Self-Hosted Weekly: Week 16, 2026. Mozilla Drops an AI Client, K8s 1.36 Preview, and Valkey Takes Over

You know that feeling when every tab in your browser has breaking news? That was this week for the self-hosted world. Mozilla dropped an AI client nobody saw coming, Kubernetes 1.36 is about to land with some genuinely useful changes, and the Valkey takeover is now officially complete across every major cloud provider.

Let's get into it.

1. Mozilla Launches Thunderbolt: A Self-Hostable AI Client

Mozilla just announced Thunderbolt, an open-source AI client built for organizations that want to run AI on their own terms. Think of it as a self-hosted alternative to ChatGPT Enterprise or Microsoft Copilot.

It supports local and commercial models, integrates with deepset's Haystack and Model Context Protocol (MCP) servers, and ships native apps for every platform (Windows, macOS, Linux, iOS, Android). Licensed under MPL 2.0 with enterprise licensing from MZLA Technologies.

Hot take: Mozilla has been searching for its post-Firefox identity for years. Thunderbolt is their most compelling product in a long time. If the self-hosted AI agent space keeps growing, this could be the client that non-technical teams actually adopt. The MCP integration alone makes it worth watching.

2. Kubernetes 1.36 Drops April 22 with 80 Enhancements

Kubernetes 1.36 is coming next week with 18 features graduating to stable, 18 to beta, and 26 new alpha features.

The highlights: Dynamic Resource Allocation (DRA) hits GA, which is huge for AI/ML workloads. HPA can now scale to zero replicas (only took seven years). OCI VolumeSource goes stable, letting you share files between containers without baking them into images. And the old gitRepo volume plugin is finally gone.

Hot take: The HPA scale-to-zero feature graduating after seven years is peak Kubernetes. But seriously, DRA going GA is the real story here. If you're running GPU workloads on K8s, this release matters more than the last five combined.

3. Valkey Is Now the Default Everywhere

It's official: AWS ElastiCache, Google Cloud Memorystore, and Akamai all default to Valkey for new instances. Redis is still available, but you have to opt in.

Valkey 8.1 brings a new memory-efficient dictionary that cuts memory footprint by 20%+ for common patterns. AWS reports up to 36% cost reduction when upgrading from ElastiCache Redis to Valkey 8.1.

Hot take: The Redis license change was supposed to protect Redis Labs' business. Instead, it handed the Linux Foundation a gift-wrapped fork that every cloud provider now prefers. For self-hosters, swapping redis:latest for valkey/valkey:latest is basically a one-line change. You can deploy Valkey on Elestio in one click if you want managed infrastructure with it. If you haven't switched yet, there's no reason left to wait.

4. OpenAI's Open-Source Shopping Spree Continues

OpenAI has made six acquisitions in 2026 already, and two of them are open-source tools. They bought Astral (creators of uv, Ruff, and ty) in March, and Promptfoo (AI vulnerability testing) earlier this month.

Both tools will remain open source after acquisition, according to OpenAI. Astral's tooling feeds into Codex, while Promptfoo integrates into OpenAI Frontier for enterprise agent security.

Hot take: "We'll keep it open source" is easy to say during acquisition PR. The real test comes 18 months later when the core maintainers have been reassigned to internal projects. Ruff and uv are too important to the Python ecosystem to let that happen quietly. Watch the commit logs.

5. Forgejo 15.0 LTS Released

Forgejo 15.0 is out and designated as a long-term support release (supported through July 2027). New features include repository-specific access tokens and improvements to Forgejo Actions.

Hot take: Forgejo keeps quietly building the best Gitea alternative while Gitea figures out its commercial strategy. If you're self-hosting your Git forge and want stability over features, the LTS designation makes Forgejo 15.0 an easy pick.

6. Two Critical CVEs for Self-Hosted Apps

Two nasty vulnerabilities dropped this week:

• Tandoor Recipes (CVE-2026-33152, CVSS 9.1): Brute-force authentication bypass via API. Upgrade to v2.6.0+ immediately.
• SiYuan (CVE-2026-33669, CVSS 9.8): Unauthenticated document access. Upgrade to v3.6.2+.

Hot take: CVSS 9.8 for unauthenticated document access is about as bad as it gets. If you're running SiYuan exposed to the internet without a VPN or reverse proxy auth, stop reading and go update right now. Tandoor's brute-force bypass is a reminder that API endpoints need rate limiting, not just password complexity rules.

7. Anthropic Partners with Linux Foundation on AI Security Scanning

Earlier this month, Anthropic announced a partnership with the Linux Foundation to provide Claude for automated security reviews of critical open-source projects, including the Linux kernel. The company claims Claude Opus 4.6 has already discovered real-world vulnerabilities in production open-source code.

Hot take: AI-powered security scanning for open source is one of those ideas that sounds obvious in retrospect. The Linux kernel has millions of lines of code and a chronic shortage of security reviewers. If the results hold up, this could meaningfully reduce the window between vulnerability introduction and discovery.

8. Docker Model Runner Matures for Local LLM Inference

Docker Model Runner (DMR) continues to gain traction as Docker's official tool for running LLMs locally. It uses llama.cpp as its default engine, treats AI models as OCI artifacts, and exposes OpenAI-compatible APIs. vLLM support is available for NVIDIA GPU users.

Hot take: The "docker model run" command turning local LLM inference into a one-liner is exactly the kind of developer experience win that Docker is good at. The OCI artifact approach means your model weights get the same versioning and distribution infrastructure as your container images. For teams already deep in the Docker ecosystem, this is the path of least resistance to local AI.

What We're Watching Next Week

• Kubernetes 1.36 official release (April 22). Expect the usual upgrade guides and "what broke" threads.
• Mozilla Thunderbolt community reception. Will the self-hosted community adopt it, or is it too enterprise-focused?
• Valkey 8.1 adoption metrics. AWS and Google defaulting to Valkey should accelerate migration numbers significantly.

The Bottom Line

This was a week where the power dynamics in open source shifted visibly. Mozilla re-entered the AI conversation with a self-hostable product. Valkey completed its takeover of the in-memory store market. OpenAI kept buying open-source tools (and promising to keep them open). And Kubernetes proved it can still ship meaningful features after a decade.

The self-hosted ecosystem isn't slowing down. If anything, it's accelerating.

Thanks for reading. See you next week.