Self-Hosted Weekly: Week 28, 2026. Ollama's $65M, Chatto Goes Open Source, Camel CVEs
Another week, another pile of releases, funding rounds, and CVEs to sort through. This week the money kept flowing into open-source AI, a genuinely nice self-hosted chat app dropped its source, and Apache Camel handed everyone a reason to patch on a Monday. Here are the eight stories worth your attention, with an honest take on each.
1. Ollama raises $65M Series B
The local-LLM darling just took a $65 million Series B led by Theory Ventures, with Benchmark, 8VC, and Y Combinator along for the ride. Ollama is the tool a huge chunk of the self-hosted AI crowd uses to pull and run models with one command, and now it has serious runway.
Hot take: Good for the ecosystem, but keep one eye open. The last time a beloved "just run it locally" tool took a big round, a hosted tier and a pricing page followed within a year. The CLI you love is open source and will stay runnable. The question is whether the roadmap starts optimizing for the cloud product instead of your laptop. If you already self-host Ollama, nothing changes today.
2. Chatto goes open source
Hendrik Mans released the source for Chatto, a privacy-focused team chat platform, under AGPL-3.0. It is a single-binary Slack/Discord alternative with SSO, voice calls, and EU hosting as first-class features, and this is the first time the code has been open to public scrutiny.
Hot take: AGPL is the right call for a chat server, it keeps hosted forks honest. The single-binary part is what actually matters though. Mattermost and Rocket.Chat are great, but "one binary, no Redis, no separate job runner" is exactly the friction level a small team will actually adopt. Worth a test deploy this weekend.
3. OpenProject 17.6 ships with XWiki integration
OpenProject 17.6.0 landed with a new XWiki integration that wires project management and enterprise knowledge management together. If you run OpenProject as your self-hosted Jira alternative, your wikis and your work packages now live closer to each other.
Hot take: This is the unglamorous, genuinely useful kind of release. Nobody tweets about a wiki integration, but "where do we write things down" is the question that kills half of all project tooling. Pairing a mature planner with a mature wiki is a smarter move than bolting on a worse built-in editor. You can run OpenProject on Elestio if you would rather not manage the Postgres yourself.
4. Google previews OpenRL, a self-hosted LLM training API
Out of GKE Labs comes OpenRL, a research-preview open-source project that gives you a self-hosted API for fine-tuning LLMs with reinforcement learning on your own Kubernetes cluster. The pitch is training loops that run on infrastructure you control instead of a managed fine-tuning endpoint.
Hot take: Interesting that Google is the one shipping the "keep your training data on your cluster" story. It is early and it is Kubernetes-flavored, so this is not a weekend project. But the direction is real: the serious self-hosting conversation in 2026 is moving from "run inference locally" to "run the whole training and data loop locally," and tooling like this is the first step.
5. Apache Camel drops a batch of CVEs
On July 6, several improper-authentication and input-validation vulnerabilities were published across Apache Camel components, including the Keycloak component (CVE-2026-53913), the Atmosphere Websocket component (CVE-2026-55993), and the Iggy component (CVE-2026-55994).
Hot take: Camel is the quiet plumbing inside a lot of enterprise integrations, which is exactly why these matter more than the CVSS numbers suggest. Auth-bypass bugs in an integration layer are the kind of thing that sits unnoticed until someone chains them. Check which Camel components you actually load and patch those first, you probably do not need all of them.
6. Docker Desktop patches its Model Runner
This week's Docker Desktop update fixes CVE-2026-33990 in the Docker Model Runner, refreshes containerd and Buildx, and finally removes the experimental docker sandbox plugin (you migrate to docker sbx now). Kubernetes kind clusters also play nicely with Registry Access Management.
Hot take: The Model Runner CVE is the headline, patch it. But the quiet story is Docker steadily building out local AI model tooling right in Desktop. If you have been ignoring docker model because it felt like a demo, it is turning into real infrastructure. Also, RIP the sandbox plugin, we barely knew you.
7. Kubernetes v1.37 hits feature freeze
The v1.37 release cycle reached its feature and blog freeze this week, with code freeze on July 22 and the release itself due August 26. The themes everyone is tracking this cycle are the ongoing push around In-Place Pod Resizing (resize CPU and memory without a restart), Sidecar Containers as a first-class lifecycle, and Dynamic Resource Allocation maturing for GPU-heavy scheduling.
Hot take: In-Place Pod Resizing is the one to care about. "Change the resource request and the pod restarts" has been a papercut forever, and making it seamless makes right-sizing workloads far less scary. DRA is the sleeper: if you run GPUs on Kubernetes, it is the piece that finally treats them like the scarce resource they are. Boring, correct, overdue.
8. NoteDiscovery: a self-hosted Obsidian alternative
A new open-source note tool called NoteDiscovery surfaced this week, offering a web interface for Markdown notes stored as plain files on your own filesystem. It ships with auth, themes, a plugin system, LaTeX, graph views, and HTML export.
Hot take: The "plain Markdown files on disk" part is the whole selling point. Obsidian is excellent but not open source, and its sync is a paid add-on. A self-hosted, file-on-disk, plugin-friendly alternative is exactly what the note-taking crowd keeps asking for. Early days, but this is the category people actually search for.
What we're watching next week
- Kubernetes v1.37 code freeze (July 22): the final feature list gets locked. Expect the usual scramble to land or punt borderline KEPs.
- The Open Source for Science Fund deadline (July 21): up to $1M for foundational libraries. Worth watching where that money lands, sustainability funding is the story that never gets old.
- More AI-infra money: Together AI's reported $800M round shows the open-model infrastructure gold rush is not slowing down. Someone will announce another one before Friday.
Bottom line
The theme this week was money and maturity. Ollama's raise and the OpenRL preview show open-source AI is getting funded and getting serious about the full training loop, not just inference. On the everyday self-hosting side, Chatto and NoteDiscovery both nailed the same lesson: single binary, files on disk, low friction beats feature count. And Apache Camel plus Docker's Model Runner are your reminder that patch Tuesday does not care about your weekend plans.
If any of this made you want to actually run something instead of just reading about it, that is the whole point. Elestio has 400+ of these tools a click away if you would rather skip the Compose file.
Thanks for reading ❤️ See you next week 👋