694 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
OpenCost Turns a Fixed Hetzner Bill Into Per-Namespace Chargeback — Without Shipping Cost Data to a SaaS Dashboard
A worked example: converting one real, post-hike Hetzner node price into OpenCost's normalized pricing config, then splitting it into real per-namespace chargeback numbers, idle cost included — no SaaS billing dashboard required.
Porter's Two Control-Plane Models, One Codebase
Porter markets itself as a PaaS that runs in your own cloud, but the control plane most customers actually get is Porter's, not theirs. A tier-by-tier look at what real self-hosting costs versus what the marketing implies.
Heroku Invented the Preview Environment for Humans. In 2026, AI Agents Are the Ones Clicking the Link.
Devin Review catches bugs before a human opens the PR, and GitHub Copilot's agentic review closes the loop even faster. Heroku's 2015 preview-environment primitive was never built for that reader — here's what has to change.
Railway's December 16 Cryptominer Incident: How Under 10% Infected Workloads Degraded 100% of Regions
Railway's December 16, 2025 postmortem shows how a Next.js RCE that infected under 10% of workloads still degraded every region — and what CPU-isolation guarantees a shared-compute PaaS needs to keep one tenant's breach from becoming everyone else's incident.
Render's $7 Starter Math: 20 Services Cost $140/Month vs $6 on One Hetzner Box
Twenty Render Starter services bill $140.95 a month before bandwidth or workspace fees. The same fleet, bin-packed onto one Hetzner box, costs as little as $6. Here's the line-by-line math and the two service counts that actually matter.
SafeLine's 20,900-Star Self-Hosted WAF Claims 99.995% Accuracy: What It Actually Buys You Over Cloudflare
SafeLine's self-hosted WAF claims 99.995% accuracy against SQL injection and DDoS traffic — here's the real cost comparison against Cloudflare, why Hetzner already covers the DDoS part for free, and what a self-hosted PaaS actually gains by shipping one as an ingress default.
SPIFFE/SPIRE for AI Agents: Cryptographic Workload Identity Instead of Long-Lived Service Account Tokens
A hands-on look at issuing an AI deploy-agent a cryptographic identity distinct from a human's with SPIFFE/SPIRE — and the honest operational cost next to the Vault/External-Secrets-Operator setup most self-hosted platforms already run.
Talos Linux's No-Shell Design Barely Scratched by CVE-2026-31431
A 732-byte exploit roots most major Linux distros — here's exactly why Sidero Labs says it barely touches Talos Linux, backed by the binary counts and CVE benchmarks that make the claim checkable.
Why Talos Linux's Own Creator Didn't Build Omni on Cluster API
Sidero Labs, the team behind Talos Linux, built its own Omni product without Cluster API. Here's a point-by-point read of its six objections against what a CAPH/CAPD-based fleet like bex actually looks like.