Your Container Logs Are Ephemeral Twice Over — Plan Around It
Logs rotate at roughly 10 MB and disappear entirely when you redeploy. Here's what's captured, what isn't, and how to keep the parts you'll need later.
There Are No Health Checks — Build the Watchdog Yourself
Nothing probes your app. Restarts react to a process exiting, not to one that's hung, so a deadlocked worker looks perfectly healthy. Here's the fix.
Your Bot Will Be Restarted — Design for It
Crashes, redeploys, and maintenance all restart your process, and you get about a second's notice. Here's how to make that a non-event instead of a bug.
You Get a Shell in Every Container — Even a Distroless One
Minimal images normally mean no shell and no debugging. A static busybox is mounted into every container here, so scratch images stay inspectable.
Your Side Project Hit the Front Page — Surviving a Spike on One Container
You can't scale out, so the advice is different. Cache hard, make the common path cheap, and whatever you do, don't deploy in the middle of it.
Protecting a Public Endpoint When There's No WAF or Rate Limiting
The edge terminates TLS and routes by hostname — that's all. Every other protection is your app's job. Here's the cheap 80% for a small service.
Your Agent Loop Needs a Stop Condition
An agent decides for itself when it's finished, and sometimes it never does. Four limits stop a tool loop costing you money and getting OOM-killed.
Your AI-Built App Assumes One User — What Breaks With Two
Generated code keeps per-user state in module-level globals. One container means every visitor shares them, so the usual symptom is seeing someone else's data.
Six Security Holes AI-Generated Apps Ship With — A Pre-Deploy Review
Models write for the happy path on a machine only you can reach. Once deployed, that code is your entire defence. Six things to check, each a two-minute grep.
Two Bots in One Channel — Stopping the Loop Before It Costs You
Telegram forbids bots seeing each other precisely to avoid this. Discord doesn't, so the check is yours — and with a model behind it, each lap is billable.
Changing a Prompt in Production Without Breaking It
A prompt is the least protected code in your app — no type check, no test, and failures look like slightly worse answers. Version it and gate it on evals.
Discord Attachment URLs Expire — Stop Storing Them in Your Database
CDN links are signed and time-limited, so a bot that saves them serves dead images later. Three fixes, and one that costs nothing at all.
Discord Bot "Missing Permissions" (50013) — Why It Isn't Your Hosting
The bot has the permission and still can't use it. Usually a channel overwrite, or a role hierarchy rule that no permission flag can override.
Discord Rate Limits — The One That Locks You Out Isn't the Obvious One
50 requests a second is easy to respect. The limit that bites is 10,000 invalid requests per 10 minutes, and a 403 in a loop counts toward it.
When Your Disk Fills Up, Every App in Your Account Stops
Disk is the one resource you don't allocate — it's measured from what you actually wrote. Go over the account limit and nothing restarts until you're under it.
Does Anyone Actually Use My Bot? Counting It Properly
Logs rotate and memory resets on every deploy, so neither can answer it. Twenty lines and a table on a volume can — if you store rollups, not events.
Hosting Something Only You Can Reach
There's no private or internal-only option — every port binding is public from the moment your app starts. Three real approaches, and the best often opens no port.
LLM API Timeouts and Retries — What Actually Breaks on One Container
The SDK default is a 10-minute timeout retried twice. One stuck request can hold a worker for half an hour, and nothing on the platform notices.
Your LLM Bot's Reply Is Too Long for Discord
Model output doesn't respect a 2,000-character cap. Splitting naively breaks code blocks, and editing on every token is how you collect rate limits.
Your Users Get Logged Out Every Time You Deploy
Two causes, both common in generated auth code — sessions kept in memory, or a signing secret regenerated at startup. Neither looks like a bug locally.
Write Logs Your AI Agent Can Actually Debug
An agent reading your logs has no memory of your architecture and a limited window. Small changes make the difference between a diagnosis and a guess.
Maintaining an App an AI Wrote for You
The risk isn't bad code — it's that nobody holds a model of it. Four cheap habits, and one that matters because every deploy rebuilds your image.
Your App Restarts Every Few Days — That's a Memory Leak
A hard RAM cap turns a slow leak into a clock. Exit code 137, a sawtooth pattern, and the pragmatic fix people don't like admitting works.
