1732 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
Your Secret Scanner's CI Broke Overnight: Gitleaks' Org License Gate, Porsche's TruffleHog Swap, and What a Git-Push Pipeline Should Standardize On
Gitleaks' GitHub Action now fails org repos without a license key while the CLI stays MIT. Compare the three fixes — license, vendored CLI, or TruffleHog verified mode — with Porsche's ADR-0011 as the worked case study and a pinned baseline for git-push build pipelines.
Render Sleeps, Fly Meters, Railway Floors: One Repo's HOSTING.md as a PaaS Decision Record
OurHike's HOSTING.md priced one backend on Render, Fly.io, and Railway — then reversed itself when its premise expired. A worked read with refreshed October 2026 prices, a floor-vs-meter breakeven, and the missing marginal-cost row for owned hardware.
Your Registry Is a Trust Root: What the JFrog Artifactory Breach Campaign Teaches Self-Hosters
Attackers chained three Artifactory flaws into full admin takeover of self-hosted registries — then planted backdoors that survive patching. The timeline, the kill chain, and a 7-item hardening checklist for your own OCI store.
Kubernetes Rewrote Its Image Promoter and Deleted 20% of It: A 7-Phase Registry Lesson for Self-Hosted PaaS
Kubernetes rewrote kpromo, its registry.k8s.io image promoter, deleting 20% of the code while cutting plan time from 20 minutes to 2 and signature replication from 17 hours to 15 minutes. A close read of the 7-phase pipeline — and what a self-hosted PaaS should copy and skip.
Your TLS Renewals Have an Expiration Date Too: Auditing cert-manager for Let's Encrypt's 45-Day Countdown
Let's Encrypt drops to 45-day certificates by 2028 — run this four-step cert-manager audit on versions, hardcoded renewBefore windows, the ARI gate, and expiry alerting before fixed renewal intervals start breaking.
Kubernetes 1.37 Locks In On-Demand PLEG Relist: What Cost-Sized Nodes Actually Save
Kubernetes 1.37 graduates PLEG on-demand relist to GA, cutting pod-create observation from 1.8s to 1.1s with no opt-out. What the locked-on change saves cost-sized node pools, and a six-step checklist to verify it during your upgrade.
Railway Won the Default for Small Projects in 2026 — Here Are the Edge Cases That Push Growing Teams Off It
Railway won the small-project default with metered pricing, the fastest deploys, and a $5 trial. This inventory names the five edge cases that push growing teams off it — always-on billing, preview costs, ephemeral storage, containerized Postgres, per-seat teams — and works the bill-size threshold where a fixed box wins.
Railway Killed Prepaid Billing. That's Your Migration-Timing Signal.
Railway now requires a post-paid card, ending prepaid credits. A prepaid balance is lock-in; post-paid is month-to-month exit freedom — plus a 5-check migration-timing checklist and a cost anchor for the same workload.
Render Cut Median Builds 40% to 21 Seconds — Can Owned Hardware Match It?
Render cut median service builds from 38 to 21 seconds on faster build nodes. This guide splits the headline into cold/warm and queue/execution cells, cites published 12–15 second warm builds on persistent builders, and prices an owned Hetzner build pool at €97.30/month — with the exact protocol to verify every cell.