Dora Noda
Software Engineer
2325 posts · View all authors
npm v12 Turns Off 16 Years of Automatic Code Execution: The Exact Packages You Need to Re-Approve Before Your Build Breaks
npm v12 flipped install scripts, Git dependencies, and remote tarballs to off by default after a year of worm-driven supply chain attacks — here's the exact audit of which packages need re-approving and what it means for a git-push PaaS's Node buildpack.
The NSA Just Published a Threat Model for MCP: What It Means for Your Deploy Agent
The NSA's AI Security Center named four structural risks in MCP's design — and every one already has a real 2026 incident behind it. Here's what each means concretely for a self-hosted MCP server with deploy and rollback authority.
Gitpod Bet the Company on Self-Hosted Agent Infra — Then OpenAI Bought It
Gitpod rebranded to Ona and went self-hosted-only in September 2025. Nine months later OpenAI bought it for Codex. Here's what a hyperscaler choosing to buy customer-owned execution instead of building it actually signals.
pgBackRest Got Archived, Then Rescued: The Bus-Factor Checklist Every Self-Hosted Postgres Backup Stack Needs
pgBackRest's repo went read-only in April 2026 after its corporate sponsor was sold, then a nine-company coalition revived it three weeks later. Here's the five-question checklist that story exposes, applied to the two real backup paths a CloudNativePG operator can choose today.
Railway's New MCP Server Has 7 Tools. bex's Shipped One Has 13 — and Still Can't Deploy
Railway's remote MCP server ships 7 tools and a one-line agent install; bex's already-shipped MCP server exposes 13. Here's what each actually lets an agent do unattended, and the one deploy verb bex still owes its own roadmap.
The Self-Hosted PaaS Category Gets Crowded in 2026: What Coolify, Dokku, CapRover, and Dokploy Actually Don't Do
Coolify, Dokku, CapRover, and Dokploy now cover the self-hosted PaaS category from every angle. A grounded look at the three things none of them do — and the real cost of the Kubernetes-native alternative that does.
SNCF Rebuilt Its Cloud-Native Platform on Cluster API — Here's What Changed
CNCF gave SNCF its 2026 Top End User Award for a Cluster API rebuild that cut cluster provisioning from a month to 30 minutes and production incidents by 90%. Here's the stack, the before/after numbers, and what it proves about running Cluster API at production stakes.
What a Zanzibar-Style Relationship Graph Buys a Deploy MCP Server Over a Scoped API Key
AuthZed is pitching SpiceDB's relationship-graph authorization for AI agents. Here's the actual SpiceDB schema for a deploy/rollback MCP server, what it can check that a scoped API key can't, and whether running it is worth the operational cost.
SPIRE Needs Your Fleet's Shape in Advance. An Orchestrator Spawning Sub-Agents Doesn't Have One.
SPIRE requires every workload to be pre-registered before it can attest — a model that breaks the moment an orchestrator spawns sub-agents on demand. Here's the actual registration race, the ClusterSPIFFEID fix, and what it still doesn't solve.