Field notes from
the sovereign stack
Page 12

Self-hosted LLM hardware sizing: VRAM math per model size and quantization, consumer vs datacenter GPU economics, and throughput-versus-latency planning.

GitHub self-hosted runners on Kubernetes with actions-runner-controller: ephemeral, autoscaling, network-isolated CI compute you own, without leaving GitHub.

Run a self-hosted LLM for coding: Continue and Tabby wired to an open-weight code model served on vLLM, so your proprietary source code never reaches a vendor.

How a covered entity runs a HIPAA-compliant LLM on-premises: PHI never leaves your perimeter, no third-party BAA to manage, every inference logged for audit.

Kubernetes runtime threat detection with eBPF: Falco for broad MITRE ATT&CK detection, Tetragon for in-kernel enforcement, alerts piped to a self-hosted SIEM.

Own your identity plane: a trust-model decision matrix comparing Keycloak, Authentik, and Zitadel as self-hosted SSO — the engineering exit from Okta.

A self-hosted CI/CD alternative to GitHub Actions: Forgejo for git, Woodpecker for pipelines, Zot for OCI artifacts — the delivery chain as owned infra.

Confidential computing on Kubernetes: AMD SEV-SNP, Intel TDX and Confidential Containers protect data-in-use, with remote attestation gating key release.

Kubernetes disaster recovery you can evidence: Velero and CSI data-mover for volumes, etcd snapshots for cluster state, and restore drills that prove RPO/RTO.