Blog
Insights, analysis, and updates from the AI agent economy. Browse by tag · Browse the archive.
Cloud Native Buildpacks Win on CVE Day, Not Day One
A base-image CVE across 17 Dockerfile-based services costs three days of edits, rebuilds, and retests. With one shared buildpack builder, it is a single bump and a rebase — here is the itemized ledger.
Bottlerocket Killed Bare-Metal Kubernetes After 1.28: Picking a Node OS for Your CAPH Fleet
Bottlerocket's bare-metal Kubernetes variants ended at 1.28, and the last patches expired with Kubernetes 1.28's end-of-life. Here is how Talos Linux, Flatcar Container Linux, and Kairos compare as the node OS for a Cluster API fleet on owned hardware — and which one fits your team.
Better-PaaS and the 'Agent-First' PaaS Pitch: What a Single-VPS Deploy Tool Gets Right — and Where It Stops at the Second Machine
Better-PaaS puts scoped agent tokens and MCP deploy tools on a single VPS — genuinely good design. A verified inventory of what ships, the principle worth stealing, and the concrete second-machine line where single-box agent surfaces stop and multi-node control planes take over.
Bare-IP TLS Is GA: Instant HTTPS for Preview URLs Without a DNS Round-Trip
Let's Encrypt's generally available 160-hour IP certificates let a preview environment serve valid HTTPS on a bare node IP with no DNS records. Here is the cert-manager plus Gateway API wiring, the renewal math, and when a subdomain still wins.
Backstage's All-In Cost Hits $700K a Year for 100 Engineers: What Port's Days-to-Weeks Setup Trades Away for the Price
A self-hosted Backstage deployment runs $450K–$700K a year for 100 engineers while a Port subscription costs $30K–$80K and ships in days. Here is where each dollar goes, what the SaaS shortcut trades away, and which one fits your headcount.
Your REST API Is Already an MCP Server: The Gateway Bridge That Skips the Rewrite (and Where It Breaks)
API gateways can now expose REST operations as MCP tools with no backend rewrite — how Azure APIM's bridge works, what governance comes free, and the five limits that call for a purpose-built MCP server.
Automatic TLS on Owned Hardware: Caddy vs cert-manager After Hetzner's July Load Balancer Disruption
Hetzner's July 2026 Ashburn load balancer disruption showed what happens when TLS renewal shares fate with a provider's data plane. A comparison of managed LB certificates, Caddy automatic HTTPS, and cert-manager plus Gateway API — and why self-hosted platforms should own the certificate path as Let's Encrypt lifetimes shrink.
Who Sent This Agent, and Whose Authority Is It Spending? What the IETF's AIMS Draft Means for MCP Server Auth
The IETF's AIMS draft composes WIMSE, SPIFFE, and OAuth 2.0 into one agent identity model. Here is what a deploy-from-chat MCP server should borrow — and how to prove which agent called and whose authority it spent.
Where Post-Railway Workloads Land: Six Destinations and the Hetzner Math
Six completed 2026 migrations off Railway landed on Render, DigitalOcean, AWS, Azure, Hetzner, and Coolify. A destination-by-destination account of what each exit buys and re-buys, plus the missing cost math: a $128/month metered footprint fits many times over on a €44 dedicated box.
Subscribe
New posts land in your reader as soon as they publish. Pick a format — all three carry the same posts.
Current feeds keep roughly two days of posts so daily polling does not miss a burst. Older entries stay reachable from the feed's next-page link in readers that follow it, or from the blog archive.
Following one topic instead? Browse tags