1732 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
Your IdP Doesn't Speak MCP Auth Yet: The Shim, the iss Hack, and the Trust Math
mcp-auth-adapter fronts Keycloak, Auth0, or Okta with the MCP 2026-07-28 auth dialect — iss interception, DCR, and client-credentials passthrough. Here is what the shim rewrites, what signed tokens keep out of reach, and the trust math of running it in front of a deploy server.
Two Weeks, Two Launches, One New Layer: What Tuskira's Open Gateway and Radware's MCP Protection Actually Cover
Tuskira open-sourced its AI Agent Gateway on October 1 and Radware announced MCP Server Protection on October 14, days after OX Security audited 15,465 MCP servers and found zero governance. A coverage map of what the new MCP security layer actually handles — credential vaulting, tool-call audit, server visibility — versus the scoping and approval work only you can do, plus a buy-or-build decision for a small self-hosted surface.
Your Secrets Were Never in the Logs: How Mini Shai-Hulud Read Them Out of Runner Memory
In six minutes on May 11, 2026, a worm published 84 malicious TanStack versions with valid SLSA provenance by reading CI secrets straight out of runner process memory. This teardown walks the three-link chain — Pwn Request, cache poisoning, /proc/mem scraping — maps every defense it bypassed, and lays out the secret-injection model build farms need now.
Off Vercel Hobby: Where Your Indie SaaS Goes When 'Free' Stops Covering a Business
Vercel's free Hobby plan bans commercial use, and 2026's free-tier map offers no refuge — so here is the migration playbook: the monthly math across Vercel Pro, Railway, Fly.io, Render, and a seven-dollar Hetzner box, plus what ISR, edge functions, and preview URLs map to off the edge.
No More Stringly-Typed Deploys: What pikpik's Four Invariants Say About Coolify, Dokploy, and CapRover Reliability
Dokploy fixed five shell-injection RCEs in one release — the sharpest proof of pikpik's 'zero shelling' invariant. This audit ranks all four invariants against the public CVE and issue record of Coolify, Dokploy, and CapRover, and shows why a PaaS built on typed Kubernetes manifests inherits the whole bar by construction.
Stop Handing Agents the CI Token: A Blueprint for Agent Identity, Budgets, and Approvals on the Git-Push Golden Path
Run-scoped agent identity, per-environment budgets, approval-gated deploys, and policy-linked audit records: a buildable four-lane blueprint for letting AI agents operate a self-hosted PaaS without handing them the CI token.
Railway Sandboxes vs Fly Sprites (2026): What Hosted Agent Isolation Costs — and the Apache-2.0 Alternative
Railway's disposable project sandboxes vs Fly's persistent Sprite computers: the isolation tech, per-hour rates, and a worked breakeven showing when a ~$0.32–0.42 active hour loses to a €6 owned sandbox slot — plus the Apache-2.0 stack that reproduces both on your own hardware.
Railway's $150 Self-Host Crossover, Recomputed for a Fleet You Own
A September 2026 guide puts Railway's self-host crossover near $150 a month against a single VPS — recomputed here against a three-node Hetzner fleet, where flat hardware and bin-packing move break-even to about $30, with per-shape crossovers for always-on APIs, preview PRs, and idle side projects.
The Bandwidth Row Is the Bill: Railway's $50/TB Egress vs Hetzner's €1
Railway charges $50/TB for egress against Hetzner's €1 — a worked bill showing the ~200 GB/mo threshold where bandwidth alone costs more than a whole flat-rate box.