---
date: 2026-05-31T00:00:00.000Z
tags:
  - scopes
  - containers
  - static files
  - security
  - entity hooks
  - services
  - cli
  - monthly
toc_max_heading_level: 3
doc_id: f2d9c4a7-8b13-4e62-9a05-7c1e3f8b6d24
description: >-
  May updates: configurable HTTP ports and tunable resource limits for
  Containers scopes, WAF protection for Static files, conditional entity hook
  firing, and external fields improvements.
keywords:
  - configurable http ports
  - cpu and memory limits
  - WAF
  - static files
  - entity hooks
  - external fields
  - service read
  - CLI 2.7.0
title: May 2026
slug: may-2026
---


May updates: configurable HTTP ports and tunable resource limits for Containers scopes, WAF protection for Static files, conditional entity hook firing, and external fields improvements.

{/* truncate */}

<!-- ## AI-powered features

Nullplatform now includes a suite of **AI-powered features** that give your teams visibility, automation, and control over the software they run, without writing queries or navigating complex configuration. 

:::info 🚀 Early release
AI-powered features are in early release and may not be available in your organization yet. If you'd like to try them, [reach out to us](/docs/support) and we'll get you set up.
:::


### AI assistant

A chat panel embedded directly in the console. Ask questions about your applications, deployments, and scopes, investigate failures, all with full context of what you're viewing. The assistant is read-only: for write operations it generates the command or script for you to run.

👉 See the [AI assistant docs](/docs/ai-assistant/overview).

### Insights

Ask a question in plain language like *"Show errors by service in the last 7 days"* and get a live visual dashboard instantly, with KPI cards, charts, and tables backed by your live data. Save dashboards as private drafts or publish them so your whole organization works from the same view.

👉 See the [Insights docs](/docs/insights/overview).

### Action items

Security vulnerabilities, over-provisioned resources, and stale deployments surface as tracked items in your application dashboard, each with an AI-suggested fix that developers can review and approve before anything runs.

### AI plugins

The open-source **nullplatform AI plugins** bring nullplatform operations into your terminal. Describe what you need in plain language and the plugin queries entities, paginates and deduplicates results, and calls the right API endpoints for you. They work with Claude Code, Factory AI, and Codex CLI, and ship as a suite of slash commands like `/np-governance`, `/np-developer`, and `/np-service-craft`.

```bash
git clone https://github.com/nullplatform/ai-plugins.git
cd ai-plugins
claude plugin install .
```

👉 See the [AI plugins setup guide](/docs/ai-ops/ai-plugins), or browse the suite on [GitHub](https://github.com/nullplatform/ai-plugins).

👉 See the [AI-powered features overview](/docs/ai/overview) for the full picture. -->

## ✨ Configurable HTTP ports for Containers scopes

Not every application binds to `8080`, and some need to expose more than one HTTP listener. Containers scopes can now bind the main HTTP listener to any port and expose extra HTTP ports alongside it, all from the **Exposed Ports** section of the scope form.

**What you get:**

- A configurable `main_http_port` (default `8080`, range `1024` to `65535`). Nullplatform threads it through the Service, Ingress, container port, and health probes automatically.
- HTTP support for `additional_ports`, each with its own Service and Ingress. Extra ports become reachable over HTTPS at the same hostname, with SSL terminated at the ALB using the existing wildcard certificate.

The change is fully backward-compatible: scopes that don't set a main port keep using `8080`, and existing GRPC additional ports keep working without changes.

<img alt="Scope form Exposed Ports section with the Main HTTP Port field" src="/img/scope/main-http-port-config.png" width="100%" className="helper-image" />

👉 See the [Configurable HTTP ports docs](/docs/agent-backed-scopes/containers/configurable-http-ports).

## ✨ Tunable CPU and memory limits for Containers scopes

Containers scopes now let you set CPU and memory **limits** independently from **requests**, so an application can request more resources than its steady-state baseline. The fields live under the **ADVANCED → Resources** tab and both default to `Same as request`.

This is an advanced knob with real trade-offs. Raising a limit above its request drops the pod from the **Guaranteed** to the **Burstable** QoS class, changing how Kubernetes schedules, throttles, and evicts it. The new page walks through each risk: QoS downgrade, memory overcommit and OOMKill, and CPU throttling. For most workloads, sticking to the default behavior remains the safer choice.

<img alt="Scope edit form showing CPU and RAM request and limit fields under the Advanced Resources tab" src="/img/scope/cpu-and-memory-limits.png" width="100%" className="helper-image" />

👉 See the [CPU and memory limits docs](/docs/agent-backed-scopes/containers/cpu-and-memory-limits).

## ✨ WAF protection for Static files scopes

Static files scopes can now attach an existing AWS WAF WebACL to their CloudFront distribution, adding managed rules, rate limiting, and request filtering in front of your assets. The feature is opt-in and adds no IAM overhead unless enabled.

Set `aws_security = "waf"` and the WebACL name in your scope-configurations provider, or use the **Security** tab in the UI. Attaching, swapping, or detaching a WebACL is always an in-place update: the distribution ID stays stable and there's no downtime.

:::info
Only AWS WAFv2 WebACLs with `scope=CLOUDFRONT` in `us-east-1`, in the same account as the agent, are supported. The scope references an existing WebACL by name and never creates or modifies WAF resources.
:::

👉 See the [WAF protection docs](/docs/agent-backed-scopes/static-files/waf).

## ✨ Conditional firing for entity hooks

You can now fire an entity hook only when the event that triggered it matches specific conditions, for example only when a deployment switches traffic to 100%. Instead of filtering the hook itself, you filter the **notification channel** the hook delivers through, using the same `filters` mechanism already available for Slack, HTTP, and agent notifications.

The framework injects the triggering operation's `request_body` into the notification context, so channel filters can match on any field from the API request that fired the hook.

👉 See the [Conditional hook firing docs](/docs/entity-hooks/filters).

## ✨ Reference namespace and account in your specifications

The `additionalKeywords` jq context used by specifications now exposes the parent **namespace** and **account** of the resolved entity, alongside the existing application, scope, and service data. Both are derived automatically from the NRN cascade, so no extra parameter is needed to reference values like `.namespace.slug` or `.account.slug` in your dynamic schemas.

👉 See the [External fields docs](/docs/services/craft-a-service/external-context).

## ✨ CLI 2.7.0

We've released version `2.7.0` of the nullplatform CLI, with a new command option and a bug fix.

**What's new in CLI 2.7.0:**

- `np account read --show-deleted` now lets you read deleted accounts.
- Fixed `np service-action exec` hanging when the command's stdout exceeded 64 KB.

**Install the latest version:**

```bash
curl https://cli.nullplatform.com/install.sh | sh
```

👉 See the [CLI docs](/docs/cli) for more info.

---

That's all for May, from the **nullplatform** team! ❤️