6 ms·

Show HN: Alien – Self-hosting with remote management (written in Rust)

106 points by alongub 5mo ago

Hi HN, I'm Alon, and I'm building Alien, an open-source platform for deploying your software into your customer's environment and keeping it fully managed. In my previous startup, I heard the same question from every single enterprise customer over and over again: "My data is sensitive. Can I deploy your product to my own cloud account?" Self-hosting is becoming very popular because it lets users keep their data private, local, and inside their own environment. Unfortunately, self-hosting breaks down when someone starts paying for your software. Especially if it's an enterprise customer. Customers usually don't actually know how to operate your software. They might change something small — Postgres version, environment variables, IAM, firewall rules — and things start failing. From their perspective, the product is broken. And even if the root cause is on their side, it doesn't matter... the customer is always right, you're still the one expected to fix it. But you can't. You don't have access to their environment. You don't have real visibility. You can't run anything yourself. So you're stuck debugging a system you don't control, through screenshots and copy-pasted logs on a Zoom call. You end up responsible for something you don't control. I think there's a better model of paid self-hosting: the software runs in the customer's environment, but the developer can actually operate it. It's a win-win: for the customer, their data stays private and local, and the developer still has control over deployments, updates, and debugging. Alien provides infrastructure to deploy and operate software inside your users' environments, while retaining centralized control over updates, monitoring, and lifecycle management. It currently supports AWS, GCP, and Azure targets. GitHub: https://github.com/alienplatform/alien https://github.com/alienplatform/alien Getting started: https://alien.dev/docs/quickstart https://alien.dev/docs/quickstart How it works: https://alien.dev/docs/how-alien-works https://alien.dev/docs/how-alien-works Excited to share Alien with everyone here – let me know what you think!

