Sovereignty

A data processing agreement allocates obligations your stack must then meet: AWS and Google resolve the right to object into leaving, not refusing.

OpenSearch vs Elasticsearch: both ship Lucene 10.5, the vendor benchmarks disagree, and Elastic's AGPL covers the source, not the releases you actually run.

A PCI DSS compliance audit validates a scope you documented yourself. What the ROC template asks for, who picks SAQ D, and where tokenisation truly helps.

Katello mirrors move packages across the air gap. Proving the patch SLA is the harder half, and Debian and Ubuntu hosts need their own OVAL feeds.

On premise AI fails on sequencing, not technology. The decision order for the whole stack: workload contract, silicon, serving, partitioning, gateway.

Third party risk management scores control maturity, and the vendor running everything wins on it. DORA template B_07.01 scores substitutability instead.

TISAX and the VDA ISA2027 catalogue define an external IT service as processing outside the audit scope. What that boundary means when you self-host.

How KubeEdge models devices as Kubernetes CRDs, why DMI lets telemetry stay on site, and where the twin's offline guarantees actually stop.

Workflow orchestration you run yourself is a state question, not a geography one — what Temporal's Event History and Airflow 3's metadata database really hold.

NIST CSF 2.0 moves supply chain into Govern as GV.SC — ten outcomes, up from five. Building a Current and Target Profile for an estate you run yourself.

Proxmox VE as a VMware exit that keeps the VM as the unit: corosync quorum, the one-minute self-fence, Ceph or ZFS replication, and PBS retention.

NIST SP 800-53 Release 5.2.0 on self-hosted Kubernetes: which controls stop being inheritable, which get cheaper to evidence, and an error in NIST's OSCAL.

vLLM vs Ollama is not a bake-off: Ollama's memory scales with parallel slots, vLLM pages the KV cache. Where the line falls, and how to measure it yourself.

ISO/IEC 42001 clause titles that your inference stack can answer with artefacts — audit records, model signatures, telemetry — and where a certificate stops.

RBI cloud guidelines demand supervisory access and a tested exit, not blanket residency. SEBI's residency duty splits by deployment model. Building for both.

OpenFeature standardises the flag call, not the flag definitions. What actually moves when you swap self-hosted Flagsmith for Unleash, and what does not.

An open source SIEM starts at the kube-apiserver audit log: write a policy that survives production volume, ship it to Wazuh, retain it in jurisdiction.

ElectricSQL syncs reads only, PowerSync owns the offline write queue, Automerge merges with no server authority. Pick the boundary, then self-host it.

Cluster API v1.14 for self-managed fleets: the object model, why ClusterClass is still alpha, delete-first rollouts, and the failure modes that bite.

Kubernetes network policy is asserted from manifests far more often than it is tested. Roll out default-deny safely, then prove enforcement with real traffic.

Distroless base images you build yourself: apko and melange, reproducible builds, signed provenance, and the rebuild cadence that decides build versus buy.

An immutable backup is not a bucket flag: S3 Object Lock on storage you run, the credential split that makes it real, and restore drills that leave evidence.

Self-hosted continuous profiling with Pyroscope: the two collection paths, their real privilege cost, the kernel 5.10 floor, and what still needs code.

CCPA compliance as an engineering problem: honouring the GPC opt-out signal at the edge, deletion that survives a backup restore, and a clock you can evidence.

DevPod upstream stopped cutting stable releases in March 2025. Build the self-hosted inner loop on devcontainer.json so the runtime stays replaceable.

ITAR compliance turns on who obtains technical data, not where it sits. Why a sovereign cloud region cannot settle that, and how to build an enclave that does.

CERT-In and EU MiFIR both mandate synchronised clocks. Run traceable time with chrony, PTP and a stratum-1 you own — then prove the error bound afterwards.

What actually runs on AMD ROCm today: Instinct partitioning, the amdgpu driver line, vLLM's documented gaps, and keeping the GPU choice reversible.

QLoRA on your own GPUs: quota-admitted training Jobs, adapters as registry artifacts, multi-LoRA vLLM serving, and the EU AI Act compute arithmetic.

