CVE-2026-25518: The cert-manager Bug That Lets a Poisoned DNS Reply Crash Your Whole TLS Pipeline
A crafted DNS response can crash the cert-manager controller mid-renewal. Here's exactly what CVE-2026-25518 breaks, why the fix isn't just an upgrade, and the two config changes a self-hosted PaaS's TLS automation needs today.
Chainguard and Wolfi Cross 2,000 Zero-CVE Images: Should a Self-Hosted PaaS Default to Them?
Chainguard's Wolfi-based images cut CVE counts from ~280 to zero and shaved 60-80% off build time and egress in a real migration. Here's what defaulting a git-push PaaS's build output to Wolfi would actually change — and the honest build-vs-buy call against Chainguard's paid catalog.
CNCF's Platform Engineering Maturity Model Just Got a v2 — We Ran a Cluster-API PaaS Through All 5 Aspects
CNCF shipped a v2 of its Platform Engineering Maturity Model at KubeCon EU 2026. Here's what actually changed in the rubric, and a concrete, honest self-assessment of a Cluster-API git-push PaaS against all 5 aspects.
containerd's June 2026 CRI Advisory: Three Ways to Escape a Shared Node That RuntimeClass Can't Stop
AWS's June 2026 bulletin disclosed five containerd CRI plugin CVEs, and patching the daemon — not picking gVisor or Kata for your RuntimeClass — is the only real fix. Here's what each bug requires and what a shared-node fleet needs to check this week.
Coolify, Dokku, and CapRover Solve Git-Push Deploys on One Box — Here's Exactly Where That Wall Is
Coolify, Dokku, and CapRover all run one Docker daemon as the control plane, build runner, and runtime. Here are the actual RAM, CPU-during-deploy, and reboot-failure numbers that mark where that single box stops working, and what a Cluster API fleet does differently.
Kubernetes Promised a CSI for Buckets in 2022. It's Still Pre-Alpha Four Years Later
COSI, Kubernetes' answer to 'CSI for buckets,' targeted beta by Kubernetes 1.32 in December 2024. It's mid-2026 and the project is still pre-alpha. Here's the dated timeline, what hosted PaaS platforms shipped instead, and what a self-hosted PaaS should build for tenant object storage right now.
Daytona vs E2B for Self-Hosted AI Sandboxes: The Helm Chart Doesn't Do What You Think
Daytona's Helm chart looks like the easy self-hosting path for AI code sandboxes, but its own README shows the control plane never leaves Daytona's cloud. Here's what standing up Daytona and E2B actually requires on a Cluster API–managed fleet.
Devpush's No-Dockerfile Bet: What a Curl-Pipe Install Buys a Solo Python Dev, and Where It Runs Out
Devpush skips Dockerfiles entirely and installs with a curl-pipe-to-bash script on one box. A concrete look at what that buys a solo Python or Node developer's time-to-first-deploy, and the specific points — language support, background workers, a second machine — where the bet runs out.
Elestio's 400+ App Catalog Passes Coolify's: Why Catalog Size Is the Wrong Way to Rank a Self-Hosted PaaS
Elestio now leads the self-hosted PaaS category with 400+ one-click apps, ahead of CapRover, Coolify, PikaPods, and Cloudron. The numbers are real — but they measure a different product than a git-push PaaS builds. Here's the actual table, what catalog size hides, and what a Cluster-API platform should borrow instead of chasing the count.