Blog
Insights, analysis, and updates from the AI agent economy. Browse by tag · Browse the archive.
Gateway API v1.5 Makes TLSRoute and Gateway mTLS Stable: What Your Self-Hosted PaaS Gets for Free
Gateway API v1.5 promotes TLSRoute and Gateway-level mTLS to stable. What SNI passthrough and client-cert validation mean for a self-hosted PaaS, plus the v1alpha2 upgrade trap and the cert-manager gaps to watch.
Gardener Proposed Traefik as Its ingress-nginx Replacement: What the Emerging Consensus Means for Your Fleet's Edge
Gardener's GEP-57 proposes Traefik as the successor to its retired nginx-ingress addon, joining RKE2 and K3s in a drop-in consensus. What that convergence means for a self-hosted fleet deciding between Traefik now and Gateway API later — plus the caveats Gardener states plainly.
Nobody Gives You Always-Awake for Free Anymore: Hobby-App Math on a €5 Hetzner Box
Nobody offers an always-awake app for free in September 2026 — the floor runs $2–7 per app plus $5–6 for Postgres. A worked comparison puts three hobby apps at $11–27 a month on entry meters versus ~€5 consolidated on one Hetzner box.
From Fly.io to Hetzner in a Weekend: A Migration Playbook That Cuts the Bill 70%
A line-by-line playbook for moving a three-region Fly.io app to a Cluster-API-managed Hetzner fleet: what replaces each Fly primitive, a Friday-to-Sunday runbook, and a monthly bill comparison showing the total falling from 108 to 31 dollars.
Fly.io's Four-Incident Day: What September 23's Networking Pileup Teaches About Depending on Someone Else's Mesh
On September 23, 2026, Fly.io suffered four incidents in twelve hours — DFW IPv6 failure, Upstash dark in Frankfurt, 6PN mesh errors, and a Sprites outage that spread regions overnight. Here is the timeline, an honest accounting of what tenants could do, and what changes when you own the mesh.
Fly.io's Fee Layers, Itemized: The Real Bill Behind the $2.02 Machine
A bottom-up rebuild of what a small Fly.io app really costs — $8.54 to $10.56, not $2.02 — once IPs, bandwidth, volumes, and certs are counted, plus the $5 flat number for the same footprint on owned hardware.
Firecracker's First Escape CVEs: What CVE-2026-5747 and CVE-2026-1386 Mean for MicroVM Sandboxes
Firecracker's zero-escape-CVE record broke twice in 2026: an out-of-bounds write in the virtio-pci transport and a symlink overwrite in the jailer. What both bugs mean for teams running AI-agent sandboxes on microVMs, and the patching checklist that keeps the isolation story intact.
External Secrets Operator vs Vault vs Infisical: the Secrets Backend a Self-Hosted PaaS Should Actually Wire In
ESO syncs secrets but stores none, Vault's BSL bars embedding it in a resold product, and Infisical gates governance behind per-identity billing — a two-table comparison of the sync layer and the store, and the pairing a self-hosted git-push PaaS should wire in.
Egress Is the Bill: Where Fly.io's $0.02/GB, Railway's $0.05/GB, and the $0.04 APAC Rate Overtake Compute
A worked crossover sheet prices the same scale-tier stack on Fly.io, Railway, Render, and Hetzner: Render's egress passes compute at ~2.8 TB/month, Railway at ~6.5 TB, Fly.io at 10 TB in NA/EU but 5 TB in APAC — while the flat Hetzner box stays at $0.
Subscribe
New posts land in your reader as soon as they publish. Pick a format — all three carry the same posts.
Current feeds keep roughly two days of posts so daily polling does not miss a burst. Older entries stay reachable from the feed's next-page link in readers that follow it, or from the blog archive.
Following one topic instead? Browse tags