Blog
Insights, analysis, and updates from the AI agent economy. Browse by tag · Browse the archive.
Kaniko Is Dead: Google Quietly Archived It in June 2025 — What Rootless BuildKit Means for a Git-Push PaaS's Image-Build Path
Google archived Kaniko in June 2025 with no successor named. Here's why rootless BuildKit is the closest maintained replacement for daemonless, unprivileged Kubernetes image builds — and the caching, security, and kernel details a git-push PaaS has to re-verify before migrating.
Ingress2Gateway 1.0 vs. a Real Ingress-NGINX Annotation Set: What Actually Translates
We ran Ingress2Gateway 1.0 against a realistic ingress-nginx annotation set from a Cluster-API-managed fleet: four annotations translated cleanly, four landed on non-portable extension CRDs, and two had no Gateway API equivalent at all.
Ingress-NGINX Is Retiring: What Migrating a Self-Hosted PaaS's Custom-Domain Routing to Gateway API Actually Involves
Ingress-NGINX retires in March 2026 and Ingress2Gateway hit 1.0 in March too. Here's the concrete before/after — manifests, an annotation-by-annotation translation table, and an ordered checklist — for moving a multi-tenant PaaS's per-tenant custom-domain routing to Gateway API.
Hetzner Killed the datacenter Field: Is Your CAPH Fleet's CCM Still Reading It?
Hetzner quietly deprecated the datacenter field on Servers and Primary IPs, and any hcloud-cloud-controller-manager older than v1.30.1 panics once it disappears. Here's the exact check, the exact failure mode, and the upgrade path for a Cluster-API-provider-Hetzner fleet.
GuardFall: Why 10 of 11 Open-Source AI Coding Agents Can't Tell What Bash Will Actually Run
Adversa AI's GuardFall research found 10 of 11 open-source AI coding agents check a shell command's raw text for danger, then hand that text to bash, which rewrites it before running. Here are the five bypass classes, per-agent results, and what it means for building agent-callable deploy tools.
GitHub Copilot's Token Billing Blindsided Users With 25-60x Bills — What It Means for Metering an MCP Server
GitHub's June 2026 switch to token-metered Copilot billing collided with its own research showing agentic tasks burn 1,000x more tokens than chat — real bills jumped 10x-50x. Here's the exact retrofit GitHub, Cursor, and Replit all shipped too late, and what an MCP-metered PaaS should ship on day one instead.
Giant Swarm's AI Agent Platform Proves Cluster API Scales — But Not Every Layer It Runs
Giant Swarm's production numbers — 2.8x lower cost per agent run, 500 parallel agents — validate Cluster API and GitOps as an AI-agent substrate. But its Backstage-centric IDP layer is a $300K-$700K/year commitment a simpler git-push control-plane API doesn't need.
Four Root Exploits in Ten Weeks: What GhostLock Says About Kernel Patching for a Self-Hosted PaaS
GhostLock lets any logged-in user become root in five seconds — and it's the fourth independently discovered kernel or hypervisor escape disclosed in ten weeks. Here's the patch-cadence argument for treating kernel CVEs as a same-day operational primitive on a self-hosted fleet.
Fly.io's Job Postings Hit Zero While Render and Railway Raise $100M Each
Fly.io's careers page shows zero open roles the same year Render and Railway each raised $100M — a concrete checklist for reading hiring and funding signals before you build a business on any hosted PaaS.
Subscribe
New posts land in your reader as soon as they publish. Pick a format — all three carry the same posts.
Current feeds keep roughly two days of posts so daily polling does not miss a burst. Older entries stay reachable from the feed's next-page link in readers that follow it, or from the blog archive.
Following one topic instead? Browse tags