Docker Compose's models: Key Has Been in the Official Spec Since June 2025 — What That Means for a Compose-to-Cluster-API Build Step
Docker Compose's models: key for defining AI models, agents, and MCP tools has quietly been part of the vendor-neutral Compose Specification since June 2025 — here's the exact YAML, and what it means for a git-push PaaS's build pipeline.
Hetzner's GEX131 GPU Server: What €889/Month for a Blackwell RTX PRO 6000 Buys Against AWS's g5.xlarge
Hetzner's GEX131 costs more per month than AWS's g5.xlarge — but a third as much per gigabyte of VRAM. Here's the worked cost-per-GB math across on-demand, spot, and reserved AWS pricing, plus what 96GB of VRAM actually unlocks that 24GB can't.
GhostApproval: The AI Coding Agent Flaw That Turned 'Approve This Edit?' Into a Rubber Stamp
Wiz's GhostApproval disclosure shows six AI coding assistants following symlinks out of their sandboxes while their approval dialogs described a different file than the one being written. Three vendors patched it; two said a patch isn't possible.
Your Deploy Agent's MCP Server Just Became Infrastructure: What Changes When It Leaves Your Laptop
A concrete walkthrough of what an infrastructure-control MCP server owes you once it moves from a local stdio process to a remote service teammates, CI, and other agents can call: mandatory auth, per-action write scopes, stateless-scaling idempotency, and a tested rollback plan.
Daytona vs E2B for Self-Hosted AI Sandboxes: The Helm Chart Doesn't Do What You Think
Daytona's Helm chart looks like the easy self-hosting path for AI code sandboxes, but its own README shows the control plane never leaves Daytona's cloud. Here's what standing up Daytona and E2B actually requires on a Cluster API–managed fleet.
Dynamic Resource Allocation Comes of Age in Kubernetes 1.36: Scheduling GPUs Declaratively Instead of Renting a Managed Tier
Kubernetes 1.36 matures Dynamic Resource Allocation's GPU-scheduling features right as Fly.io kills its GPU line — here's what DeviceClass and ResourceClaim actually replace, and the real cost math between owning a Hetzner GPU and renting one by the second.
Manufact Raised $6.3M to Be 'Vercel for MCP Servers' — Here's Exactly What a Generic Git-Push PaaS Doesn't Give You
Manufact raised $6.3M to build a hosted cloud purpose-built for MCP servers. Here's the actual pricing, the actual feature list, and what deploying the same MCP server on a generic git-push PaaS gets you instead.
One Binary, Six Categories: What Octelium's VPN-ZTNA-MCP-Gateway-PaaS Convergence Actually Buys and Costs
Octelium bundles a VPN, ZTNA platform, API/MCP gateway, and PaaS into one AGPL binary with per-agent identity for AI tool calls. Here's exactly what that convergence buys in security and what it costs in blast radius, licensing, and bus factor.
13 Critical CVEs, One Patch: What the vm2 Sandbox-Escape Wave Says About Isolating AI Agents at the Wrong Layer
A May 2026 wave of 13 critical vm2 CVEs shows why JavaScript-level sandboxing can't contain AI-agent code — and why kernel-level isolation like gVisor and Kata Containers is the layer that actually holds.