Optionality

OpenSearch vs Elasticsearch: both ship Lucene 10.5, the vendor benchmarks disagree, and Elastic's AGPL covers the source, not the releases you actually run.

Katello mirrors move packages across the air gap. Proving the patch SLA is the harder half, and Debian and Ubuntu hosts need their own OVAL feeds.

On premise AI fails on sequencing, not technology. The decision order for the whole stack: workload contract, silicon, serving, partitioning, gateway.

Third party risk management scores control maturity, and the vendor running everything wins on it. DORA template B_07.01 scores substitutability instead.

TISAX and the VDA ISA2027 catalogue define an external IT service as processing outside the audit scope. What that boundary means when you self-host.

How KubeEdge models devices as Kubernetes CRDs, why DMI lets telemetry stay on site, and where the twin's offline guarantees actually stop.

Workflow orchestration you run yourself is a state question, not a geography one — what Temporal's Event History and Airflow 3's metadata database really hold.

Proxmox VE as a VMware exit that keeps the VM as the unit: corosync quorum, the one-minute self-fence, Ceph or ZFS replication, and PBS retention.

vLLM vs Ollama is not a bake-off: Ollama's memory scales with parallel slots, vLLM pages the KV cache. Where the line falls, and how to measure it yourself.

RBI cloud guidelines demand supervisory access and a tested exit, not blanket residency. SEBI's residency duty splits by deployment model. Building for both.

OpenFeature standardises the flag call, not the flag definitions. What actually moves when you swap self-hosted Flagsmith for Unleash, and what does not.

An open source SIEM starts at the kube-apiserver audit log: write a policy that survives production volume, ship it to Wazuh, retain it in jurisdiction.

ElectricSQL syncs reads only, PowerSync owns the offline write queue, Automerge merges with no server authority. Pick the boundary, then self-host it.

Cluster API v1.14 for self-managed fleets: the object model, why ClusterClass is still alpha, delete-first rollouts, and the failure modes that bite.

Kubernetes network policy is asserted from manifests far more often than it is tested. Roll out default-deny safely, then prove enforcement with real traffic.

Distroless base images you build yourself: apko and melange, reproducible builds, signed provenance, and the rebuild cadence that decides build versus buy.

Self-hosted continuous profiling with Pyroscope: the two collection paths, their real privilege cost, the kernel 5.10 floor, and what still needs code.

CCPA compliance as an engineering problem: honouring the GPC opt-out signal at the edge, deletion that survives a backup restore, and a clock you can evidence.

DevPod upstream stopped cutting stable releases in March 2025. Build the self-hosted inner loop on devcontainer.json so the runtime stays replaceable.

ITAR compliance turns on who obtains technical data, not where it sits. Why a sovereign cloud region cannot settle that, and how to build an enclave that does.

What actually runs on AMD ROCm today: Instinct partitioning, the amdgpu driver line, vLLM's documented gaps, and keeping the GPU choice reversible.

QLoRA on your own GPUs: quota-admitted training Jobs, adapters as registry artifacts, multi-LoRA vLLM serving, and the EU AI Act compute arithmetic.

KubeVirt runs the VMs you cannot containerise on your own metal. Live migration, RWX disks, CPU pinning, and what it still does worse than vSphere.

Cloud vendor lock-in is a liability you can compute: egress bytes times price, proprietary API surface, data gravity, retraining. Here is the ledger.

The documented Vault-to-OpenBao path stops at Vault 1.14.x, Raft storage and Shamir unseal. Three gates decide which route your cluster is actually on.

Migrating to OpenTofu past the licence debate: how state provider addresses translate, why lock-file hashes do not carry over, and how to mirror the registry.

GDPR compliance at the infrastructure layer: encryption, pseudonymisation, provable restore, and erasure across backups, logs and vector stores.

MeitY empanelment certifies the provider, not your product. Workload classification, STQC audit access and exit clauses, mapped to real architecture.

A self-hosted container registry you actually operate: Harbor versus zot, proxy cache and replication for air-gapped delivery, and the disk arithmetic.

A Kubernetes version upgrade strategy: skew windows as scheduling constraints, deprecated API scans that hold up, sequential minors, and exit ramps.

ISO 27001 compliance on infrastructure you run: how to scope the ISMS, write a Statement of Applicability, and evidence Annex A 8.9, 8.16, 8.13 and 5.23.

SOC 2 compliance on self-hosted Kubernetes: what carve-out really means, which Trust Services Criteria you must evidence yourself, and how to prove it.

Running WebAssembly on Kubernetes: the runwasi shim, SpinKube and wasmCloud, the honest limits, and why Wasm is the exit ramp from proprietary serverless.

Replacing the Tailscale coordination plane with self-hosted Headscale or NetBird: Kubernetes subnet routers, owned exit nodes, failure modes and the exit ramp.

Choosing a self-hosted block storage layer for Kubernetes CSI: Rook/Ceph RBD vs Longhorn vs OpenEBS Mayastor, with hardware numbers and the exit ramp.

Choosing and operating a self-hosted vector database for on-premises RAG: Qdrant vs pgvector vs Weaviate, HNSW tuning, quantization, and the exit ramp.

