Dora Noda
Software Engineer
2336 posts · View all authors
Coolify's 58K Stars vs Dokploy's 35K: What Two Self-Hosted PaaS Growth Curves Actually Say
A same-day GitHub API check of Coolify's and Dokploy's star counts, MCP capabilities, and architecture puts the 'fastest growing PaaS' claim to the test — and finds the two projects' AI-agent tooling tells a very different story than their star counts do.
Docker's MCP Gateway Caps Every Tool Call at 1 CPU / 2GB: The Container Security Model Your Deploy Bot Should Steal
A critical RCE in Anthropic's MCP SDK won't be patched at the protocol layer, so containment has to happen at the tool-server layer. Here's exactly what Docker's MCP Gateway locks down by default, and how to size the same model for a PaaS's own deploy/rollback/scale tools.
Dokploy's CVE-2026-27130: OS Command Injection via the appName Parameter in a Popular Self-Hosted PaaS, and What It Means to Trust a Deploy Tool With Root on Your Fleet
Dokploy's CVSS 9.9 command injection through the appName field, why it's the second time that field has been the entry point, and why the same bug class keeps recurring across self-hosted PaaS deploy tools.
E2B Joined the OpenAI Agents SDK. The Real Story Is How Many Times It's Had To.
E2B's OpenAI Agents SDK integration is its tenth publicly documented per-product integration guide, not its first — here's what the real count reveals about building versus betting on MCP for a self-hosted sandbox platform.
Envoy AI Gateway Hits v1.0: A CNCF Blueprint for Securing Your Own MCP Server
Envoy AI Gateway's v1.0 release stabilizes MCPRoute and MCPRouteSecurityPolicy, giving self-hosted platforms CEL-based per-tool authorization and audit trails for AI agents — without building an MCP authorization layer from scratch.
Gateway API v1.5's ListenerSet Just Solved Multi-Tenant Custom Domains — Here's the RBAC Layout That Replaces Your Ingress Hacks
Gateway API v1.5's ListenerSet lets tenants self-serve custom domains on a shared Gateway without cluster-wide write access — here's the actual YAML, precedence rules, and RBAC layout that makes it safe, not just self-service.
GitHub Tried to Meter Self-Hosted CI Runners, Then Backed Off
GitHub announced a $0.002/minute charge on self-hosted Actions runners, then postponed it within 48 hours. Here's the cost math it would have meant, and the control-plane dependency it exposed even for teams that already self-host their compute.
Hetzner Already Killed the datacenter Field — What a CAPH Fleet Must Check Before August 1
Hetzner already removed the datacenter field from its API on July 1, and EC2-compatible metadata routes disappear August 1 — here's exactly what breaks in a CAPH-managed fleet, what's already patched, and how to check.
The Hidden PaaS Tax Nobody Puts in the Pricing Table
Render and Vercel both charge $100/month for a static outbound IP, on completely unrelated billing models — a line-by-line invoice reconstruction of what a real indie-SaaS topology costs on Render, Railway, Fly.io, and Vercel versus a single owned Hetzner box.