Dora Noda
Software Engineer
2331 posts · View all authors
PSI Metrics Reach GA in Kubernetes 1.36: What Your Node's CPU/Memory Graphs Have Been Hiding
Kubernetes 1.36 graduates PSI metrics to GA, but the kubelet's own eviction manager still doesn't read them. Here's the exact wiring a self-hosted, Cluster-API-managed fleet needs to build itself — and the CPU-PSI gotcha that will burn you if you skip it.
GhostApproval: The AI Coding Agent Flaw That Turned 'Approve This Edit?' Into a Rubber Stamp
Wiz's GhostApproval disclosure shows six AI coding assistants following symlinks out of their sandboxes while their approval dialogs described a different file than the one being written. Three vendors patched it; two said a patch isn't possible.
Hetzner Tripled Some Cloud Tiers in 2026 — OVHcloud and Scaleway Didn't: A Line-by-Line Node-Pool Cost Comparison
Hetzner raised its dedicated-vCPU cloud tier up to 173% in 2026 while OVHcloud and Scaleway raised comparable tiers by single digits — a line-by-line node-pool cost comparison, and why multi-sourcing across Cluster API providers is the real hedge.
Your PaaS Bill Lied to You: The Hidden Line Items on Render, Railway, and Fly.io — and the Ones Self-Hosting Doesn't Tell You About Either
Render, Railway, Fly.io, and Vercel all publish a sticker price — but egress, IPv4, and snapshot metering are what turn a bad month into a very different bill. Here's the real rate card, and the line items self-hosting doesn't put on its own homepage either.
Your Buildpack Only Checks bun.lockb. Bun Stopped Writing It in 2026.
Bun 1.2 quietly changed its default lockfile from bun.lockb to bun.lock, and it's already broken Bun detection on Railway, Cloudflare Pages, and Netlify. Here's the detection logic that survives the next lockfile change, and why 'build with Bun, run on Node' is the right default for existing projects.
Coolify's 6% Idle CPU Tax vs Dokploy's 0.8%: What Single-Daemon PaaS Resource Overhead Actually Costs at Fleet Scale
Coolify idles at roughly 6% CPU and 700MB RAM per box; Dokploy idles at 0.8% CPU and 350MB. Priced across a fleet, that gap crosses the cost of a fixed Cluster API control plane by the time you're running 17-65 boxes.
Daytona's $24M Compliance Bet: What a HIPAA/SOC 2 AI Sandbox Really Costs to Build Yourself
Daytona's $24M Series A prices out HIPAA/SOC 2 compliance for AI sandboxes — the real dollar-and-timeline cost of building that compliance yourself, and why a self-hosted platform already owns the harder half of the pitch for free.
DigitalOcean's Per-Second Billing Won't Save Your Always-On Fleet a Cent
DigitalOcean now bills Droplets by the second instead of the hour — but a 672-hour monthly cap means an always-on control-plane node pays the exact same bill either way, and it's still 5.5x a comparable Hetzner box.
Docker's CVE-2026-34040 Is the Second Time This AuthZ Bypass Shipped: A Padded HTTP Request Still Grants Host Access on Unpatched Engines Below 29.3.1
CVE-2026-34040 bypasses every Docker AuthZ plugin with one oversized HTTP request — the same underlying gap as 2024's CVE-2024-41110, patched twice and still exploitable below Engine 29.3.1. Here's the exact payload, why the first fix didn't hold, and what it means for a Cluster API fleet's patch discipline.