Kubernetes 1.36's User Namespaces Go GA: The hostUsers: false Default Every Multi-Tenant PaaS Should Ship
Kubernetes 1.36 graduated User Namespaces to GA — here's the exact node-image, subuid, and admission-policy recipe to make hostUsers: false the cluster-wide default for every tenant pod, plus the shared-kernel limitation it doesn't fix.
Kubero vs a Cluster-API PaaS: Two Kubernetes-Native Bets on "Heroku Without the Monthly Bill"
Kubero and a Cluster-API-based PaaS both promise Heroku without the invoice, but they eliminate different halves of it — here's the CRD-level breakdown of what each actually owns, what it costs, and which problem it solves.
Let's Encrypt's 6-Day Certificates Are GA: The Renewal Math Your PaaS's ACME Automation Needs to Survive It
Let's Encrypt's 6-day certificates are live and 45-day defaults are coming by 2028 — the renewal-frequency math, the real rate-limit bottleneck (your DNS provider, not Let's Encrypt), and what a self-hosted PaaS's ACME automation needs to change first.
MCP's Stateful Session Bottleneck: Why the 2026 Transport Roadmap Is Racing to Make Agent Servers Horizontally Scalable
MCP's official spec drops protocol-level sessions on July 28, 2026 — here's why that's the fix for the exact bug that makes a deploy-from-chat MCP server a worse single point of failure than the app it manages.
Ephemeral Preview Environments on Kubernetes: A Namespace-Per-PR Recipe for a Git-Push PaaS
A working ArgoCD ApplicationSet recipe for namespace-per-PR previews, what it actually costs in cluster resources at 10 vs 50 concurrent PRs, and the quota/network-policy/TTL guardrails that keep a busy repo from starving a shared cluster.
PocketBase vs. a Cluster API Fleet: The Three Walls That Tell You When to Switch
PocketBase's single Go binary handles 10,000+ realtime connections on a $4 server — until sustained multi-writer contention, HA requirements, or hard tenant isolation hit walls a Cluster API fleet is built to clear.
PostgreSQL 18's Async I/O, OAuth, and pg_upgrade --swap: What Your Operator Image Should Actually Turn On
PostgreSQL 18 shipped async I/O, OAuth 2.0 authentication, and a faster pg_upgrade --swap mode. A concrete recommendation for which of the three a self-hosted PaaS's CNPG or Zalando-managed Postgres image should turn on today, and which ones aren't ready yet.
Preview Environments Are Table Stakes Now: What Dokploy, Railway, and Render's PR-Preview Features Mean for a Self-Hosted git-push PaaS Roadmap
Render, Railway, and Dokploy all ship PR-triggered preview environments now — here's what it actually takes to build the same feature on a multi-node Cluster API fleet instead of one Dokploy-style box, and why the gap is four real subsystems, not a checkbox.
Railway's July Outage Was the Same Bug as February — And That's the Real Story
Railway's July 2, 2026 outage and its February 11 outage share the same root cause and nearly the same remediation promises — proof this was a governance failure, not an infrastructure one.