Dora Noda
Software Engineer
Dora Noda is a Software Engineer writing about Web3 infrastructure, blockchain networks, and self-hosting.
3394 posts · View all authors
Ingress2Gateway 1.0: A Scripted Migration Path Off the Now-Read-Only Ingress-NGINX
Ingress-NGINX is archived and unpatched — ingress2gateway 1.0 converts existing Ingress objects to Gateway API automatically. What converts cleanly, what needs hand-migration, and the five behaviors that break silently.
Only LLM Spans Should Cost Money: Span-Class-Aware Billing for Agent Observability
Span-class-aware metering prices LLM spans while tracing tool calls free — the worked cost math, which vendors already do it, and an OTel Collector recipe for self-hosted agent observability.
Mimir vs Cortex vs Thanos: Picking the Multi-Tenant Metrics Backend for a PaaS That Bills by Usage
Mimir, Cortex, and Thanos compared as the multi-tenant metrics backend for a self-hosted PaaS that bills by usage — per-tenant cardinality isolation, cost attribution for chargeback, and owned-capacity footprint, with a decision table.
CNCF Says MCP Gateways Belong in the Platform. Here's What That Actually Requires
MCP gateways are now a CNCF Platform Engineering 2.0 pillar. Here's what a gateway does that an ad-hoc MCP server doesn't — OAuth 2.1 auth, per-caller rate limits, deny-by-default tool scoping, poisoning detection — and how much of it a self-hosted PaaS control plane already absorbs.
Unlimited Apps, One Flat Bill: What PocketBaseCloud's $25 Show HN Pitch Reveals About Per-Project Pricing
PocketBaseCloud's Show HN offers unlimited small apps on a $25 flat slice — we work the N-app math against Supabase per-project metering, Vercel usage billing, and a $6 self-hosted box.
Stop Copying Registry Passwords Into Every Namespace: Kubernetes 1.34 ServiceAccount Image Pulls in Practice
Kubernetes 1.34's beta ServiceAccount token flow replaces per-namespace imagePullSecrets with short-lived, workload-bound pull credentials — how to wire the registry side, bind ServiceAccounts, handle rotation, and test the failure modes before deleting static secrets.
SUSE Put MCP Across Its Whole Portfolio: What a Vendor-Blessed Agent-to-Infra Interface Means for Your PaaS's Own MCP Server
SUSE embedded MCP servers across Rancher Prime and Multi-Linux Manager with AWS, n8n, Revenium, and Stacklok aboard. Here is what a vendor-blessed agent-to-infra interface validates for a PaaS agent API, where its patch-and-monitor scope stops short of the git-push deploy surface, and a checklist for building that surface yourself.
Coolify v4 Is a Rolling Beta: What Pinning the Platform Underneath Your Apps Actually Requires
Coolify v4.3.1 was 'latest patched' on August 12 and four releases behind by August 16 — inside a CVE cluster with RCE to host root. How to run a rolling-beta PaaS panel safely: version-pinned installs, a staging canary box, and advisory-feed monitoring.
ARC 0.14.0: Ephemeral Tenant CI on Your Own Fleet, Without the Scale-Set Sprawl
ARC 0.14.0 adds multilabel runner scale sets, stale-config protection, and a standalone Go client — a walkthrough of running ephemeral per-job tenant CI on a Cluster-API fleet, from Helm install to listener scheduling.