510 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
Hard Multi-Tenancy for Agent Workloads: What Apple's Kata plus VirtualClusters Recipe Costs
Apple's KubeCon recipe pairs per-tenant virtual control planes with Kata microVMs so untrusted agent code never shares a kernel with production tenants. The bill: about a second of cold start and 30-100 MB per sandbox, plus one small control plane per tenant.
Crossplane Graduates: AI Needs APIs, Not UIs — and What That Means for Your Self-Hosted PaaS
Crossplane's CNCF graduation validates the control-plane-first thesis: AI agents need declarative, reconciled APIs, not dashboards. Upbound's Modelplane proves it across clouds — but a fleet you own needs depth, not breadth.
Your PaaS Thought One Developer Meant One Deploy Queue. Then the Agent Fleet Showed Up.
A third of Cursor's own merged PRs are opened by autonomous cloud agents, and GitHub merged 43.2M PRs a month in 2025. One developer's agent fleet can now exhaust a whole account's daily deploy quota before lunch — here is the burst math and the four pipeline fixes: build queues, preview caps, isolated preview data, and merge triage.
Kubernetes 1.37 Kills the Last Idle Pod: Native HPA Scale-to-Zero vs KEDA for Sleeping Apps
Kubernetes 1.37 graduates HPA scale-to-zero to beta and enables it by default: queue workers can shed every replica with minReplicas 0 and no KEDA. HTTP apps still need a buffering layer, and beta isn't ready for a tenant SLA — the head-to-head, the idle-bill math, and the checklist.
MCP Has 10,000 Servers but Three Production Gaps: Identity Propagation, Timeout Budgets, and Structured Errors for Deploy Agents
Ten thousand MCP servers and 97 million monthly SDK downloads made connecting agents to tools trivial — but an agent that can deploy and roll back production needs scoped identity, timeout budgets, and machine-readable errors first. This post designs that deploy surface, tool by tool.
France's Railway Runs Kubernetes on Cluster API: What a National Railway's Declarative Rebuild Teaches a Two-Person Fleet Team
SNCF cut cluster provisioning from a month to 30 minutes and now updates every cluster monthly with Cluster API on its own hardware. Three lessons transfer directly to a two-person team on Hetzner — and four pieces of enterprise ceremony to skip.
Your Build Takes 4 Minutes and Nobody Knows Why: What Cloud Native Buildpacks' RFC 0131 Would Itemize
Deploy-from-git builds report success or failure and nothing else — no per-buildpack timing, no cache-hit signal, no failure attribution. RFC 0131 would fix that with opt-in OpenTelemetry traces per phase and buildpack, and a self-hosted PaaS can turn them into tenant-facing build receipts plus fleet-wide dashboards.
Coolify's Zero-Downtime Asterisk: Why Every Docker Compose Deploy Still Goes Down
Coolify deploys single-container apps with zero downtime but takes Docker Compose stacks offline on every deploy — a 10-to-30-second 502 window. The mechanical reason runners can't do what orchestrators get for free, where Dokploy's Swarm bet fits, and the four questions that cut through any self-hosted PaaS feature matrix.
Headscale at 40,000+ Stars: Mesh Your Multi-Region Fleet Without Anyone Else's Control Plane
Headscale passed 43,000 GitHub stars as the open-source, self-hosted Tailscale control server. A concrete build for meshing a multi-region fleet — embedded DERP, pre-auth keys, per-site subnet routers, ACLs in git — plus the single-instance HA catch and the cost math against Tailscale's 2026 per-user pricing.