Anyone in the Channel Can Prompt Your Bot
If a stranger's message reaches your model, they can instruct it. The fix isn't a better system prompt — it's limiting what the model is allowed to do.
Rate-Limiting an LLM Endpoint — Requests Aren't the Unit, Tokens Are
An endpoint that calls a model turns traffic into spend, and no hosting setting can cap it. Three layers of defence — and the one that resets on deploy.
Getting Reliable JSON Out of a Model
Two failure modes, and only one is malformed syntax. Validate in code, feed the error back once, and cap the retries — because each one is billed.
Restricting Who Can Use Your Bot's Commands
Discord's default_member_permissions is a default, not a boundary — admins bypass it and server owners can change it. The real check belongs in your handler.
Adding Search to a Small App — SQLite FTS5, Not Elasticsearch
Full-text search ships inside SQLite. No second container, no network hop, no service to run — and on one container that's three structural problems avoided.
Self-Hosting Vaultwarden — It Fits Easily, and You Own the Backups
Vaultwarden runs comfortably in a small container. The hosting is the easy part — no snapshots exist, so losing the volume means losing the vault.
Sending Webhooks Reliably When Your Container Restarts
Signing, timeouts, backoff and idempotency are the usual list. The one nobody mentions — your retry queue has to survive being replaced mid-delivery.
Your Discord Slash Commands Aren't Showing Up — Check These in Order
Usually the invite is missing a scope, or you registered globally and expected instant results. And registering on every boot has a limit you can hit.
Storing User API Keys When Your AI App Lets People Bring Their Own
Environment variables hold your app's secrets, not your users'. Per-user keys need encrypted storage — and the first question is whether to store them at all.
Your Telegram Bot Ignores Group Messages — It's Privacy Mode
It replies fine in DMs and goes silent in groups. That's the default, not a bug — and toggling it does nothing until you re-add the bot to the group.
Telegram Inline Mode — Results Are Cached and Shared by Default
Inline results cache for 300 seconds and are served to anyone typing the same query. If your results depend on who is asking, that's a data leak.
Anyone Can POST to Your Telegram Webhook — Verify It's Telegram
A webhook URL is just a public endpoint, and nothing filters who reaches it. The secret_token header is two lines of code and the only real check.
Your Agent Says It Deployed — Four Checks Before You Believe It
"Deployed successfully" means the API calls returned, not that your app works. The status is container-level, so it can be green while nothing works.
Every Redeploy Drops Every WebSocket — Designing Realtime Apps for It
There's no connection draining and about a second between stop and kill. So plan for the reconnect — and for every client reconnecting at the same instant.
What the Platform Tells You — and What It Never Will
Notifications cover billing, resources, maintenance and support messages. Nothing tells you your application itself stopped working.
Your AI Wrote a Dockerfile — Check These Nine Things Before You Push
LLM-written Dockerfiles are usually valid and frequently wrong in the same ways. Three break the build, three deploy fine and then don't work.
Built on an Apple Silicon Mac? Your arm64 Image Won't Deploy
The platform runs linux/amd64. An arm64 image doesn't fail loudly — the tag never shows up and auto-deploy quietly skips it. Build with --platform.
"Application Marked as Stale" — What That Notification Means
An inactivity policy can mark long-stopped apps stale, warn a few times, then remove them. Here's how to read the notifications and how to clear the state.
Bot Keeps Restarting but Shows as Running? Read the Exit Code
A crash-looping bot reports a healthy status because the container never exits. Here's the log line that tells you the truth, and what each exit code means.
Bot Shows Online but Ignores Every Command — It's Probably Intents
A bot that connects, appears online, and does nothing usually isn't a hosting problem. It's a missing privileged intent, and it needs fixing in two places.
Why Is My Bot Replying Twice? Four Causes, in Order of Likelihood
Duplicate replies almost always mean two copies of your bot are running — often the old host you forgot to stop. Here's how to tell which cause you have.
Your Bot Token Is in Your Git History — Rotate It, Don't Scrub It
Once a token has been pushed anywhere, it's burned. Regenerate it, move it to an environment variable, and stop shipping secrets inside the image.
