Skip to main content

Managed vs BYOC — running coding agents in your own VPC

Kiwi has two fleet types. A managed fleet is operated by Kiwi; a byoc fleet runs in the customer's own cloud. On top of those, the product exposes tiers:

  • Free — every signup runs on a Kiwi-operated shared managed fleet. Live in production.
  • Pro — a dedicated fleet (managed-dedicated or BYOC). The upgrade/checkout is still in progress.

The Free tier: one daemon process per org​

The Free tier runs every signup on a Kiwi-operated shared fleet. Rather than a heavy VM per customer, it runs one lightweight kiwidaemon process per org, each with its own keypair (so the credential-sealing boundary is unchanged), packed onto shared hosts and scaled to zero when idle.

Usage is bounded by per-org limits enforced at lease time:

  • one concurrent job,
  • a per-task wall-clock cap (TaskTimeoutSeconds), and
  • a monthly agent-minute ceiling (MaxAgentMinutesPerMonth).

A rolling-window abuse heuristic (e.g. a cryptomining signature) auto-suspends an abusive org. The test command runs under gVisor (runsc) for stronger isolation between co-tenants on the shared host.

Cold-start on submit​

Because idle orgs are scaled to zero, there is usually no daemon running when you submit. The provisioner (pkg/provisioner) cold-starts one:

  1. On submit, a ProvisioningRequest of type provision is enqueued for your org.
  2. The provisioner claims it (atomically, FOR UPDATE SKIP LOCKED), mints a single-use join token, and launches a per-org kiwidaemon container.
  3. The new daemon registers, begins polling, and leases your task.

Scale to zero​

A background sweep loop keeps the fleet lean:

  • Idle reclaim — a free daemon whose org has had no task activity for the idle TTL (default 15 minutes) is reclaimed: a reclaim request stops the container and deregisters the daemon. The next submit cold-starts a fresh one.
  • Stale recovery — a provisioning request stuck in_progress past the stale TTL (default 5 minutes) is reclaimed and retried. Provision and reclaim side effects are idempotent, so recovery is safe.

Cadences and TTLs are environment-tunable for operations.

Where the Free tier runs​

The Free tier is split across two execution substrates because the API/orchestrator run on Cloud Run, which cannot perform the provisioner's docker run launches or run a runsc sandbox:

  1. Control plane on Cloud Run — kiwi-api, kiwi-orchestrator, kiwi-frontend, backed by Cloud SQL on a private IP. Cloud Run leaves the provisioner disabled, so it only runs the singleton sweepers.
  2. A Docker + gVisor GCE VM (the "free-fleet host") with runsc registered as a Docker runtime, on the same VPC as Cloud SQL. It runs the control-plane binary with the provisioner enabled and cold-starts per-org daemon containers; each daemon's test sandbox runs as a sibling container under runsc.
  3. The kiwidaemon image in Artifact Registry, built from the repository's Dockerfile.

Pro​

Pro graduates to a dedicated fleet — either managed-dedicated (per-org VM) or BYOC (you run the daemon in your own cloud). The managed-dedicated path (per-org VM Terraform, KMS envelope crypto, Firecracker driver) is built but not yet deployed or hardware-validated; billing and the Pro upgrade flow are still in progress. See the status table.