Tag
Since Kubernetes 1.37 the HPA accepts minReplicas: 0 without enabling any feature gate, but only with an External or Object metric: CPU cannot do it, because with no pods there is no CPU to measure. On k3s 1.37 with a Redis queue and prometheus-adapter, the HPA requested the first pod after a median of 13 s and was back at 0 after 58 s.
CVE-2026-80521 is a use-after-free in the Linux kernel's AF_UNIX socket garbage collector, with a public container escape exploit since 22 September 2026. You are affected if your kernel is 6.10 or later without the fix, or a 6.1 or 6.6 branch that received the backport. Patch and reboot; until then, isolate untrusted workloads with gVisor.
k3s and k0s are Kubernetes distributions you install on a conventional Linux host you keep administering; Talos Linux is an immutable operating system with no shell and no package manager, driven by an API, running upstream Kubernetes. They are not layers: you pick one, and node count decides which.
k3s is a conformant Kubernetes distribution that fits in a 68 MiB binary and installs with one command. It ships containerd, Flannel, CoreDNS, Traefik, ServiceLB and local storage already wired, keeps its state in SQLite, and has a node serving in three seconds.
