Blog
Insights, analysis, and updates from the AI agent economy. Browse by tag · Browse the archive.
The $50K 'Skip Kubernetes' Claim, Audited Against Owned Hardware
A March 2026 essay claims skipping Kubernetes saves $50K a year. We audit the number line by line — managed control-plane fees and node markup versus a CAPH fleet on Hetzner — and find the real variable is tenant count.
Tau Skipped Kubernetes Entirely: What a Wasm-Native PaaS Gains — and Gives Up
Taubyte's Tau runs a self-hosted PaaS on WebAssembly and libp2p with zero Kubernetes. This comparison tables what deleting the control plane buys — sub-millisecond cold starts, no etcd — against what it forecloses: no Docker images, no operators, no GPU scheduling.
Sprites Meet MCP: How Fly.io Built Agent-Safe Sandboxed Deployment Environments
Fly.io's Sprites now speak MCP: agents get persistent Firecracker microVMs with 300ms checkpoints through sprites.dev/mcp. Here is the six-primitive checklist for agent-safe sandboxes, how E2B, Daytona, Modal, and Vercel compare, and what it takes to build the same on owned hardware.
France's Railway Runs on Cluster API: What SNCF's Monthly Zero-Drift Fleet Teaches a Self-Hosted PaaS
SNCF provisions Kubernetes clusters in 30 minutes and updates its whole fleet monthly with zero configuration drift — on infrastructure it owns. Here is the stack behind those numbers and which parts transfer to a small self-hosted fleet.
Keyless Signing Won: What Rekor v2 and cosign v3 Mean for Verifying Every Image at Admission
Rekor v2, cosign v3, and Open Component Model's breaking 2026 releases made keyless signing the default. What identity-based provenance means for verifying every container image at admission — and where the guarantees stop.
iptables Is Quietly Taxing Every New Connection on Your Fleet: The nftables Performance Case, With Numbers
Kubernetes 1.37 started warning clusters that never chose a kube-proxy mode, and the default flips to nftables by 1.40. The benchmark numbers behind retiring iptables, what the switch actually costs, and a decision rule for self-hosted fleets.
Render Killed the Pasted AWS Key. Your Self-Hosted PaaS Is Now on the Clock.
Render's July 2026 OIDC releases made keyless auth to AWS, Anthropic, and OpenAI a GA platform feature. Here's the trust-chain machinery behind it and the two concrete paths — cluster-issuer federation or SPIFFE/SPIRE — for matching it on machines you own.
Railway Skips the Post-Merge Rebuild: Promote the Exact Preview Image to Production With BuildKit Digests
Railway's Skipped Builds deploys the already-tested PR image to production instead of rebuilding after merge. A self-hosted version of the same trick: commit-to-digest provenance, BuildKit cache policy, and digest-pinned deploys.
Railway Put Postgres HA, PITR, and PgBouncer in the Terminal — and Gave Agents the Keys
Railway's September 2026 CLI release brings Postgres HA, point-in-time recovery, and connection pooling to the terminal with JSON output. Here is how each operation compares to its CloudNativePG equivalent on infrastructure you own, and what it means now that database lifecycles are APIs agents call.
Subscribe
New posts land in your reader as soon as they publish. Pick a format — all three carry the same posts.
Current feeds keep roughly two days of posts so daily polling does not miss a burst. Older entries stay reachable from the feed's next-page link in readers that follow it, or from the blog archive.
Following one topic instead? Browse tags