KubeVirt runs the VMs you cannot containerise on your own metal. Live migration, RWX disks, CPU pinning, and what it still does worse than vSphere.

Cloud vendor lock-in is a liability you can compute: egress bytes times price, proprietary API surface, data gravity, retraining. Here is the ledger.

The documented Vault-to-OpenBao path stops at Vault 1.14.x, Raft storage and Shamir unseal. Three gates decide which route your cluster is actually on.

Cyber Resilience Act reporting starts 11 September 2026. Map manufacturer and open-source steward obligations onto a self-hosted build pipeline.

GDPR compliance at the infrastructure layer: encryption, pseudonymisation, provable restore, and erasure across backups, logs and vector stores.

MeitY empanelment certifies the provider, not your product. Workload classification, STQC audit access and exit clauses, mapped to real architecture.

A self-hosted container registry you actually operate: Harbor versus zot, proxy cache and replication for air-gapped delivery, and the disk arithmetic.

ISO 27001 compliance on infrastructure you run: how to scope the ISMS, write a Statement of Applicability, and evidence Annex A 8.9, 8.16, 8.13 and 5.23.

An audit of 49 live articles. Stage-1 mechanical checks found zero blockers; independent review verified 342 defects. Method, failures, residual risk.

SOC 2 compliance on self-hosted Kubernetes: what carve-out really means, which Trust Services Criteria you must evidence yourself, and how to prove it.

DORA's five pillars mapped to self-hosted controls — ICT third-party risk, the 4h/72h incident clock, resilience testing, and exits you have rehearsed.

Running WebAssembly on Kubernetes: the runwasi shim, SpinKube and wasmCloud, the honest limits, and why Wasm is the exit ramp from proprietary serverless.

Replacing the Tailscale coordination plane with self-hosted Headscale or NetBird: Kubernetes subnet routers, owned exit nodes, failure modes and the exit ramp.

Choosing a self-hosted block storage layer for Kubernetes CSI: Rook/Ceph RBD vs Longhorn vs OpenEBS Mayastor, with hardware numbers and the exit ramp.

Choosing and operating a self-hosted vector database for on-premises RAG: Qdrant vs pgvector vs Weaviate, HNSW tuning, quantization, and the exit ramp.

Operate K3s edge clusters over intermittent WAN with pull-based Rancher Fleet GitOps, air-gapped image delivery, per-site overlays, and offline reconciliation.

KEDA event-driven autoscaling on Kubernetes scales pods to zero on queue depth; the descheduler bin-packs survivors to reclaim bare-metal nodes — no Karpenter.

Run a Kubernetes bare-metal load balancer without a cloud provider — MetalLB BGP, kube-vip control-plane VIP, and Envoy Gateway API, exiting Cloudflare's proxy.

Run a self-hosted certificate authority for internal Kubernetes names: step-ca as a private ACME server, cert-manager as the client, no CT-log leakage.

A production ops playbook for a self-owned event backbone: Strimzi's Kafka lifecycle on Kubernetes, Redpanda's single binary, and NATS — off Confluent Cloud.

MIG gives hard, isolated GPU partitions; time-slicing shares one context with none; DRA makes fractional GPU scheduling a first-class Kubernetes primitive.

Model residency is not agent residency. A self-hosted MCP gateway and LiteLLM proxy keep tool-calls, keys, and PII inside your own network boundary.

Schrems II turns six today. The EU-US Data Privacy Framework is under fresh challenge, and CLOUD Act reach means US-parent clouds remain a live transfer risk.

European sovereign cloud is three options, not one: hyperscaler region, EU-incorporated provider, or self-host — scored on control, jurisdiction, lock-in, cost.

Digital sovereignty is not a slogan but five engineering control layers — compute, data, keys, identity, supply chain — each mapped to a testable control.

Gaia-X gives European cloud services a machine-verifiable trust layer — but not control-plane custody, key ownership, or immunity from foreign jurisdiction.

Operationalizing the DPDPA: a consent flow, data-principal access and verifiable erasure across your stores, and a breach workflow on the DPB's clock.

CERT-In's 2022 Directions as engineering constraints: six-hour incident reporting, a rolling 180-day log-retention floor, and a synced NIC/NPL time source.

