Dora Noda
Software Engineer
2316 posts · View all authors
AWS's New ACME Endpoint Isn't Free: What $1 Per Domain, Every 45 Days, Costs a Multi-Tenant PaaS
AWS Certificate Manager now speaks ACME, but it charges $1 per domain on every issuance and renewal — at a 45-day cert lifetime, that's a metered bill free Let's Encrypt never had. Here's the worked cost comparison.
AWS CloudFront's Control-Plane Failure Took Down Hugging Face and Canvas: What Owning Your Infrastructure Doesn't Save You From
A CloudFront control-plane bug took down Hugging Face, Canvas, and Blackboard at once, even though none of them run application logic on CloudFront. A layer-by-layer look at what owning your own ingress actually removes from that risk — and what it only relocates.
AWS Built a Five-Step AI Agent Just to Pick a Service
AWS's deploy-on-aws plugin takes five steps and three MCP servers to deploy an app because it's solving a 200-service menu problem. Here's what happens to that step count on a platform that never had the menu — and the one step that stays hard everywhere.
Backstage Ships MCP Tokens for Claude and Cursor: What Exposing a Golden-Path IDP to AI Agents Actually Requires
Backstage 1.43 lets Claude and Cursor call your golden-path Scaffolder actions with a short-lived, per-user token instead of a shared secret. Here's the actual config, the failure mode an unscoped action list creates, and what a self-hosted PaaS's own MCP server needs to copy.
Better-PaaS Ships Scoped Agent Tokens for Cursor and Claude Code — What an AGPL Self-Hosted PaaS Choosing Managed Databases Over bex's Non-Goal Reveals
Better-PaaS, a single-maintainer AGPL project, ships three-tier scoped agent tokens and seven MCP tools for Cursor and Claude Code — a concrete look at what that buys against bex's own coarser key model, and where Better-PaaS's bundled managed databases trade convenience for the high-availability story a single VPS can't back.
Why bex Skips the Crossplane-Style Multi-Cloud Abstraction Layer
Crossplane just graduated CNCF's top maturity tier promising one API across every cloud. Here's why bex, a Cluster API-based platform, deliberately skips that abstraction to keep every workload traceable to one physical machine.
Kaniko Is Archived: What Actually Changes When a Buildpacks Pipeline Switches to Buildah
Google archived Kaniko in June 2025 and its Chainguard fork is maintenance-only. Here's exactly what changes in a Kubernetes build pod's spec, caching architecture, and registry auth when a buildpacks-based PaaS switches its Dockerfile-fallback builder to Buildah — and the one dependency on Kaniko you can't migrate away from.
Your Tenants' 'edit' Role Could Steal Another Tenant's DNS Credentials: The cert-manager Challenge Bug and the RBAC Audit to Run Today
A cert-manager bug let any tenant with Kubernetes' built-in edit or admin role steal another tenant's DNS credentials through a crafted ACME Challenge — not from a misconfiguration, but from an RBAC aggregation label almost no one audits. Here's the mechanism and a six-check audit to run against your own multi-tenant TLS setup.
cgroup v1 Is About to Break Your Kubernetes Nodes: A Migration Checklist Before August 26, 2026
Kubernetes v1.37 makes kubelet refuse to boot on cgroup v1 nodes by default. Here's the exact command to check your fleet, what changes in tenant CPU/memory enforcement, and a migration checklist before the August 26, 2026 deadline.