1512 posts tagged with "PaaS"
Platform-as-a-Service tooling, economics, and self-hosted alternatives
Kubernetes v1.36 Ships Admission Policies That Can't Be Deleted: Closing the Bootstrap Window in Your Fleet's Guardrails
Kubernetes v1.36's manifest-based admission control loads policies from files before the API server serves its first request — undeletable via any RBAC. What it forecloses for a multi-tenant self-hosted PaaS, and the Cluster API bootstrap sequencing that makes guardrails live before the first tenant pod.
Railway's July 2026 US East Outage: What One ISP's Bad Route Cost Every App — and What Owning the Network Costs Instead
One carrier's backbone degradation left every app in Railway's US East zone degraded for over four hours — including 20 minutes with no internet route at all. A worked breakdown of what the outage cost and what owning your own network path actually costs, from a €40 Hetzner box to a full ASN with dual transit.
Render Says Buildpacks Beat Your Dockerfile by 75%. Can Nixpacks or Paketo Match That on Your Own Hardware?
Render's 75% faster-builds claim is standard Cloud Native Buildpacks layer caching, and both Paketo and Nixpacks reproduce it on hardware you own. What the number actually measures, the exact cache-image and cache-key commands for a fleet of ephemeral builders, and the five cache policies a shared build node platform needs.
Your Base Image Is Six Months Stale: Making Renovate's FROM-Line Patching a Self-Hosted PaaS Default
A git-push PaaS rebuilds your app on every push — and never touches the FROM line between pushes. How a platform-run Renovate loop with digest pinning and health-gated automerge bounds base-image staleness from unbounded to about a day, the exact renovate.json to do it, and where the loop still falls short of buildpack rebase.
Webhook Signature Verification for Git-Push Deploys: What a Self-Hosted PaaS Has to Get Right That GitHub's Own Docs Gloss Over
On a git-push PaaS, the webhook endpoint is a remote build trigger — and HMAC verification is its entire security boundary. A 10-point audit checklist covering the raw-body trap, the === timing leak, the timingSafeEqual length-throw, the SHA-1 header ghost, and the replay gap GitHub's docs never assemble into one place.
Backstage's DevLake-to-DORA Plugin Puts a Standard DORA Card on Every Service — Here's What That Means for a Self-Hosted PaaS
A new DevLake-to-DORA backend module puts deployment frequency, lead time, change failure rate, and recovery time on every Backstage service page. Here is how it works, where each number comes from, and how a self-hosted PaaS wires its own deploy API into the card with one webhook and an annotation.
Cilium Becomes the Default Kubernetes CNI Everywhere but AWS: What eBPF Networking Buys a Self-Hosted PaaS on Hetzner
GKE and AKS now run Cilium by default while EKS holds out — here's what eBPF service routing, Hubble flow observability, and identity-based network policy actually buy a self-hosted PaaS on Hetzner bare metal, with the benchmarks, memory costs, and a decision table.
Nine Seconds, Zero Backups: What the PocketOS Wipe Demands From a PaaS That Doesn't Manage Your Database
A Cursor agent deleted PocketOS's production database and every backup in nine seconds. The real failures were architectural: co-located backups and an omnipotent API token. Here is the backup design that survives a rogue agent — and what a PaaS that doesn't manage your database still owes you.
Gateway API v1.5 Moves Gateway Merging to Stable: One Load Balancer, Many Tenant Apps, No Ingress Controller Sprawl
Gateway API v1.5 graduates ListenerSet, letting one platform-owned Gateway and a single load balancer carry every tenant's HTTPS listeners with tenant-owned certificates. The before/after topology, a working YAML example, the Hetzner LB cost math, and the admission work the merged model shifts onto your control plane.