Dora Noda
Software Engineer
2331 posts · View all authors
Zerops Says Its Pricing Is 'Just Hardware.' The Real Bill Runs 2.6x Raw Hetzner
Zerops prices itself as pure hardware, no plans, no seat fees. Here's what the actual 2026 rate card charges for a real three-service app, and why the bill still runs 2.6x the cost of the identical specs on raw Hetzner hardware.
A2A Turns One and Hits v1.0: What a Standard Agent-to-Agent Handshake Actually Buys a Deploy-From-Chat Pipeline
A2A hit v1.0 and 150+ organizations in its first year under the Linux Foundation. Here's a worked example of what its signed Agent Cards and task-approval states actually change for a deploy pipeline where one agent requests a rollback and another approves it — and whether a self-hosted PaaS's MCP server needs to speak it yet.
Your Agent's Shell and Your Tenant's Container Cannot Share a Blast Radius
A concrete node-pool, network-policy, and runtime-class architecture for keeping an AI agent's shell isolated from the tenant container it's deploying and operating.
AgentBox Puts a Bare Hetzner VM on the Same Feature Table as E2B and Daytona
AgentBox, a 247-star MIT CLI, already lists a bare Hetzner box next to E2B and Daytona on its provider table. A teardown of its checkpoint and credential-isolation mechanisms — and what a Cluster-API fleet should borrow versus build on kubernetes-sigs/agent-sandbox instead.
Anubis Crosses 20,000 Stars: What Self-Hosting Your Own AI-Scraper Defense Actually Costs
Anubis's proof-of-work challenge crossed 20,000 GitHub stars fighting AI scrapers — here's what it actually costs in compute versus what its JavaScript requirement costs real visitors, and whether a self-hosted PaaS should bundle it.
Beam's Beta9 Is the Only Self-Hostable E2B Alternative Left Standing
E2B and Daytona's sandbox pricing landed on the exact same number in 2026. Then Daytona announced it's going closed-source. A concrete look at what's left of the self-hostable AI-agent sandbox category, and why Beam's open-source Beta9 engine is the one still standing.
Cilium's eBPF Egress Gateway: The Stable Outbound IP Without the $0.135/GB NAT Tax
AWS charges $0.135/GB for a stable outbound IP through a NAT gateway. Cilium's eBPF-based Egress Gateway does the same job as a Kubernetes CRD, and on an owned Hetzner fleet it costs nothing beyond the node you already run.
Cilium Tetragon Hits Production Maturity: What Kernel-Level eBPF Enforcement Adds to a Self-Hosted PaaS's Sandbox
Tetragon 1.4 cleared the rough edges on policy authoring in February 2026. Here's what its in-kernel enforcement actually adds on top of a gVisor/Kata sandbox boundary — with a real TracingPolicy that kills an escape attempt before it lands.
Cloud Native Buildpacks Ship SBOMs by Default: What a Build-Time Bill of Materials Gets You That a Scanner Never Can
Cloud Native Buildpacks generate a CycloneDX/SPDX bill of materials as a build-time side effect, populated from dependencies the buildpack actually resolved and installed. A Dockerfile pipeline's nearest equivalent, Docker BuildKit's SBOM attestation, scans the finished image instead — and misses build-stage-only dependencies right when the EU CRA's September 2026 reporting deadline makes that gap expensive.