Dora Noda
Software Engineer
2333 posts · View all authors
Podman 6.0 Goes Rootless by Default — And No, It Still Isn't Your Kubelet's Container Runtime
Podman 6.0 makes rootless the mandatory default and rips out CNI, slirp4netns, cgroups v1, and BoltDB. Here's what actually changes — and the one thing it doesn't: your Kubernetes nodes still don't run Podman.
Railway's 8-Hour Outage Was a GCP Account Suspension, Not a Railway Bug
Railway ran workloads across GCP, AWS, and its own bare metal — but a single suspended GCP account still took the whole platform down for 8 hours. Here's the exact mechanism, and why owning the machines your control plane runs on is the only real fix.
The Solo-Developer Breakeven Calculator: When Railway's $10-15/Month Actually Costs More Than Owning the Box
Railway's real $10-15/month solo-developer bill is legit — but price your own maintenance hours at even $25/hour and the breakeven point against owning a Hetzner box moves dramatically. A worked table shows exactly where the math flips.
Render's April 2026 Egress Cut From 100GB to 5GB on Hobby: Recalculating a Bandwidth-Heavy App's Bill Before the August 1 Deadline
Render cut included egress from 100GB to 5GB on Hobby and 1TB to 25GB on Pro, then started billing overage at $0.15/GB. Here's the real before/after math for a bandwidth-heavy app before the August 1 auto-migration.
Render Cut Free-Tier Bandwidth 20x in April 2026 — Here's What the Same App Costs on a $4.59 Hetzner Box
Render's April 2026 repricing cut Hobby bandwidth from 100GB to 5GB and killed per-seat fees. A line-by-line recompute of what that costs a hobby blog versus a media-heavy team, and what the same workload runs on a self-hosted Hetzner box.
Render Kills Per-Seat Pricing: The Exact Team Size Where Flat Fees Flip Against You
Render dropped per-seat workspace billing for a flat fee on April 23, 2026 — but Pro and Scale flip in opposite directions, and the Scale breakeven doesn't land until 18 seats. Here's the exact math, who pays more, and what never enters the bill on an owned fleet.
The Trust Gradient Is Broken: Why AI Deploy Agents Need Revocable Capabilities, Not Permission Levels
A Cursor agent used a stray API token to delete a production Railway volume. New research shows why permission tiers like read-only or full-auto can't stop that — and what a capability that expires actually buys you.
Switching to crun Won't Save You From runc's Masked-Path Escape Bug — Here's What Actually Will
Three runc CVEs disclosed in November 2025 share one root cause, and crun's own coordinated patch proves switching runtimes doesn't dodge it. Here's the concrete patch checklist self-hosted Kubernetes fleets actually need to run.
Coolify vs Dokploy vs Kubero vs bex: The Single-Box-vs-Fleet Decision
Coolify, Dokploy, Kubero, and bex all promise git-push deploys you own — but only two of them are actually built to run on a single box, and the other two structurally can't be. Here's the architecture, cost, and failure-mode breakdown that decides which one fits.