684 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
Static Outbound IPs Are a Paid PaaS Add-On — and a Rounding Error on a Server You Own
Railway's July 2026 release put static outbound IPs behind its Pro plan — the same allowlist-friendly egress identity that costs €0.50/month on a Hetzner box. A platform-by-platform accounting of the egress tax on Railway, Render, Heroku, and Fly.io versus servers you own.
Sprites Speak MCP: When the Agent Sandbox Becomes a Tool the Agent Calls Itself
Fly.io's Sprites now expose their full lifecycle over MCP, so agents provision disposable machines from inside their own loop. Here is the six-tool sandbox contract — create, exec, checkpoint, restore, destroy, list — and the quotas, TTLs, and per-tenant budgets a self-hosted platform needs before the agent becomes the capacity planner.
step-ca vs Let's Encrypt: What an Internal-Only ACME CA Buys Your Fleet's Service-to-Service TLS
Let's Encrypt logs every certificate publicly and refuses private hostnames by design. step-ca gives a Cluster API fleet automated internal TLS with 24-hour certs and no CT-log exposure — here's the full setup, plus the honest cost of running your own CA.
Six Traefik Gateway API Advisories in Six Months: The Namespace-Boundary Probes Your Shared Ingress Owes Every Tenant
Traefik shipped six Gateway API isolation advisories between March and August 2026 — including a 9.9 CRITICAL REST-provider exposure and a route-key collision with no workaround. Seven concrete namespace-boundary probes, each with the manifest and the exact assertion, for any platform routing many tenants through one shared ingress.
Appwrite Sites and the BaaS Land Grab: When Your Backend Vendor Wants to Host Your App Too
Appwrite Sites turns an open-source BaaS into a git-push app host, and the 1.9.5 release adds branch/path deploy filters, a Rust runtime, and Bun/Deno builds. Here's what backend vendors climbing the stack means for who owns your deploy pipeline — and where a single-box Compose stack ends and a scheduled fleet begins.
CNCF's Platform Engineering 2.0 Five Pillars: Grading a Self-Hosted PaaS Against the AI-Era Scorecard
CNCF's July 2026 Platform Engineering 2.0 framework sets five AI-era pillars. We grade a Cluster-API-managed, Render-compatible self-hosted PaaS against each one — one pass, two partials, two gaps — and map the honest upgrade path.
Docker Hub's 2026 Pricing Squeeze: What Self-Hosting a Registry Cache Actually Saves Your CI Pipeline
Docker Hub's 2026 free tier is 10 pulls/hour unauthenticated and 40/hour on Personal, with roughly 10x overage past paid plan limits. A line-by-line cost model shows a real CI pipeline paying $160–300/month on Docker Hub versus under €12 for a self-hosted pull-through cache — and exactly where the crossover sits.
Docker Hub Almost Cut You to 40 Pulls an Hour: The Math for Sizing Your Own Registry Cache
Docker's walked-back 10/40-per-hour limits were a preview, not a false alarm: a 15-developer team with ephemeral CI runners and a 12-node cluster hits today's enforced 100/200-per-6-hour buckets on an ordinary Tuesday. The full pull ledger, the tipping-point formula, and how to size and wire a registry cache — registry:2 or Harbor — into a Cluster API fleet.
GAMMA Extends Your HTTPRoutes East-West: Does a Self-Hosted PaaS Need a Service Mesh, or Just the Ingress Layer It Already Owns?
GAMMA lets the HTTPRoute objects a PaaS already provisions for ingress govern east-west traffic too — retries, timeouts, and canary splits without a service mesh. A capability map, worked YAML, real mesh cost numbers, and a decision framework for self-hosted platforms.