Dora Noda
Software Engineer
Dora Noda is a Software Engineer writing about Web3 infrastructure, blockchain networks, and self-hosting.
3404 posts · View all authors
CloudNativePG 1.30's DatabaseRole CRD and Lease Election: What Changes for a Self-Hosted PaaS's Postgres Layer
CloudNativePG 1.30 ships a declarative DatabaseRole CRD and a Lease-based primary election, plus two CVE fixes, right as the 1.28.x line hits end of life — here's what that concretely changes for a PaaS running CNPG as its own managed-Postgres engine.
Cluster API Provider OpenStack Ships v1beta2 Behind a New ORC Dependency: What Declarative Fleet Lifecycle Looks Like on Private OpenStack Instead of Hetzner
CAPO's new v1beta2 API ships behind a hard dependency on openstack-resource-controller — here's what continuous reconciliation buys a Cluster API fleet on private OpenStack that Terraform-on-OpenStack can't, and why the model was never Hetzner-specific to begin with.
CNCF's 2026 Platform Engineering Report Says 35% of Teams Bolt AI Onto What They Already Have — Is 'AI-Native From Day One' the Wrong Pitch?
The report's 35% hybrid-platform stat looks like a case against AI-native architecture. Priced out against what hybrid actually costs in auth, golden paths, and governance, it reads the opposite way.
Coolify Fixed 11 Critical CVEs in January. The Same Root Cause Struck Again in July
Coolify patched 11 critical CVEs at CVSS 9.4-10.0 in January 2026, then shipped a fix for the same root-cause bug class in July. Here's what the repeat says about single-daemon PaaS architecture versus RBAC-scoped, Kubernetes-native control planes.
Coolify, Dokploy, and CapRover Hit a Docker Swarm Ceiling
Coolify, Dokploy, and CapRover get a solo developer to a running app fast — but a side-by-side of node failure recovery, storage, and tenant isolation shows exactly where their shared Docker Swarm architecture caps out, and when a Cluster API-provisioned fleet is worth the switch.
Kubernetes Can Checkpoint Your Containers Now — It Still Can't Restore Them
Kubernetes can freeze a running container to disk today. It cannot restore one natively. A capability matrix, the GPU and security gaps behind it, and what sandbox vendors built instead while they waited.
Crossplane's API-First Infrastructure Bet: What Agent-Operated Infra via Declarative CRDs Gets Right That a REST Deploy API Doesn't
CNCF's case for Crossplane says AI agents operate better against Kubernetes-style CRDs than a REST deploy API. Here's the mechanism-by-mechanism reason why, what the tradeoff actually costs, and what a Render-compatible API should borrow from it.
Your Cursor Sandbox Was Never the Thing Protecting You: Inside DuneSlide's Zero-Click RCE
Two CVSS 9.8 bugs in Cursor let a zero-click prompt injection escape the sandbox and reach full code execution. The real lesson isn't the sandbox bug — it's that the agent held the developer's standing machine permissions the whole time.
Daytona's Customer-Managed Compute: What 'Bring Your Own Hetzner Account' Actually Costs and Controls
Daytona lets you point its control plane at your own cloud account instead of theirs. Here's what that customer-managed compute tier still costs, still controls, and where it's a genuine middle ground versus renting trust.