1732 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
The 2026 'PaaS First' Consensus Has a Blind Spot: Who Owns the Machines
Hacker News flipped its default from Kubernetes-first to PaaS-first in 2026 — but the argument for skipping Kubernetes and the argument for handing your infrastructure to a vendor are not the same argument, and most 2026 takes conflate them.
kpack: The Buildpack Controller That Rebuilds When the Base Layer Patches, Not When You Push
Most git-push PaaS tools only rebuild an app image when you push code — so a CVE patched into the base image sits unused until you happen to touch your source again. kpack's Image/Builder/ClusterStack CRDs close that gap by watching the base layer itself.
Kubernetes 1.36 Lets You Resize a Job Before It Starts: The Queue-Then-Resize Pattern a Build Queue Needed
Kubernetes 1.36 lets a queue controller patch a suspended Job's CPU/memory/GPU requests down to whatever's actually free, then unsuspend it, without losing the Job's identity or history. Here's the worked example, the safety guarantee behind it, and how to wire it into a build-queue controller.
Kubernetes 1.36 Ships Sharded Watch — Cluster API's Own Controllers Can't Use It Yet
KEP-5866 lets Kubernetes 1.36 filter watch events at the API server instead of every controller replica. Cluster API's own controllers can't use it yet — here's the architecture gap and what would actually close it.
Your Kubernetes Autoscaler Can't See Your Queue: Building the Exporter That Fixes It
CPU and memory can't see a growing job queue on an I/O-bound worker. Here's the exact Go exporter, Prometheus adapter config, and HPA YAML that lets Kubernetes autoscale on queue depth instead — and what shipping it as a golden path would take on a self-hosted PaaS.
Your Post-Quantum TLS Migration Isn't a Second Certificate Format — It's the Same Freshness Problem You Already Solved for 6-Day Certs
Let's Encrypt is skipping a direct ML-DSA swap for Merkle Tree Certificates because the naive post-quantum handshake blows past 14,700 bytes. Here's the actual byte math, the late-2026 staging timeline, and what a self-hosted PaaS's ACME automation needs to track before production MTCs land in 2027.
From 3 Days to 11 Minutes: What the Widely-Cited MCP Deploy Speedup Stat Actually Measures
The '3 days to 11 minutes' MCP integration stat traces to one unverified blog testimonial, not a benchmark. Here's what it actually measures, and what a fair before/after would require.
MCP's Enterprise Readiness Push: Why Audit Trails and SSO Matter More When Your MCP Server Can Delete a Database
MCP's 2026 roadmap treats audit trails and SSO as a security-review checkbox. For a deploy-authority MCP server, they're what turns an agent's nine-second production wipeout into a reconstructable incident instead of a lost weekend.
Three JavaScript Quirks, One CVSS 10.0 RCE: What n8n's Sandbox-Escape Chain Means for Every Agent Tool Wired to Your Cluster
Three individually-harmless gaps in n8n's JavaScript sandbox chained into a CVSS 10.0 RCE that reached every stored credential and, on shared instances, the Kubernetes cluster underneath. Here's the exploit chain and what it means for any tool that hands an agent a general-purpose sandbox.