Depot's Colocated BuildKit Cache: What 2x-55x Faster Builds Actually Require
Depot's 2x-55x faster builds come from one architectural trick — keeping the Docker layer cache permanently colocated with the builder instead of fetching it over the network. Here's how it works, and how to build the same thing on your own Kubernetes fleet.
Docker Kanvas Turns docker-compose.yml Into Kubernetes Manifests — Here's Exactly Where It Stops
Docker's new Kanvas tool converts docker-compose.yml into Kubernetes manifests, Helm charts, and more — but it never builds an image, pushes a registry, or places a workload on a fleet. Here's what that leaves for a git-push PaaS to build itself.
Dokploy's WebSocket Terminal Bug (CVE-2026-24841): One Exec Call, Root on Every Server It Manages
Inside Dokploy's CVSS 9.9 WebSocket terminal bug: the actual vulnerable code, why an argv-array fix only solves half the exploit path, and why the flaw reached every server the control plane manages over SSH, not just the local box.
The EU's Cloud Sovereignty Framework Grades Providers SEAL-0 to SEAL-4: Where Owned Hetzner Hardware Lands That a Hosted PaaS Provider Can't Follow
The EU's new SEAL-0 to SEAL-4 sovereignty scale just rated a Google-powered cloud service 'sovereign' — here's the real methodology behind that number, and where self-hosted, owned Hetzner hardware actually lands on it.
The EU Data Act's Cloud-Switching Mandate Takes Effect: What a 30-Day Portability Deadline and a 2027 Fee Ban Actually Change
The EU Data Act's cloud-switching rules are already in force: a 2-month notice cap, a 30-day transition window, and a full ban on switching fees from January 12, 2027. Here's the exact timeline, what it actually forces vendors to hand over, and what it still doesn't reach.
Fly.io's Job Postings Hit Zero While Render and Railway Raise $100M Each
Fly.io's careers page shows zero open roles the same year Render and Railway each raised $100M — a concrete checklist for reading hiring and funding signals before you build a business on any hosted PaaS.
Four Root Exploits in Ten Weeks: What GhostLock Says About Kernel Patching for a Self-Hosted PaaS
GhostLock lets any logged-in user become root in five seconds — and it's the fourth independently discovered kernel or hypervisor escape disclosed in ten weeks. Here's the patch-cadence argument for treating kernel CVEs as a same-day operational primitive on a self-hosted fleet.
Giant Swarm's AI Agent Platform Proves Cluster API Scales — But Not Every Layer It Runs
Giant Swarm's production numbers — 2.8x lower cost per agent run, 500 parallel agents — validate Cluster API and GitOps as an AI-agent substrate. But its Backstage-centric IDP layer is a $300K-$700K/year commitment a simpler git-push control-plane API doesn't need.
GitHub Copilot's Token Billing Blindsided Users With 25-60x Bills — What It Means for Metering an MCP Server
GitHub's June 2026 switch to token-metered Copilot billing collided with its own research showing agentic tasks burn 1,000x more tokens than chat — real bills jumped 10x-50x. Here's the exact retrofit GitHub, Cursor, and Replit all shipped too late, and what an MCP-metered PaaS should ship on day one instead.