The Entrypoint You Didn't Write: Buildpacks Is Moving Its 2.9 MB Launcher Into the Run Image and Rewriting It in Rust
Every buildpack-built image runs a 2.9 MB Go binary you never chose, and it is why your scanner is red. Two open CNB RFCs would move it into the run image and rewrite it in Rust — here is what each one actually fixes, and what it does not.
What a Git-Push PaaS Should Actually Clone: Shallow vs Partial Clones and What Checkout Time Adds to Every Build
Shallow clones are 4-6x faster and the industry default, but they break versioning tools and make every later fetch 25x more expensive. Benchmarks, real PaaS defaults from Render to Heroku, and the break-even point where blobless partial clones win.
Field Is Immutable: Why helm upgrade Dies at the API Server, and Which Escape Hatch Actually Scales
A community Helm chart renames one label and your upgrade dies in the API server's validation path. Here is the full table of immutable Kubernetes fields with their exact error strings, the five ways out priced against each other, and the fleet size where a platform operator finally beats the runbook.
Hetzner Unfroze the 50-Second Load Balancer Idle Timeout — Your Build Logs Will Still Die at 15 Seconds
Hetzner made its 50-second load balancer idle timeout configurable in April 2026, but on a Kubernetes stack it is rarely the rung that kills your log stream. The full timeout ladder — with real defaults, the idle-vs-total distinction, and the heartbeat math that survives all of it.
Hetzner Removed the EC2-Compatible Metadata Routes on August 1 — Every Bootstrap Script Still Curling /latest/ Is Now Broken
On August 1, 2026 Hetzner removed the EC2-compatible /latest/ and /2009-04-04/ metadata routes, breaking every bootstrap script that inherited the AWS curl idiom. The full route-by-route migration table, a repo audit command, and the CAPH preKubeadmCommands diff that fixes it.
Headlamp's Cluster API Plugin: What a Point-and-Click Fleet UI Changes for Teams Who'd Rather Not Live in kubectl
Headlamp's new Cluster API plugin puts CAPI fleet state behind a point-and-click UI. Where it beats kubectl and clusterctl, where it fights your GitOps loop, and why a self-hosted PaaS should adopt it for operators instead of building a fleet dashboard.
One Repo, Five Services: Path-Filtered Deploys on Render, Railway, and Vercel — and When to Do It Yourself With the Dependency Graph
A docs typo shouldn't rebuild five services. How Render build filters, Railway watch paths, and Vercel's two skip mechanisms decide what a push rebuilds, where every static path filter breaks (shared libraries, lockfiles), and what a self-hosted Render-compatible PaaS should implement instead.
Runbooks Your Agents Maintain: Inside WUPHF's Markdown-Plus-Git Wiki Model
WUPHF keeps agent-maintained runbooks and postmortems as Markdown in Git. Why a repo agents can PR beats a SaaS wiki API for auditability, reverting bad knowledge, and owning your platform's operational memory.
Coolify v4 Shipped an MCP Server. Dokploy Didn't. The Self-Hosted PaaS Race Just Split in Two
Coolify's v4.x releases made a native MCP server its headline differentiator while Dokploy stayed deliberately minimal. A side-by-side comparison of both platforms — idle RAM, install, MCP surface — and why agent-operability's real cost is API discipline, not footprint.