Pim Widdershoven

I spent 30 October at Dutch Cloud Native Day in Utrecht, where the theme was Cloud Native in the Age of AI. I take home mostly sovereignty, and a lot of people building flexible, developer-oriented platforms of their own. This post covers the talks that stuck and the hallway conversations.

Standard containers share one kernel with everything else on the node, which is a risk for code that can’t be trusted. This post explains how Kata Containers gives each pod its own kernel, what that costs, and how I use it to run CI pipelines and AI agents in it, sandboxed.

Most teams treat audit evidence as paperwork they assemble after the fact. With GitOps the evidence is a side effect of how you already deploy. This post explains GitOps in plain terms, why a signed and reviewed change history is stronger proof than a ticket, and how to handle the two cases that still break it: emergency changes and drift.

Last Thursday I went to EdgeCase 2026, a Kubernetes conference in Hilversum. This post covers why I went, what I learned about edge computing and clusters without internet access, and the conversations that made the day worth it.

With Talos, Cilium, Linstor, and cert-manager in place, the cluster has infrastructure but no principled way to operate it. This post adds GitOps: FluxCD for the foundation layer where ordering and simplicity matter, ArgoCD for the application layer where a UI and per-project scoping matter more. The bootstrap sequence that hands control from a script to a Git repo, the self-management property that follows, and what GitOps does not tell you about developing against it.