowed to be weird. Your deployment process is not allowed to depend on the weirdness.

Sources // historical and technical references

Further reading

  1. Docker — Public debut at PyCon in March 2013
  2. Docker Docs — Containers, images, portability, and namespaces
  3. Kubernetes — Ten years of project history
  4. The Twelve-Factor App — Development/production parity
  5. The Twelve-Factor App — Explicit dependency declaration and isolation

Written and fact-checked by

Kawshik Ahmed Ornob

Cybersecurity specialist, AI and NLP researcher, and full-stack engineer writing about secure development systems—and occasionally their excuses.