Confidential Containers Reaches CNCF Incubation: What TEE-Attested Secrets Release Actually Costs a Self-Hosted PaaS
Confidential Containers just reached CNCF incubation, promising tenant code even the platform operator can't read. Here's what the TEE hardware, the Trustee attestation service, and the per-pod overhead actually cost to run on a self-hosted Hetzner fleet.
DockLog Ships One Image for Docker and Kubernetes Logs: What It Buys a Cluster API Fleet Over kubectl logs -f
DockLog puts Docker and Kubernetes log tailing behind one container and one RUNTIME_MODE toggle — here's exactly what that buys an operator over kubectl logs -f loops, where its single-cluster scope stops short of a real fleet, and when a growing fleet actually needs Loki instead.
Dokploy Is Apache 2.0 Again — But SSO, Audit Logs, and RBAC Now Live Behind a New Source-Available License
Dokploy's January 2026 license split moved SSO, audit logs, RBAC, and white-labeling behind a new source-available license. We pulled the actual GitHub tree to see exactly what changed and what didn't.
Encore.dev Promises No Terraform — Until You Self-Host
Encore.dev's pitch is that declaring a database in your app code replaces writing Terraform. That's true — on Encore Cloud. Self-host the same app and you're back to provisioning infrastructure by hand and handing Encore a config file. A worked look at where the automation actually stops, and what it costs when it doesn't.
Fly.io's Managed Postgres Costs $38/Month Before You've Added the App
Fly.io's Managed Postgres starts at $38/month plus $0.28/GB storage — and that's before the app talking to it is billed. A line-by-line worked comparison against running Postgres on the same Hetzner box already hosting the app.
GitHub Actions' Self-Hosted Runners Went Dark for Five Hours: The Outage That Proves 'Self-Hosted' Isn't 'Self-Owned'
A TLS certificate expired on a GitHub endpoint on July 19, 2026, and every self-hosted GitHub Actions runner on the internet went idle for five hours — even though the machines themselves never stopped running. Here's what actually broke, and why owning the compute was never the same as owning the pipeline.
GitHub Agent HQ Runs Claude, Codex, and Copilot on the Same Repo — Here's the Trust Boundary Your MCP Server Actually Needs
GitHub Agent HQ runs Claude, Codex, and Copilot side by side on the same repo under one identity model — here's why a deploy platform's MCP server should authenticate the calling app, not the AI vendor behind it.
GKE Labs' OpenRL Runs Fine-Tuning as a Kubernetes Workload: What Owning the Loop Actually Saves Over a Managed API
Google's GKE Labs open-sourced OpenRL, a self-hosted, Tinker-compatible fine-tuning API for Kubernetes. Here's the worked cost math on what running your own LoRA fine-tuning loop actually saves over Together AI's managed API — and what it doesn't.
GPU Inference's Hidden Egress Tax: The 22-31% Line Item Nobody Prices In
2026 cost teardowns keep finding the same thing: GPU-hours are barely half an inference bill once a service actually serves traffic at volume. Here's the worked math on AWS, Azure, and GCP showing where the other 22-31% goes — and an honest look at what self-hosting the serving layer removes versus what it doesn't.