Webnestify, Karpatske namestie 7770/10A, Bratislava (2026)

01/10/2026

New video. I installed Proxmox on a Hetzner dedicated server and never opened the installer.

No KVM console. No ISO mounting. An AI agent did the whole thing from the Hetzner Rescue system.

Before you panic: the agent stops and asks me before it erases any disk. ⚠️ It checks every step before moving on and leaves a record of what passed. I approve the dangerous parts. It handles the boring parts.

Every script it ran is open source, link in the comments. Read it before you trust it.

Episode 2 of Self-Hosting 101. 22 minutes. Why Proxmox, which Hetzner server to order, the firewall setup most people get wrong, and the full install from start to finish. 🔥

This is the kind of infrastructure work I do for agencies at Webnestify. If you want someone to own that layer for you, send me a message.

Would you trust an AI agent to install your server if you had to approve every destructive step?

Links in the comments.

09/09/2026

Someone lost every website on their server this week. Not hacked. The hosting provider's hard drives failed, and there were no backups and no snapshots. Support said there was nothing to restore.

The painful part: the provider had a backup checkbox. 20% on top of the server price, a few dollars a month on a small VPS. It was off.

Here is the rule I give every client. Unless a company puts in writing that they run backups and will restore them, assume nothing is being backed up. "Managed" is a marketing word.

And the second rule, the one that matters even when backups are on: if you can't restore it, you don't have a backup. A backup you have never restored is a guess.

What to do today, not next week:
1. Turn on your provider's backups.
2. Back up somewhere else too, on a different provider.
3. Automate it.
4. Restore one onto a fresh server and open the site.

I do exactly this for agencies at Webnestify, including the monthly restore test. If you are not sure your backups would survive a dead disk, send me a message.

I wrote the full story up, and Andre and I talked through it for an hour on the podcast. Links below.

Be honest: when did you last actually restore a backup?

Links in the comments.

03/09/2026

Stop paying for hardened containers. Docker Hardened Images are free now.

Here's the thing. Near-zero-CVE, distroless, non-root images with a signed SBOM used to sit behind an enterprise contract. Since this week the whole catalog is free and open source.

New video is up. I show you:
🔥 How to log in to dhi.io and pull your first hardened image
🔥 How to swap a stock image for its hardened twin
🔥 The three things that break right after, and how to fix them

Then I run it on rootless Docker, so both the image and the daemon are locked down. Zero paid tooling.

At Webnestify this is now my default for every client stack. If your servers still run stock images as root, I can help you change that.

Would you switch your self-hosted apps to hardened images, or is the missing shell a dealbreaker for you?

Links in the comments.

19/07/2026

Most businesses I audit run containers built on stock images. Full OS inside, running as root, hundreds of known CVEs sitting in layers nobody looks at.

Here's the thing: Docker now gives away hardened images for free. Near-zero CVEs, no shell, no package manager, non-root by default. Every image comes with a signed software bill of materials, the kind of supply-chain proof that used to be enterprise-only.

The only requirement is a free Docker account and a one-minute access token setup.

At Webnestify I pair these hardened images with a rootless Docker runtime on every server I can. Locked-down image, locked-down daemon, zero paid tooling. That is the baseline I hold for client infrastructure, and now anyone can have it.

I published a full guide: what these images are, how to pull them, how to migrate an existing Dockerfile, and the gotchas to expect. If container security on your servers is an open question, this is the kind of problem I solve every week, so feel free to reach out.

When did you last check how many known CVEs ship inside your production containers?

Links in the comments.

17/07/2026

Garry Tan's YC keynote got the big picture right. AI is a new way to run a company. Skill files act like employees. The brain you build is the asset you own, the model is just rented.

I run infrastructure for agencies, so I see the other side of this boom. The messy part.

Most people jumping into AI are not technical. They follow a tutorial that shows every feature and skips the security. Broad inbox access. API keys sitting in plain sight. No scoped permissions. One bad email or one leaked key is all it takes.

I have watched real businesses do this to themselves. And when an agency's client gets burned, the client blames the agency and leaves.

So here is the opening for agencies. Stop selling only web design. Start building and managing AI workflows for your clients. A website is a one-off invoice. A managed second brain is recurring, and far harder to walk away from.

At Webnestify I run my own second-brain system in production, and I help agencies do the same for their customers, with the security boundary most tutorials never mention. If you want to make that shift, reach out. 🔐

If you run an agency, what is holding you back from selling AI workflows instead of just websites?

Links in the comments 👇

12/07/2026

I switched my main coding agent to Codex, and I wrote up the honest numbers behind the decision.

Short version: by my own dashboards the $200 Codex tier gives me roughly $14,000 of API-equivalent inference a month, banked resets clear my usage limits when a heavy week hits, and the new GPT-5.6 models deliver on implementation work.

I did not drop Claude Code though. It still writes my plans and PRDs, because that is where it stays unbeatable. Claude plans, Codex builds, and my projects move faster than with either tool alone.