Operate K3s edge clusters over intermittent WAN with pull-based Rancher Fleet GitOps, air-gapped image delivery, per-site overlays, and offline reconciliation.

KEDA event-driven autoscaling on Kubernetes scales pods to zero on queue depth; the descheduler bin-packs survivors to reclaim bare-metal nodes — no Karpenter.

Run a Kubernetes bare-metal load balancer without a cloud provider — MetalLB BGP, kube-vip control-plane VIP, and Envoy Gateway API, exiting Cloudflare's proxy.

Namespace-level Kubernetes cost allocation with OpenCost: run showback and graduate to chargeback on bare-metal clusters where no cloud billing API exists.

Run a self-hosted certificate authority for internal Kubernetes names: step-ca as a private ACME server, cert-manager as the client, no CT-log leakage.

A production ops playbook for a self-owned event backbone: Strimzi's Kafka lifecycle on Kubernetes, Redpanda's single binary, and NATS — off Confluent Cloud.

MIG gives hard, isolated GPU partitions; time-slicing shares one context with none; DRA makes fractional GPU scheduling a first-class Kubernetes primitive.

Model residency is not agent residency. A self-hosted MCP gateway and LiteLLM proxy keep tool-calls, keys, and PII inside your own network boundary.

Schrems II turns six today. The EU-US Data Privacy Framework is under fresh challenge, and CLOUD Act reach means US-parent clouds remain a live transfer risk.

European sovereign cloud is three options, not one: hyperscaler region, EU-incorporated provider, or self-host — scored on control, jurisdiction, lock-in, cost.

Gaia-X gives European cloud services a machine-verifiable trust layer — but not control-plane custody, key ownership, or immunity from foreign jurisdiction.

Operationalizing the DPDPA: a consent flow, data-principal access and verifiable erasure across your stores, and a breach workflow on the DPB's clock.

The engineering read of India's DPDP Act 2023: data fiduciary duties, cross-border transfer, and the Significant Data Fiduciary tier as infrastructure.

The EU AI Act's high-risk obligations — Article 12 logging, conformity assessment, post-market monitoring — mapped onto on-prem inference infrastructure.

Bare metal Kubernetes provisioning compared: Tinkerbell's workflow engine, Metal3's Cluster API/Ironic path, and Sidero Omni's post-CAPI machine model.

Kubernetes hard multi-tenancy without cluster sprawl: when namespaces suffice, where Capsule and vCluster fit, and how node isolation makes tenancy real.

Self-hosted ClickHouse vs Snowflake: build a sovereign lakehouse with ClickHouse, Apache Iceberg, and DuckLake for teams past the warehouse cost ceiling.

Self-hosted LLM hardware sizing: VRAM math per model size and quantization, consumer vs datacenter GPU economics, and throughput-versus-latency planning.

GitHub self-hosted runners on Kubernetes with actions-runner-controller: ephemeral, autoscaling, network-isolated CI compute you own, without leaving GitHub.

Run a self-hosted LLM for coding: Continue and Tabby wired to an open-weight code model served on vLLM, so your proprietary source code never reaches a vendor.

How a covered entity runs a HIPAA-compliant LLM on-premises: PHI never leaves your perimeter, no third-party BAA to manage, every inference logged for audit.

Own your identity plane: a trust-model decision matrix comparing Keycloak, Authentik, and Zitadel as self-hosted SSO — the engineering exit from Okta.

A self-hosted CI/CD alternative to GitHub Actions: Forgejo for git, Woodpecker for pipelines, Zot for OCI artifacts — the delivery chain as owned infra.

SPIFFE/SPIRE issues cryptographic, attested workload identity — X.509 and JWT SVIDs — so Kubernetes services get mutual TLS and zero long-lived static secrets.

MinIO archived its open-source edition. Choosing its replacement — Rook/Ceph, SeaweedFS or Garage — by tenancy, throughput and jurisdiction, not by benchmark.

Production PostgreSQL on Kubernetes with CloudNativePG: streaming-replication HA, WAL archiving and PITR to your own object store, and a clean exit from RDS.

The EU AI Act, NIS2, and DORA are one architecture constraint, not three checklists — the technical evidence for why hyperscaler SaaS cannot satisfy them.

The Grafana stack — OpenTelemetry, Prometheus, Loki, Tempo — against Datadog and Elasticsearch: sovereign telemetry on Kubernetes with no per-GB ingestion bill.

Progressive delivery on Kubernetes with Argo Rollouts: metric-driven AnalysisRuns, automatic rollback, Gateway API traffic shaping, audit-grade promotion.

A no-hype cloud repatriation playbook for Kubernetes: dependency audit, stateful workload triage, a real TCO model, and why most attempts fail inside 18 months.

How to run self-hosted LLM inference on Kubernetes with vLLM at production grade: GPU sizing, cost crossover analysis, audit logging for EU AI Act compliance.

Multi-cluster GitOps past 20 clusters: where Argo CD's hub saturates, where Flux shifts that cost onto your Git origin, and the load model to find your ceiling.