Dora Noda
Software Engineer
2322 posts · View all authors
GitHub Agent HQ Runs Claude, Codex, and Copilot on the Same Repo — Here's the Trust Boundary Your MCP Server Actually Needs
GitHub Agent HQ runs Claude, Codex, and Copilot side by side on the same repo under one identity model — here's why a deploy platform's MCP server should authenticate the calling app, not the AI vendor behind it.
GKE Labs' OpenRL Runs Fine-Tuning as a Kubernetes Workload: What Owning the Loop Actually Saves Over a Managed API
Google's GKE Labs open-sourced OpenRL, a self-hosted, Tinker-compatible fine-tuning API for Kubernetes. Here's the worked cost math on what running your own LoRA fine-tuning loop actually saves over Together AI's managed API — and what it doesn't.
GPU Inference's Hidden Egress Tax: The 22-31% Line Item Nobody Prices In
2026 cost teardowns keep finding the same thing: GPU-hours are barely half an inference bill once a service actually serves traffic at volume. Here's the worked math on AWS, Azure, and GCP showing where the other 22-31% goes — and an honest look at what self-hosting the serving layer removes versus what it doesn't.
Grafana Fleet Management Now Pushes Config to Any OTel Collector — But Still Can't Run Air-Gapped
Grafana Fleet Management went GA for vendor-neutral OpenTelemetry Collectors on July 8, 2026 — one control plane, one matcher-scoped push, instead of a per-node config edit. The catch: it still requires a live Grafana Cloud backend, and a 20-star open-source project is the only fully self-hosted alternative.
The 2026 'PaaS First' Consensus Has a Blind Spot: Who Owns the Machines
Hacker News flipped its default from Kubernetes-first to PaaS-first in 2026 — but the argument for skipping Kubernetes and the argument for handing your infrastructure to a vendor are not the same argument, and most 2026 takes conflate them.
kpack: The Buildpack Controller That Rebuilds When the Base Layer Patches, Not When You Push
Most git-push PaaS tools only rebuild an app image when you push code — so a CVE patched into the base image sits unused until you happen to touch your source again. kpack's Image/Builder/ClusterStack CRDs close that gap by watching the base layer itself.
Kubernetes 1.36 Lets You Resize a Job Before It Starts: The Queue-Then-Resize Pattern a Build Queue Needed
Kubernetes 1.36 lets a queue controller patch a suspended Job's CPU/memory/GPU requests down to whatever's actually free, then unsuspend it, without losing the Job's identity or history. Here's the worked example, the safety guarantee behind it, and how to wire it into a build-queue controller.
Kubernetes 1.36 Ships Sharded Watch — Cluster API's Own Controllers Can't Use It Yet
KEP-5866 lets Kubernetes 1.36 filter watch events at the API server instead of every controller replica. Cluster API's own controllers can't use it yet — here's the architecture gap and what would actually close it.
Your Kubernetes Autoscaler Can't See Your Queue: Building the Exporter That Fixes It
CPU and memory can't see a growing job queue on an I/O-bound worker. Here's the exact Go exporter, Prometheus adapter config, and HPA YAML that lets Kubernetes autoscale on queue depth instead — and what shipping it as a golden path would take on a self-hosted PaaS.