1732 posts tagged with "Self-Hosting"
Running your own PaaS and infrastructure on machines you own
MCP Won the Protocol War — the Lock-In Just Moved Up a Layer: A Self-Hoster's Field Test
MCP became the universal agent interface — and the lock-in moved into security policies, drift detection, and Skills libraries. A hands-on field test shows which moats self-hosting defeats and which one follows you home.
MCP Streamable HTTP in Production: When Stateless Tool Calls Scale Cleanly and When a Deploy Agent Needs Session Affinity
AWS's FastMCP-on-ECS reference runs MCP servers stateless so any replica can answer any tool call, and the July 2026 spec revision deleted protocol-level sessions entirely. Here is that verdict mapped onto a deploy/rollback agent: which tools stay stateless, where multi-step state lives instead, and how idempotency keys keep privileged infrastructure actions safe across retries.
MCP Tasks and Multi-Round Trips: The Durable Deploy Contract an Agent-Operated PaaS Needs
MCP's July 2026 spec adds asynchronous Tasks and Multi-Round Trip Requests. Together they form a durable deploy state machine: task handles instead of blocked calls, an approval boundary before production promotion, safe retry, cooperative cancel, and rollback as a first-class task.
Microsoft Agent 365 Goes GA and Starts Auto-Discovering the MCP Servers Nobody Registered
Microsoft's Agent 365 platform went GA on May 1, 2026 with Shadow AI Discovery that surfaces unmanaged MCP servers through Defender and Intune. Here are the five governance controls it ships — and what a self-hosted PaaS must build itself, since Microsoft's discovery cannot see its fleet.
Northflank Ranked 6 Railway Alternatives — I Priced the Same App on All of Them
Northflank's June 2026 roundup ranked six Railway alternatives on credit-free uptime, visibility, and BYOC. Pricing the same always-on workload on all six runs from ~$77 on Railway to ~€12 on owned hardware — and the BYOC control-plane meter is the number that matters.
The Worst Three Months in npm History: What Your Build Layer Needs When the Registry Can't Be Trusted
Between March and June 2026, Axios, node-ipc, Red Hat's npm namespace, and the Mastra framework were all compromised — each defeating a different defense. A concrete accounting of all four attacks and the five build-layer controls that survive them: frozen lockfiles, disabled install scripts, DNS-aware egress sandboxing, honest provenance, and per-build SBOMs.
Nvidia Runs OpenBao in Production: The Vault Fork's Enterprise Moment, and How to Wire It Into Kubernetes
NVIDIA runs its serverless GPU platform's secrets on OpenBao, eight vendors now sell commercial support, and v2.6 added per-namespace sealing — why the Vault fork is now safe to bet a self-hosted platform on, and how to wire it into Kubernetes with the External Secrets Operator.
The OpenClaw Operator's Default-Deny Baseline: What One CRD Can (and Cannot) Contain
The OpenClaw Kubernetes operator packs non-root pods, dropped capabilities, and a default-deny NetworkPolicy into one install — a solid floor for running AI agents in-cluster. But Pod hardening stops at the process boundary: prompt injection, over-broad MCP credentials, and destructive-tool authorization need a governance layer no CRD provides.
One PaaS API on k3s and EKS: What Ownkube's Dual Substrates Really Cost vs Owning One Cluster API Fleet
Ownkube runs one PaaS API on k3s and EKS. We price both shapes against a single-substrate Cluster API fleet on Hetzner, name every seam the shared API hides, and give a rule for picking.