Dora Noda
Software Engineer
2328 posts · View all authors
Kamaji Turns Kubernetes Control Planes Into Pods — But It Only Cuts the Control-Plane Bill, Not the Worker-Node One
A worked cost model for Kamaji's Cluster API control-plane provider: what running tenant control planes as pods actually removes from a self-hosted fleet's bill, what it leaves untouched, and where its shared-kernel isolation stops being enough.
Kamal Supports Cloud Native Buildpacks, Not Just Dockerfiles: What That Means for bex's Own Build Path
Kamal, 37signals' zero-daemon deploy tool built specifically to avoid PaaS abstraction, now ships a pack builder option for Cloud Native Buildpacks alongside its default Dockerfile path. Here's the actual config, why a minimal-abstraction tool reached for a CNCF spec instead of writing its own builder, and what it means for bex's default.
Kubernetes 1.36 Just Removed gitRepo Volumes and IPVS kube-proxy — Here's the Audit Your Cluster API Fleet Needs Before You Upgrade
Kubernetes 1.36 permanently kills gitRepo volumes (closing a CVE-2024-10220-class RCE) and removes IPVS kube-proxy mode as hard failures, not warnings. Here are the exact audit commands a Cluster API fleet needs before upgrading, including the CAPI config gap that hides IPVS on Hetzner clusters.
Kubernetes Dashboard Is Officially Dead: What Breaks When You Move to Headlamp
Kubernetes Dashboard is archived for good. Here's exactly what breaks in a kubectl proxy workflow when you move to Headlamp, what RBAC setup transfers untouched, and what the Cluster API plugin gives a fleet operator that Dashboard never could.
Your Monitoring Stack Was a Root Shell: What Kubernetes v1.36's Kubelet Authorization GA Actually Fixes
Kubernetes v1.36 closes a real RCE hiding in nodes/proxy, but its GA authorization split is scoped by operation type, not by tenant — here's what it actually fixes and where pod-level break-glass access still has to live.
A 'Medium' CVE Popped a Full Reverse Shell: What ms-agent's Six-Layer Regex Bypass Teaches About Agent Sandboxing
CVE-2026-2256 scored a 'Medium' 6.5 on CVSS, but its proof-of-concept is a full reverse shell through an AI agent's own shell tool. Here's exactly how a six-layer regex denylist got bypassed, and why only a real sandbox boundary — not command validation — closes the gap.
Next.js 16.2 Ships a Stable Adapter API — Vercel's Build Contract Is Now Public
Next.js 16.2's stable Adapter API turns Vercel's once-private build output into a public, testable contract. Here's what the NextAdapter interface actually exposes, and what it takes for a self-hosted platform to build a native adapter instead of guessing.
The State of Platform Engineering Vol 4: 29.6% of Platform Teams Don't Measure Success at All
A 2026 survey of 518 platform engineers found nearly a third don't measure success at all. Here's what the budget and adoption data actually show — and three cheap metrics to instrument instead so your platform isn't next year's defunded line item.
Your Files Never Moved: What Plex's July 2026 Outage Reveals About Fake Self-Hosting
Plex's July 14, 2026 outage never touched a single self-hosted file — but users still got locked out, because auth and discovery route through Plex's cloud by default. Here's what that reveals about the gap between owning your disk and owning your infrastructure.