Dora Noda
Software Engineer
2304 posts · View all authors
Six Traefik Gateway API Advisories in Six Months: The Namespace-Boundary Probes Your Shared Ingress Owes Every Tenant
Traefik shipped six Gateway API isolation advisories between March and August 2026 — including a 9.9 CRITICAL REST-provider exposure and a route-key collision with no workaround. Seven concrete namespace-boundary probes, each with the manifest and the exact assertion, for any platform routing many tenants through one shared ingress.
Appwrite Sites and the BaaS Land Grab: When Your Backend Vendor Wants to Host Your App Too
Appwrite Sites turns an open-source BaaS into a git-push app host, and the 1.9.5 release adds branch/path deploy filters, a Rust runtime, and Bun/Deno builds. Here's what backend vendors climbing the stack means for who owns your deploy pipeline — and where a single-box Compose stack ends and a scheduled fleet begins.
CNCF's Platform Engineering 2.0 Five Pillars: Grading a Self-Hosted PaaS Against the AI-Era Scorecard
CNCF's July 2026 Platform Engineering 2.0 framework sets five AI-era pillars. We grade a Cluster-API-managed, Render-compatible self-hosted PaaS against each one — one pass, two partials, two gaps — and map the honest upgrade path.
Docker Hub's 2026 Pricing Squeeze: What Self-Hosting a Registry Cache Actually Saves Your CI Pipeline
Docker Hub's 2026 free tier is 10 pulls/hour unauthenticated and 40/hour on Personal, with roughly 10x overage past paid plan limits. A line-by-line cost model shows a real CI pipeline paying $160–300/month on Docker Hub versus under €12 for a self-hosted pull-through cache — and exactly where the crossover sits.
Docker Hub Almost Cut You to 40 Pulls an Hour: The Math for Sizing Your Own Registry Cache
Docker's walked-back 10/40-per-hour limits were a preview, not a false alarm: a 15-developer team with ephemeral CI runners and a 12-node cluster hits today's enforced 100/200-per-6-hour buckets on an ordinary Tuesday. The full pull ledger, the tipping-point formula, and how to size and wire a registry cache — registry:2 or Harbor — into a Cluster API fleet.
GAMMA Extends Your HTTPRoutes East-West: Does a Self-Hosted PaaS Need a Service Mesh, or Just the Ingress Layer It Already Owns?
GAMMA lets the HTTPRoute objects a PaaS already provisions for ingress govern east-west traffic too — retries, timeouts, and canary splits without a service mesh. A capability map, worked YAML, real mesh cost numbers, and a decision framework for self-hosted platforms.
Kubernetes 1.36 Ships User Namespaces to GA: What Rootless Containers Change for Multi-Tenant PaaS Isolation
Kubernetes 1.36 graduates user namespaces to GA, remapping container root to an unprivileged host UID. What that changes for packing multiple tenants on shared bare metal — the CVEs it defuses, the version matrix your fleet must clear, and the shared-kernel risks it does not fix.
Your Cluster Runs at 8% CPU: Bin-Packing Defaults for a Self-Hosted Fleet That Can't Return Capacity
Cast AI's 2026 report puts average Kubernetes CPU utilization at 8% and memory at 20%. On elastic cloud that's an expensive bill; on owned hardware it's capacity you already paid for and can't return. Concrete request/limit defaults, a bin-packing scheduler config, and a worked Hetzner-vs-cloud cost delta.
Kubernetes v1.36 Ships Admission Policies That Can't Be Deleted: Closing the Bootstrap Window in Your Fleet's Guardrails
Kubernetes v1.36's manifest-based admission control loads policies from files before the API server serves its first request — undeletable via any RBAC. What it forecloses for a multi-tenant self-hosted PaaS, and the Cluster API bootstrap sequencing that makes guardrails live before the first tenant pod.