Dora Noda
Software Engineer
2316 posts · View all authors
Cilium's Sidecarless mTLS Kills the Service-Mesh Tax — But Not the Way You'd Assume
Real numbers on what a sidecar mesh actually costs, how Cilium's eBPF mTLS removes it, and the eventually-consistent identity cache that a documented security review found exploitable — plus what a multi-tenant self-hosted PaaS should actually run.
Cloudflare Containers Went GA on 128MB-Workers Money: What Per-10ms Billing Actually Costs a Real Backend
Cloudflare Containers left beta on April 13, 2026 billing every 10ms of active CPU on top of the $5/mo Workers Paid plan. A worked recompute: what a persistent backend actually costs on that meter versus a flat €5.49/mo owned Hetzner box — and the bursty workload where Containers wins outright.
Cloudflare R2 Was Down for 17 Hours in July 2026 — Here's What 'Zero Egress' Actually Costs When It Breaks
Cloudflare R2 returned 500 errors across three separate incidents in July 2026, blowing past its own 99.9% SLA by roughly 30x in one month. Here's the SLA math, a worked cost comparison against Hetzner-owned object storage, and the exact egress volume where R2's free-egress pricing actually starts winning.
Cloudflare Tunnel Is Now Fully Free — What Zero-Open-Ports Ingress Means for Your Self-Hosted PaaS
Cloudflare Tunnel is now free with unmetered bandwidth and unlimited tunnels — but an October 5, 2026 API change breaks anything scripted against its old routes. Here's what it buys a self-hosted PaaS's tenants, what it costs, and the migration checklist.
CloudNativePG's First CVE Is a 9.4: How Scraping Metrics Handed Out Postgres Superuser
CloudNativePG's first-ever CVE let a low-privileged database user escalate to PostgreSQL superuser and OS command execution through the default metrics exporter — the exploit chain, the fix, and the unrelated failover bug that shipped in the same release.
CloudNativePG's Snapshot PITR Can Restore a Multi-TB Postgres in Minutes — Hetzner's CSI Driver Still Can't Take the Snapshot
CloudNativePG's snapshot-based backup can restore a multi-terabyte Postgres cluster in minutes, but Hetzner's own CSI driver has never implemented volume snapshots. Here's what actually runs on Hetzner today — the Barman Cloud Plugin path — and when swapping in Piraeus/LINSTOR for snapshot support is worth the operational cost.
Cluster API v1.12: What Chained Upgrades Actually Save a Kubernetes Fleet That Fell Behind
Cluster API v1.12 adds in-place updates and chained upgrades — here's what collapsing three separate Kubernetes minor-version rollouts into one reconciliation pass actually saves a bare-metal Hetzner fleet that fell behind, and where the old drain-and-verify discipline still applies.
ClusterClass Turns Tenant Cluster #500 Into a One-Line Diff From Cluster #1
Cluster API's ClusterClass collapses seven hand-copied objects per tenant cluster into one shared template plus a handful of variable overrides — the concrete before/after, the patch mechanics, and what it still doesn't solve.
CNCF Buildpacks Graduation: What Reaching the Top Maturity Tier Actually Changes
Cloud Native Buildpacks reached CNCF's Graduated maturity level on July 17, 2026. Here's what the governance milestone actually verifies, what it doesn't change technically, and why it matters for a platform team betting its build layer on the spec.