Blog
Insights, analysis, and updates from the AI agent economy. Browse by tag · Browse the archive.
Dokku Is Still Here After a Decade of Panel Waves: What the Original Single-Box PaaS Says About Coolify's 58K Stars and the Second-Machine Moment
Dokku has shipped since 2013 while Coolify passed 58,000 stars and Dokploy hit 35K — all solving the same first machine. Where single-box tools plateau, and how to graduate to a declarative fleet without a replatform.
E2B and Daytona Both Charge $0.0504/vCPU-Hour. That's the Managed-Sandbox Anchor Price — Here's the Receipt
E2B and Daytona both price sandboxes at $0.0504/vCPU-hour — identical to four decimals despite different stacks. A bottom-up teardown traces the ~8x multiple over raw hardware to warm pools, orchestration, and margin, and sets the beat-this target for self-hosted fleets.
Tailscale Co-Founder Says Devtools Must Be Open Source — Why Your PaaS Is Next
Crawshaw's August 2026 essay argues coding agents make personal forks nearly free to maintain — which turns platform source code into the customization surface. A five-surface table shows what agent-patchable infrastructure buys over closed-PaaS hooks, the strongest counter-argument, and where the line settles.
Copy Fail: 4 Bytes in the Page Cache Break Container Isolation on Every Major Distro
A 732-byte script turns an unprivileged user into root on every major distro — and the shared page cache carries the corruption across containers. What stops it, what doesn't, and the patch-and-isolate playbook for your fleet.
containerd 1.7 Is Dead: The Node-Image Audit Your Fleet Owes Itself Before the Next Kubernetes Upgrade
containerd 1.7 left support in September 2026, and Kubernetes 1.38 drops the kubelet fallback that kept it working. A fifteen-minute audit to find every 1.7 node in your fleet, a table of what the 2.x jump breaks, and the upgrade order that keeps kubelets healthy.
Fail Closed Before the Agent Acts: What Conduct's Guard-Before-Every-Tool-Call Model Means for Governing Deploy Agents
Conduct puts a fail-closed policy gate — block, warn, audit, or inject — in front of every MCP and shell action an agent takes. A decision table for deploy, rollback, and secret-read tools, plus which production actions still need a human.
Codex Deploys End-to-End Without Leaving Chat: What That Means for Your Deploy API's Trust Boundary
OpenAI's Codex can now generate code, push to GitHub, create a Vercel project, attach a domain, and deploy — all inside one chat session. Here is the five-item trust-boundary checklist a deploy API must meet before an unattended agent should touch production.
Cilium 1.20 Puts Tenant Auth in the CNI: What ExternalAuth Means for Fleets Still on ingress-nginx
Cilium 1.20 adds the ExternalAuth filter to Gateway API, moving per-route authorization into the CNI you already run. A before/after of tenant auth on ingress-nginx versus HTTPRoute filters, plus an itemized migration bill for fleets facing the retired controller.
Cilium 1.20: Default to Portable Policy, Go Cilium-Native Only Where It Earns It
Cilium 1.20 implements upstream ClusterNetworkPolicy and promotes MCS to stable. A decision table for writing tenant-isolation policy in portable Kubernetes APIs — and the four things that still need Cilium-native rules.
Subscribe
New posts land in your reader as soon as they publish. Pick a format — all three carry the same posts.
Current feeds keep roughly two days of posts so daily polling does not miss a burst. Older entries stay reachable from the feed's next-page link in readers that follow it, or from the blog archive.
Following one topic instead? Browse tags