Uptime Kuma vs Gatus: What a Click-Configured Status Page Costs a GitOps Fleet
Uptime Kuma has ten times the stars of Gatus, but stars don't pick a GitOps fleet's monitoring stack. A head-to-head on config-as-code, alerting breadth, and status pages — and which tool fits each job.
DMCA Takedowns Land on the Platform, Not the Tenant: The Notice-and-Takedown Runbook a Self-Hosted PaaS Needs Before the First Complaint
The moment tenants serve content from your domains, abuse notices land on your desk — and safe-harbor protection depends on machinery built before the first one. A concrete DMCA and DSA runbook for self-hosted PaaS operators: designated agent, repeat-infringer policy, per-tenant suspension, and shared-domain defense.
GitHub Actions Goes Down and So Do Your Deploys: Designing a Git-Push Deploy Path That Survives an August 2026-Style GitHub Outage
On August 6, 2026, a nine-hour GitHub Actions outage froze builds, webhooks, and Pages publishes — including teams on self-hosted runners. This guide maps the blast radius and lays out a five-piece git-push deploy path that keeps shipping when the forge goes dark.
Harbor's CVSS 9.4 Default Password: How to Tell If Your Registry Is Exposed, and the First-Boot Rule That Prevents the Next One
Harbor 2.15.0 and below ships with a working admin/Harbor12345 default worth CVSS 9.4. A five-minute exposure audit, the rotate-first fix order, what to hunt if it was reachable, and the first-boot rule your own platform should steal.
Flatcar Brings Omaha-Style Auto-Updates Into CNCF Custody: What A-B Partition Rollouts With Automatic Reboots Mean for Unattended Node Updates Across a Hetzner Fleet
Flatcar Container Linux entered the CNCF incubator with Adobe running 20,000 nodes on it. What its Omaha-driven A-B auto-updates change for Cluster-API fleets on Hetzner — and the channel pins plus reboot coordination that make unattended node updates safe.
Hetzner Deleted the Datacenter Field: Why Your Prometheus Labels Went Quietly Empty (and the 30-Second Check)
Hetzner removed the datacenter field from its Cloud API on July 1, 2026, and unpatched Prometheus and vmagent scrapers answered with empty location labels — green targets, hollow metadata. Here is the 30-second check, the old-to-new label mapping, and a nine-item audit checklist for self-hosted Hetzner fleets.
Your Load Balancer Finally Tells You Why the Target Is Down: Hetzner's Health-Check Reason Codes, Decoded Into a Runbook
Hetzner's August 2026 API change gives every unhealthy load balancer target a reason code. What each of the six codes means, who owns the fix, and how to feed them into Prometheus so pages arrive pre-routed.
Freeze the Crash: How CRIU Container Checkpoints Turn a Crash-Looping Pod Into a Debuggable Core Dump
One kubelet API call freezes a failing container into a tarball of memory, file descriptors, and process state. What the January 2026 Checkpoint/Restore Working Group means, the exact checkpoint-debug-restore loop, and the four boundaries — TCP sockets, GPUs, sandboxed runtimes, pod-level restore — that still say no.
Kubernetes v1.37's Deprecations Are a Ticking Clock: Audit Your Self-Hosted PaaS Before the Upgrade Window Closes
Kubernetes v1.37 puts dated removal timelines on kube-dns, kube-proxy IPVS mode, and cgroup v1. A concrete sunset table plus six runnable audit checks for your Cluster API fleet's controllers, CRDs, webhooks, and node templates — run them between code freeze and GA, not after reconciliation breaks.