Kubernetes User Namespaces and Pod Hardening: Containing Container Escapes in 2026
Kubernetes user namespaces explained with pod hardening: UID mapping, hostUsers false, seccomp, AppArmor, RuntimeClass sandboxes and Pod Security.
Ingress-NGINX Retirement: A Step-by-Step Migration Playbook to Kubernetes Gateway API
Ingress-NGINX retirement explained with a step-by-step migration playbook to Kubernetes Gateway API: annotation mapping, ingress2gateway, controller.
SLOs and Error Budgets for IoT Platforms: Burn-Rate Alerting with OpenSLO and Sloth
Define SLIs, SLOs and error budgets for IoT platforms: freshness and latency SLIs, multi-window burn-rate alerts with OpenSLO and Sloth.
Velero 1.18 Kubernetes Backup and Disaster Recovery: Velero vs Kasten vs CloudCasa
Kubernetes backup and disaster recovery with Velero 1.18: CSI snapshots, data movers, restore ordering, RPO and RTO, and Velero vs Kasten vs CloudCasa.
Kepler 0.12: Kubernetes Pod Energy and Carbon Metrics Including GPU MIG Power Attribution
How Kepler estimates per-pod energy in Kubernetes, what changed in 0.12 including GPU MIG attribution, and where its carbon metrics can mislead.
Falco 0.45 vs Tetragon vs Tracee: Kubernetes Runtime Threat Detection with eBPF
Falco 0.45 vs Tetragon vs Tracee for Kubernetes runtime threat detection: eBPF drivers, rule languages, alert routing and a production rollout plan.
etcd 3.7 Explained: Raft Consensus, Kubernetes Control Plane Impact and Upgrade Guide
etcd 3.7 explained: Raft and MVCC mechanics, what changed for Kubernetes control planes, plus a safe backup, defrag and rolling upgrade runbook.
Container Runtime Security Hardening in 2026: containerd 2.3, CRI-O and Podman 6 CVE Response
Harden container runtimes after the Sept 2026 containerd and Podman CVEs: rootless mode, seccomp, user namespaces and a patch-rollout runbook.
Istio 1.31 Explained: What Changed and How to Upgrade Your Service Mesh
Istio 1.31 explained: ambient mesh changes, deprecations and upgrade notes, plus a safe revision-based canary upgrade plan for sidecar or ambient mode.
Rust in the Linux Kernel Goes Mainstream: What It Means for Embedded and IoT Drivers
Rust is no longer experimental in the Linux kernel. What changed, how Rust drivers work, and what embedded and IoT teams should do about out-of-tree.