684 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
Kubernetes 1.36 Ships User Namespaces to GA: What Rootless Containers Change for Multi-Tenant PaaS Isolation
Kubernetes 1.36 graduates user namespaces to GA, remapping container root to an unprivileged host UID. What that changes for packing multiple tenants on shared bare metal — the CVEs it defuses, the version matrix your fleet must clear, and the shared-kernel risks it does not fix.
Your Cluster Runs at 8% CPU: Bin-Packing Defaults for a Self-Hosted Fleet That Can't Return Capacity
Cast AI's 2026 report puts average Kubernetes CPU utilization at 8% and memory at 20%. On elastic cloud that's an expensive bill; on owned hardware it's capacity you already paid for and can't return. Concrete request/limit defaults, a bin-packing scheduler config, and a worked Hetzner-vs-cloud cost delta.
Kubernetes v1.36 Ships Admission Policies That Can't Be Deleted: Closing the Bootstrap Window in Your Fleet's Guardrails
Kubernetes v1.36's manifest-based admission control loads policies from files before the API server serves its first request — undeletable via any RBAC. What it forecloses for a multi-tenant self-hosted PaaS, and the Cluster API bootstrap sequencing that makes guardrails live before the first tenant pod.
Railway's July 2026 US East Outage: What One ISP's Bad Route Cost Every App — and What Owning the Network Costs Instead
One carrier's backbone degradation left every app in Railway's US East zone degraded for over four hours — including 20 minutes with no internet route at all. A worked breakdown of what the outage cost and what owning your own network path actually costs, from a €40 Hetzner box to a full ASN with dual transit.
Render Says Buildpacks Beat Your Dockerfile by 75%. Can Nixpacks or Paketo Match That on Your Own Hardware?
Render's 75% faster-builds claim is standard Cloud Native Buildpacks layer caching, and both Paketo and Nixpacks reproduce it on hardware you own. What the number actually measures, the exact cache-image and cache-key commands for a fleet of ephemeral builders, and the five cache policies a shared build node platform needs.
Your Base Image Is Six Months Stale: Making Renovate's FROM-Line Patching a Self-Hosted PaaS Default
A git-push PaaS rebuilds your app on every push — and never touches the FROM line between pushes. How a platform-run Renovate loop with digest pinning and health-gated automerge bounds base-image staleness from unbounded to about a day, the exact renovate.json to do it, and where the loop still falls short of buildpack rebase.
Webhook Signature Verification for Git-Push Deploys: What a Self-Hosted PaaS Has to Get Right That GitHub's Own Docs Gloss Over
On a git-push PaaS, the webhook endpoint is a remote build trigger — and HMAC verification is its entire security boundary. A 10-point audit checklist covering the raw-body trap, the === timing leak, the timingSafeEqual length-throw, the SHA-1 header ghost, and the replay gap GitHub's docs never assemble into one place.
Cilium Becomes the Default Kubernetes CNI Everywhere but AWS: What eBPF Networking Buys a Self-Hosted PaaS on Hetzner
GKE and AKS now run Cilium by default while EKS holds out — here's what eBPF service routing, Hubble flow observability, and identity-based network policy actually buy a self-hosted PaaS on Hetzner bare metal, with the benchmarks, memory costs, and a decision table.
Nine Seconds, Zero Backups: What the PocketOS Wipe Demands From a PaaS That Doesn't Manage Your Database
A Cursor agent deleted PocketOS's production database and every backup in nine seconds. The real failures were architectural: co-located backups and an omnipotent API token. Here is the backup design that survives a rogue agent — and what a PaaS that doesn't manage your database still owes you.