The engineering read of India's DPDP Act 2023: data fiduciary duties, cross-border transfer, and the Significant Data Fiduciary tier as infrastructure.

The EU AI Act's high-risk obligations — Article 12 logging, conformity assessment, post-market monitoring — mapped onto on-prem inference infrastructure.

Bare metal Kubernetes provisioning compared: Tinkerbell's workflow engine, Metal3's Cluster API/Ironic path, and Sidero Omni's post-CAPI machine model.

Kubernetes hard multi-tenancy without cluster sprawl: when namespaces suffice, where Capsule and vCluster fit, and how node isolation makes tenancy real.

Self-hosted ClickHouse vs Snowflake: build a sovereign lakehouse with ClickHouse, Apache Iceberg, and DuckLake for teams past the warehouse cost ceiling.

Self-hosted LLM hardware sizing: VRAM math per model size and quantization, consumer vs datacenter GPU economics, and throughput-versus-latency planning.

GitHub self-hosted runners on Kubernetes with actions-runner-controller: ephemeral, autoscaling, network-isolated CI compute you own, without leaving GitHub.

Run a self-hosted LLM for coding: Continue and Tabby wired to an open-weight code model served on vLLM, so your proprietary source code never reaches a vendor.

How a covered entity runs a HIPAA-compliant LLM on-premises: PHI never leaves your perimeter, no third-party BAA to manage, every inference logged for audit.

Kubernetes runtime threat detection with eBPF: Falco for broad MITRE ATT&CK detection, Tetragon for in-kernel enforcement, alerts piped to a self-hosted SIEM.

Own your identity plane: a trust-model decision matrix comparing Keycloak, Authentik, and Zitadel as self-hosted SSO — the engineering exit from Okta.

A self-hosted CI/CD alternative to GitHub Actions: Forgejo for git, Woodpecker for pipelines, Zot for OCI artifacts — the delivery chain as owned infra.

SPIFFE/SPIRE issues cryptographic, attested workload identity — X.509 and JWT SVIDs — so Kubernetes services get mutual TLS and zero long-lived static secrets.

MinIO archived its open-source edition. Choosing its replacement — Rook/Ceph, SeaweedFS or Garage — by tenancy, throughput and jurisdiction, not by benchmark.

Production PostgreSQL on Kubernetes with CloudNativePG: streaming-replication HA, WAL archiving and PITR to your own object store, and a clean exit from RDS.

Kubernetes disaster recovery you can evidence: Velero and CSI data-mover for volumes, etcd snapshots for cluster state, and restore drills that prove RPO/RTO.

Confidential computing on Kubernetes: AMD SEV-SNP, Intel TDX and Confidential Containers protect data-in-use, with remote attestation gating key release.

The EU AI Act, NIS2, and DORA are one architecture constraint, not three checklists — the technical evidence for why hyperscaler SaaS cannot satisfy them.

Talos Linux vs Ubuntu for Kubernetes security: an immutable, API-only node ships almost no userspace to carry CVEs, and hardening Ubuntu cannot close that gap.

The Grafana stack — OpenTelemetry, Prometheus, Loki, Tempo — against Datadog and Elasticsearch: sovereign telemetry on Kubernetes with no per-GB ingestion bill.

A no-hype cloud repatriation playbook for Kubernetes: dependency audit, stateful workload triage, a real TCO model, and why most attempts fail inside 18 months.

How to run self-hosted LLM inference on Kubernetes with vLLM at production grade: GPU sizing, cost crossover analysis, audit logging for EU AI Act compliance.

Multi-cluster GitOps past 20 clusters: where Argo CD's hub saturates, where Flux shifts that cost onto your Git origin, and the load model to find your ceiling.

Vault is the right backend, not the right interface. ESO + dynamic credentials + etcd encryption eliminate long-lived secrets from Kubernetes clusters.

Cilium against Calico for zero-trust Kubernetes networking: identity-based policy, WireGuard node encryption and Hubble visibility, without the sidecar tax.

Platform engineering on Kubernetes: golden paths without admission enforcement are only suggestions. How to make the golden path the only path that works.