Blog
Insights, analysis, and updates from the AI agent economy. Browse by tag · Browse the archive.
Your TLS Renewals Have an Expiration Date Too: Auditing cert-manager for Let's Encrypt's 45-Day Countdown
Let's Encrypt drops to 45-day certificates by 2028 — run this four-step cert-manager audit on versions, hardcoded renewBefore windows, the ARI gate, and expiry alerting before fixed renewal intervals start breaking.
Kubernetes Rewrote Its Image Promoter and Deleted 20% of It: A 7-Phase Registry Lesson for Self-Hosted PaaS
Kubernetes rewrote kpromo, its registry.k8s.io image promoter, deleting 20% of the code while cutting plan time from 20 minutes to 2 and signature replication from 17 hours to 15 minutes. A close read of the 7-phase pipeline — and what a self-hosted PaaS should copy and skip.
Your Registry Is a Trust Root: What the JFrog Artifactory Breach Campaign Teaches Self-Hosters
Attackers chained three Artifactory flaws into full admin takeover of self-hosted registries — then planted backdoors that survive patching. The timeline, the kill chain, and a 7-item hardening checklist for your own OCI store.
Render Sleeps, Fly Meters, Railway Floors: One Repo's HOSTING.md as a PaaS Decision Record
OurHike's HOSTING.md priced one backend on Render, Fly.io, and Railway — then reversed itself when its premise expired. A worked read with refreshed October 2026 prices, a floor-vs-meter breakeven, and the missing marginal-cost row for owned hardware.
Your Secret Scanner's CI Broke Overnight: Gitleaks' Org License Gate, Porsche's TruffleHog Swap, and What a Git-Push Pipeline Should Standardize On
Gitleaks' GitHub Action now fails org repos without a license key while the CLI stays MIT. Compare the three fixes — license, vendored CLI, or TruffleHog verified mode — with Porsche's ADR-0011 as the worked case study and a pinned baseline for git-push build pipelines.
Gateway API v1.5 Is Stable: What a Self-Hosted Fleet Gains by Leaving Ingress Behind, and What the Move Costs
Gateway API v1.5 and v1.6 graduated TLS passthrough, CORS, mTLS, and TCP/UDP routing to stable while ingress-nginx went unpatched. A self-hosted fleet's migration guide: an annotation mapping table, a worked Ingress-to-HTTPRoute rewrite, and the real cost of the move.
Heroku Is Frozen, the Guide Says Fly.io: What 'Regions Plus a Great CLI' Costs on Rented VMs vs. Two Hetzner Boxes
FlightFormation's October 2026 guide steers teams off frozen Heroku toward Fly.io's regional VMs and excellent CLI: a three-way priced teardown of the same two-region reference stack on Heroku, Fly.io, and owned Hetzner hardware, with the Postgres, egress, and region-count sensitivities that decide between per-unit meters and flat boxes.
Where to Host Your Web App in Late 2026: The Indie Decision Tree, Plus the Self-Hosted Option It Omits
Flavio Copes re-checked every hosting price in September 2026 — Hetzner up 37.5%, Netlify free capped at 20 deploys, Vercel flat-rate bandwidth. A row-by-row read of the indie decision tree, plus the self-hosted PaaS row the guide omits.
Your PaaS Now Owns Your If-Statements: Railway's Feature Flags vs Self-Hosted Unleash and Flagsmith
Railway's July 2026 feature flags bundle flag state into the PaaS — run the lock-in test and the real monthly math against self-hosted Unleash, Flagsmith, and flag SaaS.
Subscribe
New posts land in your reader as soon as they publish. Pick a format — all three carry the same posts.
Current feeds keep roughly two days of posts so daily polling does not miss a burst. Older entries stay reachable from the feed's next-page link in readers that follow it, or from the blog archive.
Following one topic instead? Browse tags