CAPD vs CAPH: One Cluster API, From Your Laptop to Real Hetzner Bare Metal
CAPD and CAPH speak the exact same Cluster API contract at opposite extremes — one fakes the hardware for local dev, the other provisions real Hetzner dedicated servers. Here's what changes, what doesn't, and the gotchas in between.
Kubernetes Quietly Fixed a Years-Old cgroup v1-to-v2 CPU Priority Bug: What the January 2026 Formula Rewrite Means
A linear formula meant to convert cgroup v1 CPU shares into v2 CPU weight silently gave 1-CPU containers about 39% of the priority they should've had, invisible to kubectl and metrics-server the whole time. Here's the fixed formula, the exact command to audit your own nodes, and what rolling it out across a self-hosted fleet's node images actually requires.
Cloudflare's 60-Minute Disposable Workers: The Zero-Signup Deploy Target AI Agents Actually Need
Cloudflare shipped a Worker deploy an agent can create with zero signup, live for exactly 60 minutes. Here's the mechanism, how it stacks up against E2B/Daytona/Fly/Modal, and whether a Cluster-API PaaS can build the same thing without a sandbox vendor.
Cluster API v1.12 In-Place Updates and Chained Upgrades: The End of Node-Replacement-Only Kubernetes Lifecycle
Cluster API v1.12 lets Machines change without being deleted and recreated, and lets a fleet jump several Kubernetes minors in one declared upgrade. Here's how both mechanisms work and what they actually change for a bare-metal Hetzner fleet.
Coolify's 58K Stars vs Dokploy's 35K: What Two Self-Hosted PaaS Growth Curves Actually Say
A same-day GitHub API check of Coolify's and Dokploy's star counts, MCP capabilities, and architecture puts the 'fastest growing PaaS' claim to the test — and finds the two projects' AI-agent tooling tells a very different story than their star counts do.
Docker's MCP Gateway Caps Every Tool Call at 1 CPU / 2GB: The Container Security Model Your Deploy Bot Should Steal
A critical RCE in Anthropic's MCP SDK won't be patched at the protocol layer, so containment has to happen at the tool-server layer. Here's exactly what Docker's MCP Gateway locks down by default, and how to size the same model for a PaaS's own deploy/rollback/scale tools.
Dokploy's CVE-2026-27130: OS Command Injection via the appName Parameter in a Popular Self-Hosted PaaS, and What It Means to Trust a Deploy Tool With Root on Your Fleet
Dokploy's CVSS 9.9 command injection through the appName field, why it's the second time that field has been the entry point, and why the same bug class keeps recurring across self-hosted PaaS deploy tools.
E2B Joined the OpenAI Agents SDK. The Real Story Is How Many Times It's Had To.
E2B's OpenAI Agents SDK integration is its tenth publicly documented per-product integration guide, not its first — here's what the real count reveals about building versus betting on MCP for a self-hosted sandbox platform.
Envoy AI Gateway Hits v1.0: A CNCF Blueprint for Securing Your Own MCP Server
Envoy AI Gateway's v1.0 release stabilizes MCPRoute and MCPRouteSecurityPolicy, giving self-hosted platforms CEL-based per-tool authorization and audit trails for AI agents — without building an MCP authorization layer from scratch.