01
Necessary Always on
Required for the site to work (login, preferences, security). Always on.
NEWS
ENGINEERING
How we build things — architecture decisions, technical write-ups and lessons from running the platform.
how to build ai agent harness: 3 repositories with different roles
DeepSeek Harness, Anatomy and OpenClaw address different aspects of working with agents. Here is what each repository says and what to ask during a technical evaluation.
3 repos to know: AI at the office, even without the cloud
Three open-source repositories for growing AI inside a small company: one to run it on your own servers, one to search company documents, one to automate processes.
NetBird: hardening a self-hosted WireGuard ZTNA overlay's control plane
NetBird is a self-hostable, WireGuard-based zero-trust network overlay licensed under BSD-3-Clause and AGPLv3. Treat its control plane like production infrastructure.
Hardening Velero backups before ransomware finds them first
Velero remains a common open-source backup and disaster-recovery tool for Kubernetes. Hardening it means encrypted, offsite backups, restricted RBAC and drills that test restores.
SOPS and Sealed Secrets: keep plaintext out of Git for MSP Kubernetes
SOPS encrypts config files before they hit Git; Sealed Secrets encrypts a Kubernetes Secret so only the target cluster can decrypt it. Together they cover the GitOps secrets gap.
Bombini and Oburix: two small eBPF tools worth a lab evaluation
Bombini and Oburix are open-source eBPF security-monitoring agents for Linux. Both are small, active projects worth evaluating under change control, not drop-in EDR replacements.
Harbor: hardening a private container registry into a control plane
goharbor/harbor pairs vulnerability scanning, image signing, RBAC and replication in one open-source registry. Treating it as a production control plane, not just storage, is what actually hardens an MSP's supply chain.
Azure Lighthouse: why an MSP's org is not the same as a tenant
Microsoft's Azure Lighthouse lets an MSP manage many customer tenants from its own tenant without merging directories — a pattern worth knowing before mixing up org and tenant.
Dependency update hygiene for MSPs: from policy to Renovate automation
A practical baseline for closing the gap between a vendor's fix and a fleet running it: an SBOM inventory, a review cadence, staged rollouts, and Renovate to automate the pull request, not the risk decision.
CrowdSec 1.8.1 patches its new bot-detection feature
CrowdSec shipped v1.8.1, fixing a false positive in the bot-detection feature added in 1.8.0 last month. For MSP edges, the useful pattern stays the same: logs in, hub rules out, review before blocking.
Tetragon brings eBPF runtime security in-kernel for cloud-native fleets
Tetragon, the Cilium/CNCF eBPF project, adds Kubernetes-aware runtime observability and in-kernel policy enforcement, giving MSPs detection beyond static scanners.
Authentik: a hardening checklist for self-hosted identity providers
Authentik is an open-source identity provider for OIDC, SAML, LDAP and RADIUS. For MSPs running it themselves, a few hardening steps matter more than any single feature.
Cosign and External Secrets Operator: a Kubernetes supply-chain baseline for MSPs
Sign every container image at build and verify it at deploy with Cosign, then keep credentials out of Git with External Secrets Operator — two controls MSPs can run as one repeatable baseline.
Three open-source EDR projects worth a look: Rustinel, Fibratus, owLSM
Rustinel, Fibratus and owLSM give MSPs free, self-hosted endpoint detection built on Sigma and YARA rules -- useful for labs, not a drop-in replacement for a commercial EDR.
When EU MSPs should route AI traffic open vs. closed
A practical split for EU MSPs deciding when to send bulk AI traffic through an open, observable gateway versus reserving closed, premium APIs for high-stakes work.
How to read an inference benchmark before you believe the price tag
GPU inference claims mix a preview score, a cloud list price and a vendor blog into one number. Here is what to check before treating any $/token figure as fact.
Checkov: catching misconfigured infrastructure code before it merges
Checkov is an open-source policy-as-code scanner that flags Terraform, Kubernetes and CloudFormation misconfigurations before they reach the cloud, in a distinct lane from CVE scanning.
Trivy as a CI gate: scan, fail on severity, ticket the rest
Trivy, Aqua Security's open-source scanner, can gate MSP pipelines: scan every build, fail on high or critical findings, and ticket the rest before promotion.