685 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
Your Deploy Agent Has the Same Privileges as a Human Push — and No Insurance
AIUC-1 and California's AB 316 just made 2026 the year AI agent liability got real, while insurers quietly excluded it from standard coverage. Here's what's actually covered, what isn't, and the audit-trail and permission design a deploy-from-chat platform needs today.
Friendly Fire: The AI Security Review That Executes the Attack It's Supposed to Catch
AI Now Institute's Friendly Fire exploit turns Claude Code and Codex's own security reviews into remote code execution — here's how it works and what it means for scoping AI agent permissions on a deploy pipeline.
What Bunnyshell and Okteto Actually Charge for 'Namespace Per PR' — And What It Costs to Build Once
A line-by-line breakdown of what Bunnyshell's per-minute meter and Okteto's per-seat fee actually cost a mid-size team's PR preview environments each month, versus building the same namespace-per-PR workflow on owned Cluster API infrastructure.
Ceph Tentacle's FastEC vs MinIO's Maintenance Mode: What Self-Hosting Block and Object Storage Looks Like on a Cluster-API Fleet in 2026
Ceph Tentacle's FastEC cuts erasure-coding overhead for small block I/O by 2-3x. Worked out on real Hetzner-class hardware against 3x-replicated Longhorn, plus the January 2026 production incident that shows exactly how not to enable it.
Docker Compose's models: Key Has Been in the Official Spec Since June 2025 — What That Means for a Compose-to-Cluster-API Build Step
Docker Compose's models: key for defining AI models, agents, and MCP tools has quietly been part of the vendor-neutral Compose Specification since June 2025 — here's the exact YAML, and what it means for a git-push PaaS's build pipeline.
Dokploy Passed CapRover's GitHub Stars in Two Years, Not Nine
CapRover took nearly nine years to reach 15,109 GitHub stars. Dokploy passed that number in about two. The GitHub API data, and the Docker Compose gap behind it, explain why.
The Deploy That Pointed at Nothing: Firetiger's CI Race Condition and the One Check That Would Have Stopped It
A canceled CI build fooled Firetiger's deploy pipeline into shipping a container image ID that was never built, triggering an 8-hour ingest outage. Here's the exact failure chain, and the one registry check that would have caught it.
CVE-2026-50566: How Namespace-Scoped RBAC Became a 9.9 Node Compromise in Fission
A routine namespace-scoped RBAC grant let a Fission tenant escalate to node compromise — why RBAC was never a sandbox boundary, and what it means for platforms scheduling tenant code on shared nodes.
Gateway API on kind: The Local Reproduction Recipe for Ingress Bugs You Can't Debug on Bare Metal
The stock kubernetes.io recipe for running Gateway API on kind gets you one working HTTPRoute. Here's how to extend it to reproduce the three tenant ingress bugs that actually page a self-hosted PaaS's on-call, before they hit bare metal.