cassianoleal 5mo ago
RCE into my environment? No, thanks.
- alongub 5mo ago
  It's not RCE. The commands are predefined RPCs written into the deployed code. Customers can review and approve them. Trust between the vendor and the customer is still required and Alien doesn't make it unnecessary.
  - cassianoleal 5mo ago
    It may not be arbitrary code but it's still remote code execution. The service provider has direct access to my infrastructure. It's one supply chain attack, one vulnerability, one missed code review away from data exfiltration or remote takeover.
    - armagnac2 5mo ago
      what better alternative do you have? It's either you go full SaaS, which means you rely 100% on the vendor, or work like 20 years ago with fully on prem. BYOC is the fine balance imo, that requires proper infra and implementation.
msteffen 5mo ago
IIUC this kind of thing is usually called “managed deployment.” Minio used to have a slick implementation of this, and I think databricks does as well. Usually it’s less “execute arbitrary commands on customer hosts,” and more “send metrics and logs to shared repository and send RPCs to customer deployment”
- alongub 5mo ago
  It's heavily inspired by Databricks' deployment model. And you're right that it's not "execute arbitrary commands". Commands are predefined functions in the deployed code that the developer defines upfront and customers can review. The metrics/logs part is also core to Alien... telemetry flows back to the vendor's control plane so you actually have visibility into what's running.
gsgreen 5mo ago
Even when you do control the environment, infra isn’t as stable as people think. Same VPS, same config, but under sustained load you’ll see latency creep or throughput drift depending on the host / routing / neighbors. Short tests almost never show it — only shows up after a few minutes.
- alongub 5mo ago
  Right, and that's when you do control the environment. Now imagine debugging that when it's your customer's infra, you have no access, and you're relying on them to copy-paste logs on a Zoom call.
antonvs 5mo ago
I worked for a few years on an on-premise deployment of a system that was otherwise SaaS. Many enterprise customers simply won’t allow something like this - particularly big financials, aviation, healthcare etc. Realistically, the game ends up being - see what you can get away with until someone notices. Given that, you might want to rename the product to something more boring than “Alien”.
- mrhottakes 5mo ago
  agreed, this architecture is a non-starter for many enterprise orgs
- alongub 5mo ago
  In practice, unmanaged self-hosting is often less secure, because you end up with outdated versions, unpatched vulnerabilities, and no one responsible for keeping things healthy. More and more enterprise CISOs are starting to understand this. The model here is closer to what companies like Databricks already do inside highly regulated environments. It's not new... it's just becoming more structured and accessible to smaller vendors.
  - OlivOnTech 5mo ago
    I don't agree, I see supply chains attacks as a bigger risk than outdated systems exposed only in the lan.
    - alongub 5mo ago
      Both are real risks. But supply chain attacks exist whether you self-host or not... you're still running the vendor's code either way. The question is whether you also want that code to stay up to date and properly managed, or drift silently.
      - nickmonad 5mo ago
        I agree that keeping things up to date is a good practice, and it would be nice if enterprise CISOs would get on board with that. One challenge we've seen is that other aspects of the business don't want things to be updated automatically, in the same way a fully-managed SaaS would be. This is especially true if the product sits in a revenue generation stream. We deal with "customer XYZ is going to update to version 23 next Tuesday at 6pm eastern" all the time.
nickmonad 5mo ago
> So you're stuck debugging a system you don't control, through screenshots and copy-pasted logs on a Zoom call. This is very real. I work with a deployment that operates in this fashion. Although unfortunately, we can't maintain _any_ connection back to our servers. Pull or push, doesn't matter. The goal right now is to build out tooling to export logs and telemetry data from an environment, such that a customer could trigger that export on our request, or (ideally) as part of the support ticketing process. Then our engineers can analyze async. This can be a ton of data though, so we're trying to figure out what to compress and how. We also have the challenge of figuring out how to scrub logs of any potentially sensitive information. Even IDs, file names, etc that only matter to customers.
- jcgrillo 5mo ago
  > This can be a ton of data though, so we're trying to figure out what to compress and how. We also have the challenge of figuring out how to scrub logs of any potentially sensitive information. This is fundamentally a data modeling problem. Currently computer telemetry data are just little bags of utf-8 bytes, or at best something like list<map<bytes, bytes>>. IMO this needs to change from the ground up. Logging libraries should emit structured data, conforming to a user supplied schema. Not some open-ended schema that tries to be everything to everyone. Then it's easy to solve both problems--each field is a typed column which can be compressed optimally, and marking a field as "safe" is something encoded in its type. So upon export, only the safe fields make it off the box, or out of the VPC, or whatever--note you can have a richer ACL structure than just "safe yes/no". I applaud the industry for trying so hard for so long to make everything backwards compatible with the unstructured bytes base case, but I'm not sure that's ever really been the right north star.
  - quesera 5mo ago
    Grand solutions require broad coordination, and they often devolve back into a modified-but-equivalent version of the previous problem. :( Stream-of-bytes is classically difficult model to escape. Many have tried.
    - 5mo ago
munksbeer 5mo ago
I very seldom, if ever, see a "Show HN" title with a suffix of "written in Java" or "written in python" or "written in Go". "Written in Rust" seems to be a very popular thing to add. My assumption is that people know it will get the thread more visibility?
- irickt 5mo ago
  The signal works both ways. "Written in Java" would save a lot of clicks. So the Java author may omit the label for the same reason. /s
nhatcher 5mo ago
I like it! I think if we are moving to a world (that is a big if) with more people self-hosting ideas like this one might have a future. A different take: https://www.cloudron.io/ https://www.cloudron.io/
- pixelbyindex 5mo ago
  same, I think there are a few folks who are starting to see the feasibility and the desirability in hosting their own solutions. I have been working on an idea to solve this, called minima host[0]. It is intended to be simple: - with the power of a mac mini, you can host (almost) anything - pay for the mini, it is your machine to do with as you please (we will host it for you) - if you decide you no longer need hosting, we will mail you back the machine that rightfully belongs to you if anyone is interested in becoming a partner, shoot me a message, felipe@ind3x.games - [0] https://www.minimahost.com/ https://www.minimahost.com/
huksley 5mo ago
Is it for managing my software deployed in the customer's cloud environment? Would you support simpler deployment targets, like on premises VMs etc? At DollarDeploy we developing the platform to deploy apps to VMs with managed services provided, kind of like Vercel for your own servers. Would be interesting to try alien for enterprise customers.
- alongub 5mo ago
  > Would you support simpler deployment targets, like on premises VMs etc? https://github.com/alienplatform/alien/blob/main/crates/alien-core/src/platform.rs#L12 https://github.com/alienplatform/alien/blob/main/crates/alie... :)
- mamcx 5mo ago
  Yep, I work for small companies and already have a sync server that wish to manage centrally for more than just updates
pruthviraja 5mo ago
Interesting approach. The managed self-hosting gap is real..we have run into this exact pain point with kubernetes based deployments where customers modify their cluster configs and things break silently. If I may ask how does Alien handle rollback if an update fails in a customer environment?is there any plan for on-prem/bare metal support beyond the big three clouds?
- alongub 5mo ago
  Alien is basically a huge state machine where every API call that mutates the environment is a discrete step, and the full state is durably persisted after each one. If something fails mid-update, it resumes from exactly where it stopped. You can also point a deployment to a previous release and it walks back. This catches and recovers from issues that something like Terraform would just leave in a broken state. For on-prem: we're working on Kubernetes as a deployment target (e.g. bare metal OpenShift)
  - pruthviraja 5mo ago
    i think the durable state machine approach is smart...that resume from where it stopped behavior is a big deal during incident response when you really dont want to rerun an entire deployment just because one step failed. K8s as a deployment target would be huge especially for the on-prem enterprise crowd. Will definitely keep an eye on that
    - alongub 5mo ago
      Thanks so much! If you have any other ideas, I'd really appreciate it if you could shoot them my way (alon AT alien dot dev)
      - pruthviraja 5mo ago
        For sure.. Thank you
  - rendaw 5mo ago
tanki 5mo ago
Such a big pain, I’ve experienced those issue first hand in my last two startups and it took so much time and effort Super cool product, I’ve gotta try it
- i_think_so 5mo ago
  Account created yesterday, exactly one comment. Meta: I presume youngish accounts like mine (who can't downvote yet) have no role to play in policing astroturfing like this, correct?
dvirsegev 5mo ago
I’ve been waiting for a solution like this for too long, can’t wait to try it!
EverMemory 5mo ago
[dead]

