Dora Noda
Software Engineer
Dora Noda is a Software Engineer writing about Web3 infrastructure, blockchain networks, and self-hosting.
3404 posts · View all authors
Docker's CVE-2026-34040 Is the Second Time This AuthZ Bypass Shipped: A Padded HTTP Request Still Grants Host Access on Unpatched Engines Below 29.3.1
CVE-2026-34040 bypasses every Docker AuthZ plugin with one oversized HTTP request — the same underlying gap as 2024's CVE-2024-41110, patched twice and still exploitable below Engine 29.3.1. Here's the exact payload, why the first fix didn't hold, and what it means for a Cluster API fleet's patch discipline.
Dokploy Ships Four Buildpack Backends: What Buildpack Plurality Buys a Git-Push Platform Over Picking One
Dokploy runs four separate buildpack backends side by side. A concrete look at what that plurality costs in real bugs, which languages each one actually covers, and whether a self-hosted PaaS should copy the model or pick one.
Fly.io's July 9, 2026 Depot Builder Outage in IAD: What Renting a Shared Remote-Build Fleet Costs When the Region Itself Degrades
Fly.io's build step went down three times in five months because it isn't Fly's build step — it's Depot's. Here's the July 9 IAD outage timeline, the recurrence pattern behind it, and what renting a shared remote-build fleet actually costs when the vendor's region degrades.
Hetzner's GEX44 GPU Server at €184/Month: The Break-Even Utilization vs A10/L4 Rental — and the CAPH Catch
Hetzner's GEX44 GPU box runs €184/month flat. Here's the exact utilization percentage where it beats renting A10/L4 capacity from AWS or GCP by the hour — and the one hyperscaler rate it never beats at all.
Kamal 2.0 Runs HEY and Basecamp Without a Control Plane: The Overhead It Skips, and Where It Runs Out
Kamal 2 deploys HEY.com and Basecamp to bare metal over plain SSH, no control plane involved. Here's the exact resource overhead a Cluster API fleet pays that Kamal skips — and the point where Kamal runs out of road.
Your Deploy Agent's MCP Server Just Became Infrastructure: What Changes When It Leaves Your Laptop
A concrete walkthrough of what an infrastructure-control MCP server owes you once it moves from a local stdio process to a remote service teammates, CI, and other agents can call: mandatory auth, per-action write scopes, stateless-scaling idempotency, and a tested rollback plan.
PaaS-First Killed Kubernetes-by-Default in 2026 — Except Underneath
The 2026 shift to 'PaaS-first, Kubernetes is the exception' quietly crowns single-server tools like Dokku and CapRover as the correct answer. A three-layer breakdown of who actually holds Kubernetes's complexity shows why a Cluster API-backed PaaS was never the thing that consensus rejected.
Railway Killed the Builder It Built: What Railpack's Nix-to-BuildKit Rewrite Means for a Self-Hosted PaaS's Buildpack Bet
Railway shipped Railpack in March 2026 to replace Nixpacks, the builder it built and open-sourced. The result: 38% smaller Node images, 77% smaller Python images, and a language-coverage gap at launch. Here's what the Nix-to-BuildKit rewrite actually changed, and what it means for a self-hosted PaaS choosing between Railpack and Cloud Native Buildpacks.
Render's Aug 1, 2026 Repricing Deadline: What Auto-Migrating to Flat Fees and a 25GB Egress Cap Actually Costs You vs a Self-Hosted Fleet
Render auto-migrates every legacy workspace to flat-fee pricing on August 1, 2026. The math splits sharply by seat count and egress — here's the exact breakeven, and what the same traffic costs on a self-hosted box instead.