Dora Noda
Software Engineer
2333 posts · View all authors
Kata Containers vs gVisor: A RuntimeClass Decision Framework for Multi-Tenant Kubernetes
runC's 2025-2026 escape vulnerabilities settled the question of whether untrusted multi-tenant workloads need stronger isolation. This is the decision framework for which one, per workload, actually pays off.
Kubernetes 1.36 Retires the Webhook for Tenant Defaulting — Here's the Before/After
Kubernetes 1.36 graduates MutatingAdmissionPolicy to stable, letting CEL expressions replace the tenant-defaulting webhook most self-hosted PaaS platforms hand-roll. Here's the before/after code, what operationally disappears, and where a hand-written webhook still wins.
Kubernetes Ships an Official Agent Sandbox Primitive: What It Actually Buys a Self-Hosted PaaS
Kubernetes SIG Apps shipped an upstream CRD for running untrusted AI-agent code safely — here's what it gives a Cluster API-based PaaS for free versus E2B, Daytona, and Modal, the real cost math, and what's still missing.
Kubernetes Wrote the AI Contribution Rulebook. Here's the Cheat Sheet for a One-Person PaaS
Kubernetes' new AI contribution policy leans on CNCF funding most projects don't have — here's which parts are free to copy, and what curl, Ghostty, and tldraw did without that budget.
Render and Railway Bill Per-Second for What Kubernetes CronJob Does for Free
A line-by-line cost comparison of Render Cron Jobs and Railway's cron feature against a plain Kubernetes CronJob on a self-hosted Cluster API fleet, at 1, 5, 20, and 100 scheduled jobs a month.
The Kubernetes CSI Driver Bug That Turns a Tenant's subDir Into a Delete Weapon
CVE-2026-3864 and CVE-2026-3865 let a crafted subDir value in a PersistentVolume escape onto the shared NFS or SMB export it's mounted from. Here's the exact mechanism, who can actually trigger it on a self-hosted PaaS, and the audit checklist that closes it.
Kubernetes 1.36's Fine-Grained Kubelet Authorization Is GA — Here's Exactly What It Doesn't Fix
Kubernetes 1.36 splits kubelet API permissions out of the all-or-nothing nodes/proxy grant — but exec, attach, and portforward stay bundled together by design, so tenant kubectl exec access is exactly as risky as before.
The 20-40% Kubernetes Tax: What Small-Team Maintenance Data Actually Costs, and When Fleet Management Pays It Off
Small teams running their own Kubernetes lose 20-40% of an engineer's time to upgrades, cert rotation, and etcd backups — here's what that costs in dollars, and when Cluster API automation actually claws it back.
Kubernetes 1.36's unusedSince Field Turns Orphaned-Volume Hunting Into a Query
Kubernetes 1.36 adds an unusedSince timestamp to every PVC's status, turning orphaned-volume hunting from a manual cross-reference script into a one-line query — and a self-hosted PaaS's precondition for automated reclaim jobs.