640 posts tagged with "Kubernetes"
Container orchestration, Cluster API, and self-hosted control planes
16 Claude Code CVEs and Counting: Why Container Sandbox Escape Is a Vulnerability Class, Not a Bug
Sixteen CVEs against one coding agent prove container sandbox escape is a permanent vulnerability class, not a patchable bug. Here is the CVE record, the isolation ladder with real latency numbers, and why agent-generated code belongs behind its own kernel.
Coolify vs CapRover for Solo Devs: What the Polish Verdict Gets Right — and the Second-Machine Ceiling Neither Lifts
SoloDevStack scored Coolify 9/10 and CapRover 7/10 on polish. A claim-by-claim audit confirms the verdict for week one — then runs the second-machine checklist both panels fail, and names what replaces 'which panel' once one box is not enough.
Crossplane's Case for API-First Infrastructure: What an AI Agent That Deploys Actually Needs From an API
Crossplane's CNCF graduation made composable infrastructure APIs mainstream, but an agent that deploys needs a contract shape — schema, desired state, status, watch, safe retry — not a specific framework. A head-to-head of composite resources against a purpose-built deploy API, with a decision rule for which to build.
Should Your AI Agent Write YAML or Call Tools? Crossplane's API-First Case vs MCP Agent Ops
Crossplane says agents should declare desired state and let controllers reconcile; the MCP ecosystem says agents should call tools step by step. A head-to-head on the same task, a mid-provision crash traced through both, and three reconciliation ideas every platform MCP server should borrow.
CrowdSec vs fail2ban on the Nodes You Own: Who Guards a Self-Hosted PaaS's SSH and HTTP Edge
fail2ban guards one box well but never shares what it learns. This comparison shows where fail2ban still wins, where CrowdSec's crowd-sourced blocklists and fleet-wide bouncers take over, and how to place each one on a self-hosted fleet.
The Dutch Government Is Building a Microsoft Alternative on NixOS: What National-Scale Self-Hosting Signals for Teams Who Own Their Stack
The Dutch government's DAWO project is building a Microsoft-independent workplace on NixOS — here is what the mandate, pilots, and technology amount to, and what 'the whole system is declared in config' means for a self-hosted PaaS fleet choosing between NixOS and Talos for its node images.
etcd 3.7 RangeStream: What Streaming List Reads Mean for a Cluster API Fleet
etcd 3.7's RangeStream streams large collection reads in chunks instead of buffering whole responses, and Kubernetes 1.37 enables it by default. Here is where the memory win lands on a Cluster API fleet, how to verify it with one metric, and what it does not fix in your controllers' caches.
External Secrets Operator Won the Kubernetes Secrets War: A Self-Hosted PaaS Playbook
ESO passed 45M downloads and GA'd its v1 APIs, making it the default sync layer between external secret stores and Kubernetes. Here is the concrete buy-vs-cost case for adopting it as a fleet add-on — tenant-scoped stores, rotation semantics, and what it still doesn't solve.
hcloud's Per-Location Availability Columns Are the Safety Check CAPH Dropped
CAPH v1.0.7 stopped validating server types and Hetzner moved availability to per-location signals, so a typo'd type now fails at the API instead of kubectl apply. Poll hcloud's Available/Recommended columns, pin types per location, and gate the apply.