Dora Noda
Software Engineer
2304 posts · View all authors
Your AI Agent's Debug Loop Costs Grow Quadratically, Not Linearly — Here's the Math
A 50-step AI agent debug loop bills 26x more than the tool calls it actually made — because every LLM call resends the entire conversation history. Here's the math, the real dollar cost for a deploy-from-chat MCP server, and the fix that actually bounds it.
Blue-Green Deploys on Cluster API: Flipping a Tenant's Traffic Between Two MachineDeployments Without Touching the Load Balancer
A rolling MachineDeployment update isn't blue-green. Here's the actual Cluster API primitive for an atomic, instantly-reversible traffic cutover — two MachineDeployments, one Service selector flip, and the in-flight-request handling most implementations skip.
The Buildpack Escape Hatch: Why 'No Dockerfile' Breaks for About 1 in 5 Repos
Buildpack pitches promise you'll never write a Dockerfile — until the detect phase rejects your repo with no editable file to fix. A worked estimate of how often that happens, and the three-tier escape hatch a git-push platform should ship instead of just falling back to raw Dockerfiles.
Buildpacks vs Dockerfiles for a Git-Push PaaS: The Real Build-Time, Image-Size, and Leaked-Detail Numbers
Buildpacks promise 'no Dockerfile needed,' Dockerfiles promise full control. A real, sourced comparison of build time, image size, and how much implementation detail each one pushes back onto the developer.
Cloudflare D1's Per-Row Meter Turned 765,000 Rows Into a $134 Bill: What a 10GB-Per-Database Cap Costs a Bundled PaaS Database
A published $134 Cloudflare D1 bill — 95% of it a single line item of 127 billion metered row reads from a missing index — is a concrete look at what per-row database billing and a 10GB-per-database cap actually cost, against a self-hosted SQLite-plus-Litestream setup where a bad query is a latency problem, not an invoice line.
CVE-2026-18381: When Your Operator's CRD Field Becomes a Token Exfiltration Bootstrap
A user-editable upload URL in a Red Hat OpenShift operator let anyone with CR edit access steal its service-account token — no exploit needed, just a redirect. Here's the audit checklist for finding the same bug shape in your own operators.
Show HN's Cygnus: What a Serverless-Runtime Framing Actually Changes (and What It Doesn't) Versus a Container-Per-App PaaS
Cygnus revives an idle app from zero in about 30 milliseconds using kernel-sandboxed 'cages' instead of containers. Here's exactly what that architecture buys over Coolify and Dokploy's always-on containers — and why it still hits the same one-box ceiling the rest of the category has.
Kubernetes 1.36's Declarative Validation Goes GA: Which Webhook a Self-Hosted Cluster API Fleet Can Actually Delete — and Which One It Can't
Kubernetes 1.36's Declarative Validation only touches built-in types, not CRDs — the webhook a Cluster API fleet can actually delete graduated two releases earlier under ValidatingAdmissionPolicy. Here's the exact boundary between the three mechanisms, and the stateful checks none of them can replace.
Docker Hub's 2026 Price Hikes Make the Case for a Self-Hosted Harbor Registry
Docker's 2026 price hikes and pull rate limits push a busy CI pipeline into a $1,800/year seat-priced plan for one feature: unlimited pulls. Here's what a self-hosted Harbor registry costs instead.