1732 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
Surviving a Full Hetzner Datacenter Outage: What 3-DC k0s HA Really Costs Versus Single-DC
A 3-datacenter k0s cluster on Hetzner survives a full DC outage for about $103/mo in servers and $0 in extra traffic — but every etcd write pays ~25ms and a third of worker capacity must sit idle. Here is the layer-by-layer HA design, the verified cost math, and when single-DC plus backups wins instead.
Your Dockerfile Cache Is Blind to Your Monorepo: What Build-Graph Caching Adds to a Git-Push PaaS Pipeline
A one-line monorepo change costs about 11 builder-minutes under Docker layer caching versus 4 with Turborepo/Bazel remote cache hits — the worked time-and-cost math, the September 2026 Namespace/Depot/Blacksmith landscape, and when a git-push PaaS should offer graph-aware caching natively.
Node 26 Hits Active LTS on October 28: A Builder Checklist for Git-Push PaaS Teams
Node.js 26 becomes Active LTS on October 28, 2026 — with Yarn v1 and Corepack gone from builder images and six tenant-facing breakages to triage. A dated checklist for git-push PaaS operators covering default-flip timing, EOL warnings, and the annual cadence that starts with Node 27.
The npm Worm With Valid Provenance: What ChainDrop's 400 Poisoned Packages Mean for Anyone Building Tenant Images
ChainDrop poisoned 400+ npm packages with valid SLSA provenance after the keyv maintainer's GitHub account was compromised. Here is what provenance-only trust breaks and the five build-pipeline controls every tenant-image builder needs.
Open-Weight AI Is Having Its Kubernetes Moment — Here's What Your Fleet Needs to Serve It
Open-weight models are becoming the default infrastructure layer for AI. This post maps the standardized Kubernetes inference stack — OCI weights, DRA, InferencePool, KServe, llm-d — and shows what a self-hosted fleet needs to serve models next to tenant apps.
OpenAI Built Codex a Windows Sandbox Out of SIDs and Firewall Rules: What It Teaches a Linux-First PaaS About Isolating Agent Code
OpenAI's May 2026 write-up shows how Codex sandboxes agent commands on Windows with synthetic SIDs, write-restricted tokens, dedicated sandbox users, and firewall rules — here is the two-tier design, the three isolation lessons a Linux-first PaaS should take from it, and an explicit verdict on whether it needs a Windows tier.
Oracle Halved Its Free ARM Cloud. Here's the $0-vs-$5 Kubernetes Math Now.
Oracle cut its Always Free Ampere allowance from 4 OCPUs/24GB to 2/12 in June 2026 and started terminating over-limit instances in August. A worked comparison of the most always-on Kubernetes still available for $0 versus a flat ~$5 Hetzner box, with the reclaim, capacity, and grandfathering catches priced in.
A Full PaaS on One $11 ARM Server: What Real CAX21 Usage Data Says About Tenant Capacity
A measured teardown of a full multi-tenant PaaS on a €10.99 Hetzner CAX21 ARM server: per-component RAM tables, per-tier tenant footprints, and the 10–25 tenant capacity the numbers support — plus the scaling ladder to €33 and ~€200.
Pangolin Puts SSO and WireGuard in Front of LLM Access Instead of API Keys: What Tunnel-Based Identity Means for Agent Credential Hygiene
Pangolin's AI Gateway authenticates LLM access with SSO-backed WireGuard tunnels instead of static API keys, and joins self-hosted models to the same gateway as public ones. Here's how the mechanism works, how it compares to Tailscale Aperture, and what it changes in your threat model.