Skip to content
Stribog

§02/OSS-AS-DISCIPLINE

Open source as method

Writing on open source as a discipline — inspectable tooling, supply-chain integrity, contribution fluency, and independence from any single vendor.

12 articles expressing this pillar

Streaming

Self-Managed Kafka: Strimzi, Redpanda, NATS Off Confluent Cloud

A production ops playbook for a self-owned event backbone: Strimzi's Kafka lifecycle on Kubernetes, Redpanda's single binary, and NATS — off Confluent Cloud.

13 min read

Sovereignty

Gaia-X in Practice: Federation, Labels, and the Sovereignty Gap

Gaia-X gives European cloud services a machine-verifiable trust layer — but not control-plane custody, key ownership, or immunity from foreign jurisdiction.

13 min read

Data

Sovereign Lakehouse: ClickHouse, Iceberg, and DuckLake Past Snowflake

Self-hosted ClickHouse vs Snowflake: build a sovereign lakehouse with ClickHouse, Apache Iceberg, and DuckLake for teams past the warehouse cost ceiling.

13 min read

Sovereign AI

Self-Hosted Coding Assistants: Continue, Tabby, and vLLM On-Prem

Run a self-hosted LLM for coding: Continue and Tabby wired to an open-weight code model served on vLLM, so your proprietary source code never reaches a vendor.

15 min read

Security

Catching the Breach in Kernel Time: Falco and Tetragon for Runtime Defense

Kubernetes runtime threat detection with eBPF: Falco for broad MITRE ATT&CK detection, Tetragon for in-kernel enforcement, alerts piped to a self-hosted SIEM.

15 min read

Identity

Self-Hosted SSO in 2026: Keycloak vs Authentik vs Zitadel After Okta

Own your identity plane: a trust-model decision matrix comparing Keycloak, Authentik, and Zitadel as self-hosted SSO — the engineering exit from Okta.

16 min read

CI/CD

Own Your Pipeline: Forgejo, Woodpecker, and Zot as a GitHub Actions Exit

A self-hosted CI/CD GitHub Actions alternative: Forgejo for git, Woodpecker for pipelines, Zot for OCI artifacts — the whole delivery chain as owned infrastructure.

16 min read

Sovereignty

Confidential Computing on Kubernetes in 2026: Protecting Data-in-Use with Hardware TEEs, Remote Attestation, and Confidential Containers

How AMD SEV-SNP, Intel TDX, and Confidential Containers (CoCo/Kata) protect data-in-use on Kubernetes — and how remote attestation gates key release so workloads only run on verified hardware.

17 min read

Storage

After MinIO Goes Dark: Rook/Ceph, SeaweedFS or Garage for Sovereign S3

After MinIO archived its open-source edition: a framework for choosing self-hosted S3-compatible object storage by tenancy, throughput, and jurisdiction.

14 min read

Supply Chain

OSS Supply Chain Security in 2026: From SBOM Generation to Sigstore Signing to Admission Enforcement — a Production Pipeline

A complete guide to building a Kubernetes supply chain security pipeline: SBOM generation with Syft, SLSA L3 provenance via slsa-github-generator, Sigstore keyless signing, and Kyverno admission enforcement.

15 min read

Security

Kubernetes Secrets Management Is Still Broken: ESO + Short-Lived Credentials Over Vault-Everything

Vault is the right backend, not the right interface. ESO + dynamic credentials + etcd encryption eliminate long-lived secrets from Kubernetes clusters.

15 min read

Networking

eBPF and Cilium Are Eating the Service Mesh: What Zero-Trust Kubernetes Networking Looks Like Without Sidecars

How Cilium eBPF delivers zero-trust Kubernetes networking — identity-based policy, WireGuard node-to-node encryption, Hubble observability — without the sidecar complexity tax.

18 min read
All writingSovereignty →Audit-grade rigor →Optionality →The long game →

Executive Briefing

Thirty minutes to clarify your infrastructure risk

Walk us through your vendor footprint and regulatory constraints. We will tell you honestly where sovereignty creates leverage — and where it does not. No pitch deck. No obligation.