640 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
One ZMQ Message to Root: What LMCache's CVE-2026-105192 Means for Self-Hosting the LLM KV-Cache Layer
LMCache's CVE-2026-105192 let one unauthenticated ZeroMQ message run code as root on self-hosted inference cache servers; v0.5.6 fixes it, and this post shows how to tell if you were exposed and how to harden the deployment.
Portainer 3.0 Ends the Community Edition: Dockge vs Komodo vs Arcane as the Docker-Only Replacement
Portainer 3.0 ships with no Community Edition build, freezing CE on 2.x — a concrete comparison of Dockge, Komodo, Arcane, Coolify, and Dokploy on compose stacks, multi-host, and auth, plus why foundation-owned tooling is the structural defense.
Whose Fingerprint Is on This Deploy? Separate Kubernetes Identities for Humans, CI, and AI Agents
A shared deploy token cannot tell a human retry from a CI job or an MCP agent's mistake. Here is the three-lane identity design — SSO-backed humans, OIDC-minted CI, per-agent ServiceAccounts — that makes every deploy attributable without breaking git-push.
Cilium LB-IPAM and BGP on Bare Metal: What Dropping MetalLB Looks Like on a Hetzner Fleet
MetalLB 0.16's FRR-K8s default is dead weight on L2-only Hetzner clusters. This post compares staying on MetalLB versus Cilium LB-IPAM with L2 or BGP advertisement, sketches a phased per-cluster migration, and names the catch: on Hetzner dedicated, the BGP peer is a router you build yourself.
Governance Is the Runtime: What CNCF's 'Platform Under the Model' Turn Demands From Your Control Plane
87% of orgs encourage AI agents but only 47% govern them. Here is the six-gate runtime checklist — identity, admission, approval, audit, provenance, kill switch — that turns CNCF's 'governance embedded in the runtime' from slogan into control-plane wiring.
Coolify v5 Says No to Kubernetes: What 'Like Swarm but Better' Means at Box Two
Coolify v5 bets on a custom Compose-native orchestrator instead of Kubernetes. A six-capability box-two scorecard — rolling deploys, scheduling, storage, networking, machine lifecycle, conformance — with evidence tags on every v5 promise, plus the four signals that tell you whether to wait or leave the single-box ceiling now.
No Patched Kernel Exists Yet: What CVE-2026-80521 Costs a Self-Hosted Fleet During the Patch Gap
CVE-2026-80521 escapes default containers to host root with a public exploit and no fixed Ubuntu or Debian kernel — a four-step runbook to check exposure, triage untrusted workloads, sandbox through the gap, and roll the fix.
Flipt v2 Goes Git-Native: Feature Flags That Branch With Your Code
Flipt v2 stores feature flags in Git instead of a database, turning releases into reviewed pull requests. A comparison of the 2026 self-hosted flag field plus a worked deploy-dark workflow for a git-push PaaS, with the license and Pro-gate caveats spelled out.
Your Fleet Runs on Go 1.26, Not Go 1.27: The Kubernetes 1.37 Toolchain-Coupling Checklist
Kubernetes 1.37 ships built on Go 1.26, not Go 1.27, so a fleet that builds its own controllers, providers, and node images inherits stdlib CVEs on two different schedules. Here is the version truth table and the ordered rebuild checklist.