Webnestify, Karpatske namestie 7770/10A, Bratislava (2026)

19/07/2026

Most businesses I audit run containers built on stock images. Full OS inside, running as root, hundreds of known CVEs sitting in layers nobody looks at.

Here's the thing: Docker now gives away hardened images for free. Near-zero CVEs, no shell, no package manager, non-root by default. Every image comes with a signed software bill of materials, the kind of supply-chain proof that used to be enterprise-only.

The only requirement is a free Docker account and a one-minute access token setup.

At Webnestify I pair these hardened images with a rootless Docker runtime on every server I can. Locked-down image, locked-down daemon, zero paid tooling. That is the baseline I hold for client infrastructure, and now anyone can have it.

I published a full guide: what these images are, how to pull them, how to migrate an existing Dockerfile, and the gotchas to expect. If container security on your servers is an open question, this is the kind of problem I solve every week, so feel free to reach out.

When did you last check how many known CVEs ship inside your production containers?

Links in the comments.

17/07/2026

Garry Tan's YC keynote got the big picture right. AI is a new way to run a company. Skill files act like employees. The brain you build is the asset you own, the model is just rented.

I run infrastructure for agencies, so I see the other side of this boom. The messy part.

Most people jumping into AI are not technical. They follow a tutorial that shows every feature and skips the security. Broad inbox access. API keys sitting in plain sight. No scoped permissions. One bad email or one leaked key is all it takes.

I have watched real businesses do this to themselves. And when an agency's client gets burned, the client blames the agency and leaves.

So here is the opening for agencies. Stop selling only web design. Start building and managing AI workflows for your clients. A website is a one-off invoice. A managed second brain is recurring, and far harder to walk away from.

At Webnestify I run my own second-brain system in production, and I help agencies do the same for their customers, with the security boundary most tutorials never mention. If you want to make that shift, reach out. 🔐

If you run an agency, what is holding you back from selling AI workflows instead of just websites?

Links in the comments 👇

12/07/2026

I switched my main coding agent to Codex, and I wrote up the honest numbers behind the decision.

Short version: by my own dashboards the $200 Codex tier gives me roughly $14,000 of API-equivalent inference a month, banked resets clear my usage limits when a heavy week hits, and the new GPT-5.6 models deliver on implementation work.

I did not drop Claude Code though. It still writes my plans and PRDs, because that is where it stays unbeatable. Claude plans, Codex builds, and my projects move faster than with either tool alone.

At Webnestify I use these agents daily on real client infrastructure, so this choice is not academic for me. If you want AI tooling working on your infrastructure without the trial and error, reach out.

Which AI tools are carrying your workload right now?

Links in the comments 👇

10/07/2026

Renting a VPS and adding a SaaS control panel on top is not managed hosting.

The panel manages your websites. The server stays your problem. OS updates, firewall, backups, incident response. All yours.

Most people find out the hard way. The site goes down, they open a ticket, and the vendor's honest answer is "that's outside our scope, it's your server."

⚠️ And it gets worse. That panel installed an agent with root access on your box, connected to the vendor's cloud around the clock. You carry all the liability. They hold standing access. If the vendor gets breached, your server is one hop away.

I wrote a full breakdown on Webnestify Insights:

- The responsibility gap nobody reads in the contract
- Why the always-on root agent is their access and your risk
- Why "AI will manage it for me" is the same illusion with a new coat of paint
- Coolify and Dokploy, the open-source way to own the serverless workflow on your own hardware
- And honestly, when the cloud is the right call

🔐 Someone has to actually own server management. Either you learn it, and everything I do is public, no gatekeeping. Or you delegate it to someone accountable to you. That is exactly what I do at Webnestify for agencies around the world.

When a panel-managed server goes down at 2am, who do you think is responsible: you or the vendor?

👉 Links in the comments.

03/07/2026

The docker group is the most common quiet root backdoor I find on client servers.

Nobody adds it maliciously. Someone got tired of typing sudo two years ago, and it has been sitting there ever since. Anyone in that group can mount the entire host filesystem into a container they control. That is root, no password needed. 🔐

Rootless Docker removes that whole category. The daemon runs as an ordinary user. Your containers run as that user. If something escapes a container, it lands as a nobody, not as root on your host.

The catch? The manual setup is fiddly. Subordinate UID ranges, systemd lingering, a DOCKER_HOST variable most tutorials forget. Miss one step and nothing starts.

So I wrote a script that does it all in one command. Dedicated user, verified downloads, and a hello-world check at the end so you know it works. It is open source, and it has a dry-run mode that shows you every command before it touches anything.

Full write-up on the blog, script on GitHub.

Hardening servers like this is exactly what I do for clients at Webnestify, so if your infrastructure could use the same treatment, my door is open.

When did you last check who is in the docker group on your servers?

Links in the comments.

02/07/2026

A business owner near my city just got robbed by a single email. No hacking involved.

He had set up an AI assistant to help with daily tasks, connected it to his Gmail, and given it access to his other tools. A tutorial showed him how. It never mentioned security.

The next day an email landed in his spam folder. The subject line said "To Hermes agent." The message told the agent to run a command and report back. The agent read the email, followed the instruction, and quietly sent his passwords and access keys to a stranger's server. He never saw a thing.

Here is what I keep coming back to. He was not foolish. The load on a normal business owner today is enormous. The tools change every month, everyone online is shouting about the next big thing, and almost nobody explains the risks. Good people follow the steps and get burned.

AI can genuinely take the boring work off your plate. But an assistant that reads your inbox and can act on your accounts is one bad email away from working for someone else. Learn the risks first, then switch it on.

