1732 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
Cloud Native Buildpacks Win on CVE Day, Not Day One
A base-image CVE across 17 Dockerfile-based services costs three days of edits, rebuilds, and retests. With one shared buildpack builder, it is a single bump and a rebase — here is the itemized ledger.
Cilium 1.20: Default to Portable Policy, Go Cilium-Native Only Where It Earns It
Cilium 1.20 implements upstream ClusterNetworkPolicy and promotes MCS to stable. A decision table for writing tenant-isolation policy in portable Kubernetes APIs — and the four things that still need Cilium-native rules.
Cilium 1.20 Puts Tenant Auth in the CNI: What ExternalAuth Means for Fleets Still on ingress-nginx
Cilium 1.20 adds the ExternalAuth filter to Gateway API, moving per-route authorization into the CNI you already run. A before/after of tenant auth on ingress-nginx versus HTTPRoute filters, plus an itemized migration bill for fleets facing the retired controller.
Fail Closed Before the Agent Acts: What Conduct's Guard-Before-Every-Tool-Call Model Means for Governing Deploy Agents
Conduct puts a fail-closed policy gate — block, warn, audit, or inject — in front of every MCP and shell action an agent takes. A decision table for deploy, rollback, and secret-read tools, plus which production actions still need a human.
containerd 1.7 Is Dead: The Node-Image Audit Your Fleet Owes Itself Before the Next Kubernetes Upgrade
containerd 1.7 left support in September 2026, and Kubernetes 1.38 drops the kubelet fallback that kept it working. A fifteen-minute audit to find every 1.7 node in your fleet, a table of what the 2.x jump breaks, and the upgrade order that keeps kubelets healthy.
Copy Fail: 4 Bytes in the Page Cache Break Container Isolation on Every Major Distro
A 732-byte script turns an unprivileged user into root on every major distro — and the shared page cache carries the corruption across containers. What stops it, what doesn't, and the patch-and-isolate playbook for your fleet.
Tailscale Co-Founder Says Devtools Must Be Open Source — Why Your PaaS Is Next
Crawshaw's August 2026 essay argues coding agents make personal forks nearly free to maintain — which turns platform source code into the customization surface. A five-surface table shows what agent-patchable infrastructure buys over closed-PaaS hooks, the strongest counter-argument, and where the line settles.
E2B and Daytona Both Charge $0.0504/vCPU-Hour. That's the Managed-Sandbox Anchor Price — Here's the Receipt
E2B and Daytona both price sandboxes at $0.0504/vCPU-hour — identical to four decimals despite different stacks. A bottom-up teardown traces the ~8x multiple over raw hardware to warm pools, orchestration, and margin, and sets the beat-this target for self-hosted fleets.
Dokku Is Still Here After a Decade of Panel Waves: What the Original Single-Box PaaS Says About Coolify's 58K Stars and the Second-Machine Moment
Dokku has shipped since 2013 while Coolify passed 58,000 stars and Dokploy hit 35K — all solving the same first machine. Where single-box tools plateau, and how to graduate to a declarative fleet without a replatform.