509 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
A Real Hetzner Decision Doc Picked Coolify v4 and Dokploy: What Teams Actually Reward in a Self-Hosted PaaS
A real team's Hetzner platform decision scored Coolify, Dokploy, CapRover, Kamal, Dokku, and Portainer on low ops burden — and picked its winners for operability, not feature count. Here is the reconstructed matrix and the machine-two question it deferred.
Renovate as a Kubernetes CRD: Patching Build Images Without a Hosted Bot Account
Mogenius's Renovate Operator runs dependency updates as a Kubernetes-native controller. Here is a worked design for patching a self-hosted PaaS's build images with it, plus the quota, credential, and blast-radius guardrails that keep automation safe.
Claude Cowork Broke Containment Twice in July: VM Root on Windows, Host Files on Mac
In July 2026, Claude Cowork broke containment twice — a root chain on Windows and a kernel-to-host escape on Mac. This teardown walks both attack chains and maps the isolation tiers and hardening checklist your own agent sandboxes need.
Your Operator's /readyz Is Lying: The controller-runtime Cache-Sync Trap Behind Green Dashboards and Stalled Reconciles
A kubebuilder operator's scaffolded readyz check returns 200 before the informer cache syncs, before leader election completes, and before webhooks serve. The three readiness checks that close the gap, the RBAC stall that makes them necessary, and the audit to run this week.
Coolify vs Dokku vs CapRover vs Ownkube: What the 2026 Shootout Gets Right — and What Breaks at Box Two
A September 2026 four-way comparison crowns a winner for every team size — but its real finding is that each panel breaks differently at the second machine. This read-through prices all four ceilings, including the vendor's own.
Daytona's Core Went Private: What a Frozen Sandbox Repo Teaches About Who Owns Your Agent Isolation Layer
Daytona froze its open-source sandbox repo in June 2026, four months after a $24M Series A. What the freeze costs teams pinned to v0.190.0, how MinIO CE ran the same playbook, and a priced look at staying, renting, or owning your agent isolation layer.
Ingress-NGINX Is Retired: Your Gateway API Migration Playbook for the Rest of 2026
Ingress-nginx stopped receiving security patches in March 2026. A migration playbook for self-hosted teams: the five translation traps, which annotations survive the move to Gateway API, and a TLS cutover checklist.
Show HN Promised Instant Kubernetes With KVM and gRPC — the Hard Part Was Never Provisioning
A Show HN promises production Kubernetes in 5–10 minutes via KVM and gRPC agents. Machine lifecycle is already standardized by Cluster API — the unsolved half is the tested service bundle, and no protocol fixes that.
Kapibara Builds Git Pushes With In-Cluster BuildKit and a Railpack Frontend — No Docker-in-Docker Required
Kapibara's Docker-less build path replaces per-build Docker-in-Docker pods with one in-cluster BuildKit daemon and a Railpack frontend — the step-by-step design, what it removes, and what it still costs.