OCI VolumeSource Goes Stable in Kubernetes 1.36: Do You Still Need to Bake Large Assets Into Your App Image?
Kubernetes 1.36 made OCI VolumeSource stable, letting a Pod mount any OCI image as a read-only volume. Here's the honest before/after against a well-cached Dockerfile, a worked build-pipeline split, and what a self-hosted platform must verify before offering it to tenants.
Kubernetes Quietly Corrected Three 'Fixed' CVEs That Were Never Patched — What That Means for Your Cluster's Threat Model
Kubernetes just admitted three CVE records carried a fake 'fixed' field for years — a concrete look at what the correction reveals about trusting scanner output, and the version-pinned scanning check a Cluster-API fleet needs instead.
Kubernetes Swap Went Stable in 1.34: What LimitedSwap Actually Buys a Self-Hosted PaaS on NVMe
Kubernetes' node swap support graduated to stable in 1.34. A walkthrough of what LimitedSwap actually protects against, what it doesn't, and the concrete tenant-density math it unlocks on a Hetzner NVMe node that a fixed-instance managed PaaS can't touch.
OpenTelemetry Graduates CNCF in May 2026: Why Self-Hosted Collectors Beat Egress-Metered Observability SaaS
OpenTelemetry's May 2026 CNCF graduation locked in OTLP as the universal interchange format, and the cost gap it exposed between egress-metered SaaS and self-hosted collectors runs 38x to 166x depending on scale — with worked numbers to prove it.
OVHcloud's Bare Metal Barely Moved in 2026 — Hetzner's Cloud VMs Didn't Get So Lucky
OVHcloud's VPS price jumped 44.5% in 2026 and its Bare Metal line only rose 5-16% — the same split Hetzner shows between its hammered CCX cloud instances and its barely-touched AX dedicated servers. A spec-matched price table shows where the 2026 DRAM shock actually lands.
The "PaaS-First, Kubernetes as Exception" Narrative of 2026 Misses the Platforms Built on Kubernetes You Never See
Coolify and CapRover are cited as proof self-hosting should default to a single-node PaaS with Kubernetes as the exception. But Render, Railway, and Heroku Fir all run on Kubernetes underneath a git-push UX you never see — here's what a Cluster-API-managed fleet gets you that Docker Swarm structurally can't.
Dependabot Has No Path to Forgejo or Gitea, and Only a Community Patch for GitLab: Why Renovate Is the Only Bot Built for All Three
Dependabot has no official route onto GitLab, and none at all onto Gitea or Forgejo. Renovate runs natively on both, plus Bitbucket and Azure DevOps, covers roughly three times the package ecosystems, and ships a dependency dashboard and automerge Dependabot still doesn't have. What that gap actually costs a self-hosted, git-agnostic PaaS.
Rivet Actors Give an AI Agent State That Survives Between Tool Calls — What a Container-Only PaaS Is Missing
Rivet Actors is an open-source, self-hostable take on Cloudflare Durable Objects, built for AI agent memory and realtime state. Here's what its cold-start and cost numbers actually are, what self-hosting it takes, and whether a container-only PaaS like bex needs to build its own actor primitive.
Sealos and the Rise of Prompt-to-Deploy AI-Native Clouds: What 'Deploy Anything With a Prompt' Gets Right That a Git-Push PaaS Still Doesn't
Sealos pitches 'deploy anything with a prompt' as a new AI-native category, but its own architecture shows agent skills calling the same Kubernetes CRDs the dashboard already used. Here's the actual dividing line between a real AI-native platform and a chat UI bolted onto an existing API.