Blog
Insights, analysis, and updates from the AI agent economy. Browse by tag · Browse the archive.
Kubernetes 1.36 Ships User Namespaces to GA: What Rootless Containers Change for Multi-Tenant PaaS Isolation
Kubernetes 1.36 graduates user namespaces to GA, remapping container root to an unprivileged host UID. What that changes for packing multiple tenants on shared bare metal — the CVEs it defuses, the version matrix your fleet must clear, and the shared-kernel risks it does not fix.
GAMMA Extends Your HTTPRoutes East-West: Does a Self-Hosted PaaS Need a Service Mesh, or Just the Ingress Layer It Already Owns?
GAMMA lets the HTTPRoute objects a PaaS already provisions for ingress govern east-west traffic too — retries, timeouts, and canary splits without a service mesh. A capability map, worked YAML, real mesh cost numbers, and a decision framework for self-hosted platforms.
Docker Hub Almost Cut You to 40 Pulls an Hour: The Math for Sizing Your Own Registry Cache
Docker's walked-back 10/40-per-hour limits were a preview, not a false alarm: a 15-developer team with ephemeral CI runners and a 12-node cluster hits today's enforced 100/200-per-6-hour buckets on an ordinary Tuesday. The full pull ledger, the tipping-point formula, and how to size and wire a registry cache — registry:2 or Harbor — into a Cluster API fleet.
Docker Hub's 2026 Pricing Squeeze: What Self-Hosting a Registry Cache Actually Saves Your CI Pipeline
Docker Hub's 2026 free tier is 10 pulls/hour unauthenticated and 40/hour on Personal, with roughly 10x overage past paid plan limits. A line-by-line cost model shows a real CI pipeline paying $160–300/month on Docker Hub versus under €12 for a self-hosted pull-through cache — and exactly where the crossover sits.
CNCF's Platform Engineering 2.0 Five Pillars: Grading a Self-Hosted PaaS Against the AI-Era Scorecard
CNCF's July 2026 Platform Engineering 2.0 framework sets five AI-era pillars. We grade a Cluster-API-managed, Render-compatible self-hosted PaaS against each one — one pass, two partials, two gaps — and map the honest upgrade path.
Appwrite Sites and the BaaS Land Grab: When Your Backend Vendor Wants to Host Your App Too
Appwrite Sites turns an open-source BaaS into a git-push app host, and the 1.9.5 release adds branch/path deploy filters, a Rust runtime, and Bun/Deno builds. Here's what backend vendors climbing the stack means for who owns your deploy pipeline — and where a single-box Compose stack ends and a scheduled fleet begins.
xAI Open-Sourced Grok Build — But You Can't Send a Patch: What Apache-2.0 Without Open Contributions Actually Grants You
xAI published the 845,000-line Rust harness behind Grok Build under Apache-2.0 — then refused all external pull requests. A concrete breakdown of what a permissive license without open contributions actually grants a team: audit and fork rights, no roadmap influence, and a security-patch treadmill.
Vercel's Four Repricings Since 2024: What the Pattern Predicts for Your Next Bill Shock — and What a Fixed-Price Box Actually Fixes
Vercel re-modeled its billing four times in eighteen months — granular meters, Fluid Compute, Active CPU, then credits. Here is the full timeline, what the 3-10 month cadence means for your budget, and a worked comparison against a flat-rate Hetzner box where egress variance is zero.
The Tailscale Kubernetes Operator Exposes kube-apiserver Without Touching the Public Internet
84% of internet-observable Kubernetes API servers answer to the public internet. The Tailscale operator's API server proxy replaces the IP allowlist with identity-authenticated tailnet access — here is what changes for a self-hosted fleet, what it costs, and what Headscale users shouldn't assume.
Subscribe
New posts land in your reader as soon as they publish. Pick a format — all three carry the same posts.
Current feeds keep roughly two days of posts so daily polling does not miss a burst. Older entries stay reachable from the feed's next-page link in readers that follow it, or from the blog archive.
Following one topic instead? Browse tags