This is exactly the kind of setup I secure for clients at Webnestify before anything gets connected.

Would you know how to tell if your AI tools were quietly leaking your data?

Links in the comments 👇

01/07/2026

I built a side project this month and I want to share it.

It is called xCloud MCP. It lets you manage your xCloud servers and sites by talking to an AI like Claude, instead of clicking around a dashboard.

So you can just ask:

- Which of my sites have WordPress updates waiting?
- Is this server running low on disk?
- Make a backup, then purge the cache for example.com

And it does it. Backups, vulnerability scans, PageSpeed checks, cache management, WordPress updates, magic login, logs, and more.

To be clear, this is unofficial. I am a community member, not part of the xCloud team. It is MIT licensed, so anyone can fork it and build on it. I would love that.

The part I cared about most was security. I did not want a tool that could go rogue on someone's servers.

- Your token is the boundary. A read-only token simply cannot change anything.

- Your secrets stay yours. Tokens and passwords get scrubbed before the AI ever sees them.

- No shell anywhere, so command injection is not a path that exists.

- Anything destructive is hidden by default, needs a write token, and asks before it runs.

- It runs locally. No open ports, HTTPS only.

- Every release is signed with build provenance and ships an SBOM.

Free, open source, one command to install. 🔐

If your AI could safely manage your servers, what would you want it to do first?

Link in the comments.

01/07/2026

Search "Contabo" or "OVHcloud" and you'll drown in angry threads.

CPU steal. Slow support tickets. A datacenter fire that took 30,000 servers with it. The reviews read like a warning label.

Here's the thing: most of those complaints are real. And almost all of them are predictable.

Cheap hosting runs on three trades. Dense nodes, so you get a noisy neighbour. Unmanaged support, so your 3am incident is your problem. And you own your backups, because the safety net was never included.

But here's the detail that actually changed how I use them. Try to pin down Contabo's uptime guarantee. Their current terms promise 99.9%, but only for network connectivity, with no service credit if they miss it. Meanwhile their own help center still cites an older 95% figure, pointing right back at those same terms. When a host can't give you one straight answer on its own uptime, that's not what I'd bet a client's production on. 🔐

So here's exactly how I use both.

Contabo and OVHcloud live on my dev boxes, my staging, and anything I'm just kicking the tyres on. Throwaway environments where a slow ticket or a busy node costs me nothing.

For real production, mine or a client's, I reach for something else.

That's the whole thing in one line: great value for non-critical work, wrong place to bet a business.

The trick isn't avoiding budget hosts. It's matching the provider to the workload, reading the SLA before you sign, and keeping your backups with a different company in a different place.

If your infrastructure has outgrown the cheapest line on a pricing page, that's the kind of problem I untangle at Webnestify.

When did you last actually read your host's uptime guarantee?

Links in the comments 👇

30/06/2026

Hetzner raised prices twice this spring, and a lot of people asked me if it's time to jump ship.

Here's my honest take as someone who runs infrastructure for clients every day.

The increase is fair. Server RAM contract prices jumped roughly 93% to 98% in a single quarter. SSDs now cost up to 16x more per terabyte than hard drives. AI data centers are eating the memory supply, and every provider is feeling it. Hetzner even absorbed the cost for about nine months before passing it on. I'd have made the same call.

Where Hetzner slipped was communication. The first announcement had no real numbers. Two hikes landed months apart. And the availability problems, where customers couldn't even rescale their own servers, were buried in a status page most people never saw.

But here's the part that matters for the businesses I work with: even after two increases, Hetzner is still one of the strongest price-to-performance options in Europe. Leaving costs money too.

So instead of panic-migrating, I tell clients to do three things: right-size before you rescale, check the cheaper auction and limited tiers, and never weld your stack to one provider. Portable infrastructure turns a scary pricing email into a decision you make calmly, not one made for you.

That last point is how I build for clients at Webnestify: infrastructure you control, on standards that move. If a provider's pricing ever forces your hand, that's a problem worth fixing before the next email lands. 🔐

When a provider raises prices, do you audit your setup or just absorb the bill?

Links in the comments.

29/06/2026

Self-hosting is great until you are twelve browser tabs deep, pasting compose files you only half trust.

I built wdm to fix that. 🚀 It is a terminal app, a TUI and a CLI, for installing, updating, and checking a curated set of Docker Compose self-hosting templates. Safe defaults, minimal fuss.

The part I care about most is trust. 🔐 wdm ships as a single signed binary. The installer verifies the signature, the checksums, and a provenance attestation before anything runs. If verification fails, it stops. You never run an artifact that does not check out.

No cosign, gh, sudo, or package manager needed up front. Just curl, sha256sum, and tar. Once it verifies, it drops wdm in ~/.local/bin and seeds a verified catalog, so browsing apps works on the first run.

It runs best against a dedicated user with rootless Docker. No docker group, no root-owned socket. There is a provisioning script that sets that up, and you can dry-run it first to see every command before it touches your server.

This is the same standard I hold for client infrastructure. Verify before you run, least privilege by default, nothing magic. ✅ If your team wants self-hosting that is actually safe to operate, that is the kind of work I do at Webnestify.

What self-hosted app would you want a verified one-line install for first?

Links in the comments.

Webnestify

19/07/2026

17/07/2026

12/07/2026

10/07/2026

03/07/2026

02/07/2026

01/07/2026

01/07/2026

30/06/2026

29/06/2026

Address

Website

Alerts

Contact The Business

Shortcuts

Share

Category

Listing takedown request