Blog Post: Suggesting validators run bare metal, not cloud

[tigarcia]

Problem

Some solana validator operators are still running on cloud services with containers. The blog post is making the foundation's stance clear that we do not recommend a cloud based environment. Bare metal is preferred.

Summary of Changes

A new blog post explaining why bare metal is the preferred option.

Fixes #

---

Change classification (SDLC §2)

• Critical — auth, secrets/key handling, fund movement, deploy/CI
  security gates, or anything that changes who can do what
• [X ] Standard — production-facing, non-critical (features, API/route
  changes, dependency updates, monitoring/config)
• Low — no security impact (docs, tests, dev tooling, content)

Security checklist

• [X ] No secrets, tokens, or credentials in source, env files, or CI logs
  (use Doppler / NEXT_PUBLIC_* only for values safe to ship to the
  browser).
• [X ] Input from users or external services is validated before use; no
  dangerouslySetInnerHTML / unsanitized HTML on untrusted input.
• [ X] New or updated dependencies are justified below, and pnpm audit
  passes (no new High/Critical advisories).
• [X ] Errors are handled explicitly — no silent failures on production paths.
• [X ] For Critical changes: a trust-boundary / threat-model note is
  included below, and a second reviewer has been requested.

[vercel]

@tigarcia is attempting to deploy a commit to the Solana Foundation Team on Vercel.

A member of the Team first needs to authorize it.

[greptile-apps]

Greptile Summary

This PR adds a new blog post explaining the Solana Foundation's stance that production validators should run on bare metal hardware rather than cloud VMs or containers, anchored to the upcoming XDP and 100M CU feature activations.

• The post covers XDP networking requirements (dedicated physical cores, elevated capabilities, high packet rates), why cloud/container abstractions undercut those requirements, and hardware recommendations (high-clock CPU, ECC RAM, enterprise NVMe, 10–25GbE).
• External links reference valid Anza documentation and the community hardware compatibility list; the internal /upgrades/xdp cross-link assumes that page exists in production.
• Two prose errors remain in the CPU/storage paragraph: a stray "on" in "and on recommends" and a grammatically broken sentence with a double "is".

Confidence Score: 5/5

Safe to merge — this is a content-only addition with no code changes, no secrets, and no security surface.

The change adds a single MDX blog post with no logic, no API changes, and no dependencies. The post's technical claims are consistent with publicly available Anza documentation, and all external links point to known Anza/Solana domains. The only items remaining are minor prose errors in one paragraph.

The single changed file is apps/media/content/posts/why-solana-validators-run-on-bare-metal.mdx; the prose errors in the CPU/storage section (lines 127–129) should be corrected before publishing.

Important Files Changed

Filename	Overview
apps/media/content/posts/why-solana-validators-run-on-bare-metal.mdx	New blog post recommending bare metal over cloud/container for Solana validators; content is technically sound but contains two prose errors in the CPU/storage paragraph (stray "on" and a double-"is" sentence).

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Validator operator decision] --> B{Environment type?}
    B -->|Bare metal| C[Full hardware control]
    B -->|Cloud VM| D[Provider-managed vNIC]
    B -->|Container| E[Additional abstraction layer]

    C --> F[Pick NIC model & firmware]
    C --> G[Pin physical cores for XDP & PoH]
    C --> H[Full ethtool / IRQ-affinity / NUMA tuning]
    F & G & H --> I[✅ Competitive XDP performance]

    D --> J[No NIC model choice]
    D --> K[vCPU pinning — partial effectiveness]
    D --> L[Reduced ethtool / NUMA options]
    J & K & L --> M[⚠️ Matches bare metal at best]

    E --> N[--network=host required]
    E --> O[Elevated capabilities required]
    E --> P[Direct host NIC access required]
    N & O & P --> Q[Container isolation removed]
    Q --> M

    M --> R{Acceptable for use case?}
    R -->|RPC / experimentation| S[✅ Cloud/container is fine]
    R -->|Production staked validator| T[❌ Bare metal strongly recommended]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[Validator operator decision] --> B{Environment type?}
    B -->|Bare metal| C[Full hardware control]
    B -->|Cloud VM| D[Provider-managed vNIC]
    B -->|Container| E[Additional abstraction layer]

    C --> F[Pick NIC model & firmware]
    C --> G[Pin physical cores for XDP & PoH]
    C --> H[Full ethtool / IRQ-affinity / NUMA tuning]
    F & G & H --> I[✅ Competitive XDP performance]

    D --> J[No NIC model choice]
    D --> K[vCPU pinning — partial effectiveness]
    D --> L[Reduced ethtool / NUMA options]
    J & K & L --> M[⚠️ Matches bare metal at best]

    E --> N[--network=host required]
    E --> O[Elevated capabilities required]
    E --> P[Direct host NIC access required]
    N & O & P --> Q[Container isolation removed]
    Q --> M

    M --> R{Acceptable for use case?}
    R -->|RPC / experimentation| S[✅ Cloud/container is fine]
    R -->|Production staked validator| T[❌ Bare metal strongly recommended]

Loading

_{Reviews (4): Last reviewed commit: "Blog Post: Suggesting validators run bar..." | Re-trigger Greptile}

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Try greploops.