Blog
Insights, analysis, and updates from the AI agent economy. Browse by tag · Browse the archive.
Render and Railway Bill Per-Second for What Kubernetes CronJob Does for Free
A line-by-line cost comparison of Render Cron Jobs and Railway's cron feature against a plain Kubernetes CronJob on a self-hosted Cluster API fleet, at 1, 5, 20, and 100 scheduled jobs a month.
Kubernetes Wrote the AI Contribution Rulebook. Here's the Cheat Sheet for a One-Person PaaS
Kubernetes' new AI contribution policy leans on CNCF funding most projects don't have — here's which parts are free to copy, and what curl, Ghostty, and tldraw did without that budget.
Kubernetes Ships an Official Agent Sandbox Primitive: What It Actually Buys a Self-Hosted PaaS
Kubernetes SIG Apps shipped an upstream CRD for running untrusted AI-agent code safely — here's what it gives a Cluster API-based PaaS for free versus E2B, Daytona, and Modal, the real cost math, and what's still missing.
Kubernetes 1.36 Retires the Webhook for Tenant Defaulting — Here's the Before/After
Kubernetes 1.36 graduates MutatingAdmissionPolicy to stable, letting CEL expressions replace the tenant-defaulting webhook most self-hosted PaaS platforms hand-roll. Here's the before/after code, what operationally disappears, and where a hand-written webhook still wins.
Kata Containers vs gVisor: A RuntimeClass Decision Framework for Multi-Tenant Kubernetes
runC's 2025-2026 escape vulnerabilities settled the question of whether untrusted multi-tenant workloads need stronger isolation. This is the decision framework for which one, per workload, actually pays off.
Karpenter's Alpha Cluster API Provider vs. Cluster Autoscaler: What Actually Autoscales an Owned-Hardware Kubernetes Fleet in 2026
A Hetzner-backed Cluster API fleet gets its node-ready time from Cluster API's own machine lifecycle, not from which autoscaler is asking — here's what Cluster Autoscaler, alpha Karpenter-for-CAPI, and vCluster's Auto Nodes each actually deliver today.
JADEPUFFER Ran a Full Ransomware Kill Chain With No Human Involved — What That Means for Agents That Deploy Your App
An AI agent ran an entire ransomware attack end to end with no human directing a single step. Here's what that kill chain means for any platform whose own agent can deploy or restart your infrastructure.
ingress-nginx's EOL Didn't Stop CVE-2026-3288: What Patching a Dead Project Means for Your Routing Layer
ingress-nginx's official end of life didn't stop three RCE patches from landing in its final weeks and months after — here's the sourced timeline, a fleet-wide audit you can run today, and why the blast radius is worse on a self-hosted PaaS.
Hetzner's June 2026 Price Hike Doubled Some Instances — Here's the Recomputed Break-Even Against Render and Railway
Hetzner's June 15, 2026 adjustment raised CPX and CCX instances by up to 209% while CX and CAX barely moved. A line-by-line recompute of a web+worker+Postgres topology on post-hike Hetzner versus Render and Railway — and why picking the wrong instance family now costs as much as picking the wrong vendor.
Subscribe
New posts land in your reader as soon as they publish. Pick a format — all three carry the same posts.
Current feeds keep roughly two days of posts so daily polling does not miss a burst. Older entries stay reachable from the feed's next-page link in readers that follow it, or from the blog archive.
Following one topic instead? Browse tags