Dora Noda
Software Engineer
Dora Noda is a Software Engineer writing about Web3 infrastructure, blockchain networks, and self-hosting.
3404 posts · View all authors
How the controller-runtime Cache Actually Works: What PaaS Builders Should Know Before Their First OOMKill
Your operator's Get() never hits the API server — it silently caches every object of that Kind in the cluster. How controller-runtime's shared-informer cache works, why it OOMKills control planes at fleet scale, and the exact selectors, transforms, and DisableFor config that shrink a PaaS control plane from gigabytes to a few hundred MB.
Coolify v4 and the v5 Rewrite: What 325,000 Users on a Single-Box PaaS Say About Multi-Server Scalability
Coolify v4 polished the single-box self-hosted PaaS to a shine — then announced v5 as a ground-up rewrite for multi-server scalability. A mechanism-by-mechanism look at why fleet behavior can't be bolted onto per-host SSH orchestration, and what a Kubernetes/Cluster API platform inherits on day one.
Headlamp's Cluster API Plugin: What a Point-and-Click Fleet UI Changes for Teams Who'd Rather Not Live in kubectl
Headlamp's new Cluster API plugin puts CAPI fleet state behind a point-and-click UI. Where it beats kubectl and clusterctl, where it fights your GitOps loop, and why a self-hosted PaaS should adopt it for operators instead of building a fleet dashboard.
Retiring cluster-admin and the Shared Bastion: Kubernetes' Access-Broker Pattern for Production Debugging
Kubernetes' March 2026 guidance replaces cluster-admin exec and shared bastions with a three-layer access broker: least-privilege RBAC, group-based bindings, and a just-in-time gateway — plus how to wire it into a multi-tenant PaaS debug-shell feature without rebuilding the anti-pattern.
Litestream's Writable VFS: SQLite Mounted From an S3 Bucket as the No-Managed-Database Persistence Path for a Self-Hosted PaaS
Litestream's writable VFS lets an app open a SQLite database whose pages live in an S3 bucket — reads via Range requests, writes synced every second. How the mechanism works, the honest constraints, and a workload-by-workload table of what fits versus what still needs a tenant-run Postgres.
One Repo, Five Services: Path-Filtered Deploys on Render, Railway, and Vercel — and When to Do It Yourself With the Dependency Graph
A docs typo shouldn't rebuild five services. How Render build filters, Railway watch paths, and Vercel's two skip mechanisms decide what a push rebuilds, where every static path filter breaks (shared libraries, lockfiles), and what a self-hosted Render-compatible PaaS should implement instead.
Static Outbound IPs Are a Paid Add-On on PaaS and a Free Property of Your Own Server
Railway shipped static outbound IPs and IPv6 on July 3, 2026 — Pro-only, three shared IPs per service with HA migration by July 13. What that costs, why allowlists turn egress into a production dependency, and why hardware you own solves it with one exclusive IP and no feature toggle.
Render Just Made PgBouncer Free. Here's the Connection-Pooling Homework You Inherit When You Self-Host Postgres
Render's July 2026 changelog bundles PgBouncer free with paid Postgres. Here is every decision that toggle makes for you — pooler choice, transaction vs session mode, prepared-statement fixes — plus a complete pgbouncer.ini for reproducing it on your own hardware.
Self-Hosting Firecracker Sandboxes for AI Agents: The Real Math Behind the 60–80% Cost Drop
E2B, Modal, and Daytona meter AI-agent sandboxes at $0.17–0.24 per hour; one $115 Hetzner box running Firecracker delivers them for cents. A worked cost model shows where the 60–80% savings actually start — and why the popular 500-sandbox-hour threshold assumes your ops time is free.