Blog
Insights, analysis, and updates from the AI agent economy. Browse by tag · Browse the archive.
CVE-2026-50566: How Namespace-Scoped RBAC Became a 9.9 Node Compromise in Fission
A routine namespace-scoped RBAC grant let a Fission tenant escalate to node compromise — why RBAC was never a sandbox boundary, and what it means for platforms scheduling tenant code on shared nodes.
The Deploy That Pointed at Nothing: Firetiger's CI Race Condition and the One Check That Would Have Stopped It
A canceled CI build fooled Firetiger's deploy pipeline into shipping a container image ID that was never built, triggering an 8-hour ingest outage. Here's the exact failure chain, and the one registry check that would have caught it.
Dokploy Passed CapRover's GitHub Stars in Two Years, Not Nine
CapRover took nearly nine years to reach 15,109 GitHub stars. Dokploy passed that number in about two. The GitHub API data, and the Docker Compose gap behind it, explain why.
Docker Compose's models: Key Has Been in the Official Spec Since June 2025 — What That Means for a Compose-to-Cluster-API Build Step
Docker Compose's models: key for defining AI models, agents, and MCP tools has quietly been part of the vendor-neutral Compose Specification since June 2025 — here's the exact YAML, and what it means for a git-push PaaS's build pipeline.
Ceph Tentacle's FastEC vs MinIO's Maintenance Mode: What Self-Hosting Block and Object Storage Looks Like on a Cluster-API Fleet in 2026
Ceph Tentacle's FastEC cuts erasure-coding overhead for small block I/O by 2-3x. Worked out on real Hetzner-class hardware against 3x-replicated Longhorn, plus the January 2026 production incident that shows exactly how not to enable it.
What Bunnyshell and Okteto Actually Charge for 'Namespace Per PR' — And What It Costs to Build Once
A line-by-line breakdown of what Bunnyshell's per-minute meter and Okteto's per-seat fee actually cost a mid-size team's PR preview environments each month, versus building the same namespace-per-PR workflow on owned Cluster API infrastructure.
Friendly Fire: The AI Security Review That Executes the Attack It's Supposed to Catch
AI Now Institute's Friendly Fire exploit turns Claude Code and Codex's own security reviews into remote code execution — here's how it works and what it means for scoping AI agent permissions on a deploy pipeline.
Your Deploy Agent Has the Same Privileges as a Human Push — and No Insurance
AIUC-1 and California's AB 316 just made 2026 the year AI agent liability got real, while insurers quietly excluded it from standard coverage. Here's what's actually covered, what isn't, and the audit-trail and permission design a deploy-from-chat platform needs today.
Gateway API v1.6 Graduates UDPRoute to GA: What It Actually Takes to Route Non-HTTP Traffic on a Self-Hosted PaaS
Gateway API v1.6 made UDPRoute GA, but controller support is uneven, there's an upgrade-order trap that drops traffic, and UDPRoute still can't multiplex tenants on one port the way HTTPRoute does. Here's what actually changes, with a working example.
Subscribe
New posts land in your reader as soon as they publish. Pick a format — all three carry the same posts.
Current feeds keep roughly two days of posts so daily polling does not miss a burst. Older entries stay reachable from the feed's next-page link in readers that follow it, or from the blog archive.
Following one topic instead? Browse tags