Blog
Insights, analysis, and updates from the AI agent economy. Browse by tag · Browse the archive.
How the controller-runtime Cache Actually Works: What PaaS Builders Should Know Before Their First OOMKill
Your operator's Get() never hits the API server — it silently caches every object of that Kind in the cluster. How controller-runtime's shared-informer cache works, why it OOMKills control planes at fleet scale, and the exact selectors, transforms, and DisableFor config that shrink a PaaS control plane from gigabytes to a few hundred MB.
Six Traefik Gateway API Advisories in Six Months: The Namespace-Boundary Probes Your Shared Ingress Owes Every Tenant
Traefik shipped six Gateway API isolation advisories between March and August 2026 — including a 9.9 CRITICAL REST-provider exposure and a route-key collision with no workaround. Seven concrete namespace-boundary probes, each with the manifest and the exact assertion, for any platform routing many tenants through one shared ingress.
step-ca vs Let's Encrypt: What an Internal-Only ACME CA Buys Your Fleet's Service-to-Service TLS
Let's Encrypt logs every certificate publicly and refuses private hostnames by design. step-ca gives a Cluster API fleet automated internal TLS with 24-hour certs and no CT-log exposure — here's the full setup, plus the honest cost of running your own CA.
Sprites Speak MCP: When the Agent Sandbox Becomes a Tool the Agent Calls Itself
Fly.io's Sprites now expose their full lifecycle over MCP, so agents provision disposable machines from inside their own loop. Here is the six-tool sandbox contract — create, exec, checkpoint, restore, destroy, list — and the quotas, TTLs, and per-tenant budgets a self-hosted platform needs before the agent becomes the capacity planner.
Static Outbound IPs Are a Paid PaaS Add-On — and a Rounding Error on a Server You Own
Railway's July 2026 release put static outbound IPs behind its Pro plan — the same allowlist-friendly egress identity that costs €0.50/month on a Hetzner box. A platform-by-platform accounting of the egress tax on Railway, Render, Heroku, and Fly.io versus servers you own.
Spend Caps Are a Feature Hosted PaaS Has to Build — and Owned Hardware Gets for Free
Railway's July 2026 CLI usage limits let you cap spend by taking your own app offline. A fixed-price Hetzner box makes the same guarantee for free — but owned hardware still owes its tenants quotas. The full economics of bill anxiety, with the numbers.
Railway's Five Postmortems in Six Months: What an 8-Hour Blackout From a GCP Account Suspension Reveals About Renting Your Platform's Platform
Railway's May 2026 blackout was caused by Google suspending the account the whole platform runs on — a failure mode no SLA or multi-AZ diagram covers. A close read of five postmortems, the hidden dependency chain of renting a PaaS, and an honest tally of what self-hosting removes from the failure tree versus what it adds to your pager.
Your PaaS Bill Grew a New Line Item: Fly.io's Snapshot Charges, Cross-Region Transfer Fees, and What a Multi-Region Indie SaaS Actually Pays Now
Fly.io began billing volume snapshots on January 1, 2026 — a meter attached to a default. A line-by-line accounting of what a multi-region indie SaaS (web, worker, cross-region Postgres replica) now pays on Fly.io and Railway, the cross-region transfer rates most users never priced, and why self-hosted costs can't grow lines you didn't write.
OpenID Certified at 30 MB: What Pocket ID and Tinyauth's Formal OIDC Conformance Actually Proves for Your PaaS Admin Login
Pocket ID and Tinyauth both passed the OpenID Foundation's conformance suite in 2026. What the certification actually tests, what it doesn't prove, and when a 30 MB IdP is enough to gate a self-hosted PaaS admin surface.
Subscribe
New posts land in your reader as soon as they publish. Pick a format — all three carry the same posts.
Current feeds keep roughly two days of posts so daily polling does not miss a burst. Older entries stay reachable from the feed's next-page link in readers that follow it, or from the blog archive.
Following one topic instead? Browse tags