1732 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
Kubernetes v1.37 Finally Lets You noexec a Volume Mount: Closing the 9-Year-Old Hole in readOnlyRootFilesystem
Kubernetes v1.37 adds alpha bindMountOptions and emptyDir mode fields that finally let operators mount volumes noexec and stop emptyDir from defaulting to 0777. What the two knobs block, and the gate rollout checklist for multi-tenant fleets.
Kubernetes 1.37 Scales HPA Workloads to Zero (Beta): What It Replaces in Your Idle-Reaping Playbook — and What It Doesn't
Kubernetes 1.37 graduates HPA scale-to-zero to beta with one line — minReplicas: 0. Queue consumers can drop the bespoke idle-reaper, but HTTP services still need Knative-style request buffering, and four policy gaps stay on the platform.
An AI Agent Found a WireGuard Bug in GKE: A Blueprint for Agent-Led Triage on Your Own Fleet
Lovable's agent surfaced a crash-looping GKE networking daemon buried in millions of log lines; humans did everything after. The honest agent-vs-human split from that incident, plus a trust-boundary matrix for giving a triage agent read-only cluster access on your own fleet.
What the MCP 2026-07-28 Spec Broke: Your Server's Auth Fix Checklist
The MCP 2026-07-28 spec turned every remote server into a formal OAuth 2.1 resource server, and working servers now fail closed. Here is the six-item fix checklist: metadata endpoint, 401 pointer, audience enforcement, issuer validation, and the DCR-to-CIMD plan.
MCP Went Stateless: What the 2026-07-28 Rewrite Changes for Self-Hosting Agent Tool Servers
MCP's July 2026 spec revision deletes sessions, the initialize handshake, and sticky-routing requirements. A before/after guide to what self-hosted agent tool servers can delete, what replaces sessions, and how to migrate.
12,520 Exposed MCP Servers: A 7-Point Auth Checklist for Shipping a Deploy-Capable MCP Server
Censys found 12,520 MCP servers on the public internet and independent studies put 40% of remote servers at no authentication at all. Here is the seven-default auth checklist that keeps a deploy-capable MCP server out of the next scan.
Microsoft's Document Database Rides CloudNativePG: What That Verdict Means for Your Fleet's Postgres Layer
Microsoft's DocumentDB Kubernetes operator creates CNPG Cluster resources instead of reimplementing HA and backups, injecting its gateway through a CNPG-I plugin. What that architecture proves about standardizing a self-hosted fleet's Postgres layer — and the honest cases for not doing it.
Mooring: a Security-First PaaS in One Binary — and What Breaks When You Need a Second Server
Mooring packs a secure-by-default PaaS into one 12 MB binary — no Swarm, no Kubernetes. This capability-by-capability comparison with Coolify, Dokploy, and Cluster API fleets shows exactly what breaks when one server stops being enough.
One Sponsor Pulled the Plug and Paketo Had Two Weeks to Move Registries: The Buildpack Bus-Factor Problem
When Paketo's GCP sponsor pulled funding, the project had about two weeks to move every image off GCR. This post audits what a build pipeline really inherits from its builder, prices the four responses — trust, mirror, vendor, or switch — and gives platform teams a five-step checklist before the next forced migration.