At Webnestify I use these agents daily on real client infrastructure, so this choice is not academic for me. If you want AI tooling working on your infrastructure without the trial and error, reach out.

Which AI tools are carrying your workload right now?

Links in the comments 👇

10/07/2026

Renting a VPS and adding a SaaS control panel on top is not managed hosting.

The panel manages your websites. The server stays your problem. OS updates, firewall, backups, incident response. All yours.

Most people find out the hard way. The site goes down, they open a ticket, and the vendor's honest answer is "that's outside our scope, it's your server."

⚠️ And it gets worse. That panel installed an agent with root access on your box, connected to the vendor's cloud around the clock. You carry all the liability. They hold standing access. If the vendor gets breached, your server is one hop away.

I wrote a full breakdown on Webnestify Insights:

- The responsibility gap nobody reads in the contract
- Why the always-on root agent is their access and your risk
- Why "AI will manage it for me" is the same illusion with a new coat of paint
- Coolify and Dokploy, the open-source way to own the serverless workflow on your own hardware
- And honestly, when the cloud is the right call

🔐 Someone has to actually own server management. Either you learn it, and everything I do is public, no gatekeeping. Or you delegate it to someone accountable to you. That is exactly what I do at Webnestify for agencies around the world.

When a panel-managed server goes down at 2am, who do you think is responsible: you or the vendor?

👉 Links in the comments.

03/07/2026

The docker group is the most common quiet root backdoor I find on client servers.

Nobody adds it maliciously. Someone got tired of typing sudo two years ago, and it has been sitting there ever since. Anyone in that group can mount the entire host filesystem into a container they control. That is root, no password needed. 🔐

Rootless Docker removes that whole category. The daemon runs as an ordinary user. Your containers run as that user. If something escapes a container, it lands as a nobody, not as root on your host.

The catch? The manual setup is fiddly. Subordinate UID ranges, systemd lingering, a DOCKER_HOST variable most tutorials forget. Miss one step and nothing starts.

So I wrote a script that does it all in one command. Dedicated user, verified downloads, and a hello-world check at the end so you know it works. It is open source, and it has a dry-run mode that shows you every command before it touches anything.

Full write-up on the blog, script on GitHub.

Hardening servers like this is exactly what I do for clients at Webnestify, so if your infrastructure could use the same treatment, my door is open.

When did you last check who is in the docker group on your servers?

Links in the comments.

02/07/2026

A business owner near my city just got robbed by a single email. No hacking involved.

He had set up an AI assistant to help with daily tasks, connected it to his Gmail, and given it access to his other tools. A tutorial showed him how. It never mentioned security.

The next day an email landed in his spam folder. The subject line said "To Hermes agent." The message told the agent to run a command and report back. The agent read the email, followed the instruction, and quietly sent his passwords and access keys to a stranger's server. He never saw a thing.

Here is what I keep coming back to. He was not foolish. The load on a normal business owner today is enormous. The tools change every month, everyone online is shouting about the next big thing, and almost nobody explains the risks. Good people follow the steps and get burned.

AI can genuinely take the boring work off your plate. But an assistant that reads your inbox and can act on your accounts is one bad email away from working for someone else. Learn the risks first, then switch it on.

This is exactly the kind of setup I secure for clients at Webnestify before anything gets connected.

Would you know how to tell if your AI tools were quietly leaking your data?

Links in the comments 👇

01/07/2026

I built a side project this month and I want to share it.

It is called xCloud MCP. It lets you manage your xCloud servers and sites by talking to an AI like Claude, instead of clicking around a dashboard.

So you can just ask:

- Which of my sites have WordPress updates waiting?
- Is this server running low on disk?
- Make a backup, then purge the cache for example.com

And it does it. Backups, vulnerability scans, PageSpeed checks, cache management, WordPress updates, magic login, logs, and more.

To be clear, this is unofficial. I am a community member, not part of the xCloud team. It is MIT licensed, so anyone can fork it and build on it. I would love that.

The part I cared about most was security. I did not want a tool that could go rogue on someone's servers.

- Your token is the boundary. A read-only token simply cannot change anything.

- Your secrets stay yours. Tokens and passwords get scrubbed before the AI ever sees them.

- No shell anywhere, so command injection is not a path that exists.

- Anything destructive is hidden by default, needs a write token, and asks before it runs.

- It runs locally. No open ports, HTTPS only.

- Every release is signed with build provenance and ships an SBOM.

Free, open source, one command to install. 🔐

If your AI could safely manage your servers, what would you want it to do first?

Link in the comments.

Webnestify

01/10/2026

09/09/2026

03/09/2026

19/07/2026

17/07/2026

12/07/2026

10/07/2026

03/07/2026

02/07/2026

01/07/2026

Address

Website

Alerts

Contact The Business

Shortcuts

Share

Category

Listing takedown request