Depot's Colocated BuildKit Cache: What 2x-55x Faster Builds Actually Require
Depot's 2x-55x faster builds come from one architectural trick — keeping the Docker layer cache permanently colocated with the builder instead of fetching it over the network. Here's how it works, and how to build the same thing on your own Kubernetes fleet.
Docker Kanvas Turns docker-compose.yml Into Kubernetes Manifests — Here's Exactly Where It Stops
Docker's new Kanvas tool converts docker-compose.yml into Kubernetes manifests, Helm charts, and more — but it never builds an image, pushes a registry, or places a workload on a fleet. Here's what that leaves for a git-push PaaS to build itself.
GuardFall: Why 10 of 11 Open-Source AI Coding Agents Can't Tell What Bash Will Actually Run
Adversa AI's GuardFall research found 10 of 11 open-source AI coding agents check a shell command's raw text for danger, then hand that text to bash, which rewrites it before running. Here are the five bypass classes, per-agent results, and what it means for building agent-callable deploy tools.
Hetzner Killed the datacenter Field: Is Your CAPH Fleet's CCM Still Reading It?
Hetzner quietly deprecated the datacenter field on Servers and Primary IPs, and any hcloud-cloud-controller-manager older than v1.30.1 panics once it disappears. Here's the exact check, the exact failure mode, and the upgrade path for a Cluster-API-provider-Hetzner fleet.
Kaniko Is Dead: Google Quietly Archived It in June 2025 — What Rootless BuildKit Means for a Git-Push PaaS's Image-Build Path
Google archived Kaniko in June 2025 with no successor named. Here's why rootless BuildKit is the closest maintained replacement for daemonless, unprivileged Kubernetes image builds — and the caching, security, and kernel details a git-push PaaS has to re-verify before migrating.
KEDA's Scale-to-Zero: What It Actually Buys a Self-Hosted PaaS Billing Tenants for Idle Containers
A dormant tenant app held at a minimum of one replica costs real money — on Railway's metered pricing, about $30/month for a 1 vCPU/1GB container that serves zero requests. Here's what wiring KEDA's true scale-to-zero into a Cluster API fleet actually changes, in dollars and in cold-start seconds.
OCI VolumeSource Goes Stable in Kubernetes 1.36: Do You Still Need to Bake Large Assets Into Your App Image?
Kubernetes 1.36 made OCI VolumeSource stable, letting a Pod mount any OCI image as a read-only volume. Here's the honest before/after against a well-cached Dockerfile, a worked build-pipeline split, and what a self-hosted platform must verify before offering it to tenants.
The "PaaS-First, Kubernetes as Exception" Narrative of 2026 Misses the Platforms Built on Kubernetes You Never See
Coolify and CapRover are cited as proof self-hosting should default to a single-node PaaS with Kubernetes as the exception. But Render, Railway, and Heroku Fir all run on Kubernetes underneath a git-push UX you never see — here's what a Cluster-API-managed fleet gets you that Docker Swarm structurally can't.
Port and Cortex Anchor 2026's IDP Category: What a Git-Push PaaS Actually Needs to Borrow
SD Times named Port and Cortex 2026's internal-developer-portal category anchors. Here's what a git-push PaaS's deploy API already covers, what's genuinely missing, and how to borrow the rest without standing up a second system of record.