Your Build Gets Less Memory Than Your App — Why Bundles Fail to Compile
Builds run in their own capped container, so raising your app's RAM doesn't help. Here's what blows the limit and the four ways around it.
Building a Bot With Someone Else — Collaborate in the Repo, Not the Panel
Apps have a single owner, so there's no way to share one. That's less limiting than it sounds if deploys run from CI, and it forces a better setup anyway.
A Crash-Looping Discord Bot Can Get Its Token Reset
Every restart that reaches the gateway spends one IDENTIFY. Discord allows 1000 a day, and blowing past it resets your token. A 5-second loop gets there fast.
You Deleted Your App — What Happens Next, and What You Can Do
Deleting is a soft delete with a retention window, but you can't undo it yourself. Here's what's recoverable, for how long, and how to not need it.
"This Interaction Failed" — Discord's 3-Second Rule Explained
Discord gives your bot 3 seconds to acknowledge a slash command. Defer for anything slower — and know what a redeploy does to work you deferred.
Your Docker Image Is 1.2 GB — Here It Costs Downtime, Not Storage
Image size doesn't count against your disk quota; volumes do. So slim images for a different reason — every redeploy pulls the thing before your app starts.
There's a File Browser in the Panel — Download a Backup Without a Shell
The Files tab browses your running container: download a database, upload a seed file, edit a config. Here's what persists and what quietly doesn't.
Hosting a Webhook Receiver — 10 Seconds, a Signature, and a Redeploy
A webhook endpoint needs public HTTPS, a fast 2XX, and a verified signature. Here's how to build one that doesn't lose events when you redeploy.
Hosting a Telegram Mini App — HTTPS and the Validation Step Everyone Skips
A Mini App is a web page Telegram embeds, so it needs HTTPS with a valid certificate — and an initData check on your server that most tutorials leave out.
How to Roll Back a Bad Deploy — and What Won't Roll Back With It
Pushed images keep a tag history you can switch back to in one click. But your database migration doesn't roll back, and `latest` destroys the option entirely.
Move a Bot Off a VPS: What Changes
Move a bot from a VPS to one container. Plan its data, public ports, process monitoring and costs before retiring the server.
You Can Calculate Your Maximum Hosting Bill in Advance
Billing here follows what you allocate, not what your traffic does — so a spike can't produce a surprise invoice. Here's the arithmetic and the one exception.
How Much CPU and RAM Does Your Bot Actually Need?
Presets run from 0.1 vCPU to 2. Start at the bottom, move up only on evidence — and know why a change seems to do nothing until you restart.
Self-Host ntfy for Push Notifications From Your Bots and Scripts
One small Go binary turns any curl command into a phone notification. Here's the deploy, the auth config people skip, and the honest iOS caveat.
Self-Host Uptime Kuma in One Form — Image, Volume, HTTPS
Deploy Uptime Kuma from its public Docker image with a persistent volume and an HTTPS URL, set in a single create form. Plus the one mistake to avoid.
The Events Tab — the History That Survives When Logs Rotate Away
Logs tell you why something broke and then disappear. The event history tells you when and how often, and it's still there after a redeploy.
What 0.5 vCPU Actually Means — Your Container Gets Frozen, Not Slowed
A fractional CPU quota is a time budget per 100ms window. Exhaust it and the kernel stops your process cold, which is why symptoms come in spikes.
What You're Actually Granting When You Connect an AI Agent to Your Hosting
22 MCP tools, 8 of them read-only. But read-only isn't the same as harmless — two of those hand your agent credentials. Here's the honest breakdown.
A Stopped App Has No Shell — What You Can Still Do, and the Disk Catch-22
Shell and the file browser need a running container. Logs and events don't. Knowing which is which matters most when a disk overrun stops everything at once.
"It Works Locally" — Why Your Bot Breaks the Moment You Deploy
Same code, different machine. Case-sensitive filenames, CRLF line endings, a UTC clock, and missing env vars cause most of it. Here's the checklist.
You Probably Don't Need Redis — Caching for Small Apps and Bots
For a single small app, an in-process cache beats a Redis container on speed, cost, and security. Here's when that's true, and what to do when it isn't.