Yar Kravtsov
Builds Stagely. Riga, Latvia.
Registry tokens that cannot push
How the Stagely customer agent gives machines short-lived registry credentials for each job, why stagelet machines only pull, and where Hetzner Cloud differs.
Reset a stagelet without its source
How a reset puts a stagelet back to its last successful deploy, with the same images by digest and the same config, on a machine that never gets the source.
When cloud firewalls skip the private network
Hetzner Cloud and Vultr firewalls do not filter private networks. See how each Stagely machine adds iptables rules at boot to keep stagelets apart.
One OAuth server, two audiences: MCP and CLI
Coding agents and the stagely CLI sign in through one OAuth server. Each grant works at one resource, so an agent's token cannot manage members or billing.
Keep containers away from cloud metadata
Stagely runs pull request code in containers on machines in your cloud. See how it keeps those containers away from the metadata service on six clouds.
Plan a deploy without git clone
Stagely plans each stagelet deploy from a few files that it reads through the GitHub API at one commit. The control plane never runs git on your repository.
Fail closed: a 50-second limit on access
The stagelet gateway admits visitors with a single-use pass and confirms each session with Stagely every 20 seconds. With no confirmation, access stops.