Kubernetes Ships an Official Agent Sandbox Primitive: What It Actually Buys a Self-Hosted PaaS
Kubernetes SIG Apps shipped an upstream CRD for running untrusted AI-agent code safely — here's what it gives a Cluster API-based PaaS for free versus E2B, Daytona, and Modal, the real cost math, and what's still missing.
Render and Railway Bill Per-Second for What Kubernetes CronJob Does for Free
A line-by-line cost comparison of Render Cron Jobs and Railway's cron feature against a plain Kubernetes CronJob on a self-hosted Cluster API fleet, at 1, 5, 20, and 100 scheduled jobs a month.
The Kubernetes CSI Driver Bug That Turns a Tenant's subDir Into a Delete Weapon
CVE-2026-3864 and CVE-2026-3865 let a crafted subDir value in a PersistentVolume escape onto the shared NFS or SMB export it's mounted from. Here's the exact mechanism, who can actually trigger it on a self-hosted PaaS, and the audit checklist that closes it.
Kubernetes 1.36's Fine-Grained Kubelet Authorization Is GA — Here's Exactly What It Doesn't Fix
Kubernetes 1.36 splits kubelet API permissions out of the all-or-nothing nodes/proxy grant — but exec, attach, and portforward stay bundled together by design, so tenant kubectl exec access is exactly as risky as before.
The 20-40% Kubernetes Tax: What Small-Team Maintenance Data Actually Costs, and When Fleet Management Pays It Off
Small teams running their own Kubernetes lose 20-40% of an engineer's time to upgrades, cert rotation, and etcd backups — here's what that costs in dollars, and when Cluster API automation actually claws it back.
Kubernetes 1.36's unusedSince Field Turns Orphaned-Volume Hunting Into a Query
Kubernetes 1.36 adds an unusedSince timestamp to every PVC's status, turning orphaned-volume hunting from a manual cross-reference script into a one-line query — and a self-hosted PaaS's precondition for automated reclaim jobs.
User Namespaces Are GA in Kubernetes 1.36: Exactly What It Buys You (and What It Doesn't) for Multi-Tenant and AI-Agent Nodes
Kubernetes 1.36 makes User Namespaces GA — a near-free identity remap that neutralizes four real container-escape CVEs, but stops short of the kernel-level isolation AI agents running untrusted code still need.
Kubernetes 1.36's Volume Group Snapshots Go GA: Can Your Self-Hosted Fleet Actually Use It?
Kubernetes 1.36 graduated VolumeGroupSnapshot to GA — a crash-consistent, multi-volume snapshot API. Here's the CSI driver support matrix that decides whether a Hetzner or Longhorn fleet can actually use it today, and the one path that works.
Let's Encrypt's DNS-PERSIST-01: One TXT Record Replaces Every Renewal for Multi-Tenant TLS
A new Let's Encrypt challenge type lets a tenant authorize a platform's ACME account once instead of on every renewal — here's the record format, the security tradeoff, and what it changes for a self-hosted PaaS issuing certs at fleet scale.