106 points by alongub 5mo ago

cassianoleal 5mo ago

RCE into my environment? No, thanks.

alongub 5mo ago
It's not RCE. The commands are predefined RPCs written into the deployed code. Customers can review and approve them. Trust between the vendor and the customer is still required and Alien doesn't make it unnecessary.
- cassianoleal 5mo ago
  It may not be arbitrary code but it's still remote code execution. The service provider has direct access to my infrastructure. It's one supply chain attack, one vulnerability, one missed code review away from data exfiltration or remote takeover.
  - armagnac2 5mo ago
    what better alternative do you have? It's either you go full SaaS, which means you rely 100% on the vendor, or work like 20 years ago with fully on prem. BYOC is the fine balance imo, that requires proper infra and implementation.

msteffen 5mo ago

IIUC this kind of thing is usually called “managed deployment.” Minio used to have a slick implementation of this, and I think databricks does as well. Usually it’s less “execute arbitrary commands on customer hosts,” and more “send metrics and logs to shared repository and send RPCs to customer deployment”

alongub 5mo ago
It's heavily inspired by Databricks' deployment model. And you're right that it's not "execute arbitrary commands". Commands are predefined functions in the deployed code that the developer defines upfront and customers can review. The metrics/logs part is also core to Alien... telemetry flows back to the vendor's control plane so you actually have visibility into what's running.

gsgreen 5mo ago

Even when you do control the environment, infra isn’t as stable as people think. Same VPS, same config, but under sustained load you’ll see latency creep or throughput drift depending on the host / routing / neighbors. Short tests almost never show it — only shows up after a few minutes.

alongub 5mo ago
Right, and that's when you do control the environment. Now imagine debugging that when it's your customer's infra, you have no access, and you're relying on them to copy-paste logs on a Zoom call.

antonvs 5mo ago

I worked for a few years on an on-premise deployment of a system that was otherwise SaaS. Many enterprise customers simply won’t allow something like this - particularly big financials, aviation, healthcare etc. Realistically, the game ends up being - see what you can get away with until someone notices. Given that, you might want to rename the product to something more boring than “Alien”.

mrhottakes 5mo ago
agreed, this architecture is a non-starter for many enterprise orgs
alongub 5mo ago
In practice, unmanaged self-hosting is often less secure, because you end up with outdated versions, unpatched vulnerabilities, and no one responsible for keeping things healthy. More and more enterprise CISOs are starting to understand this. The model here is closer to what companies like Databricks already do inside highly regulated environments. It's not new... it's just becoming more structured and accessible to smaller vendors.
- OlivOnTech 5mo ago
  I don't agree, I see supply chains attacks as a bigger risk than outdated systems exposed only in the lan.
  - alongub 5mo ago
    Both are real risks. But supply chain attacks exist whether you self-host or not... you're still running the vendor's code either way. The question is whether you also want that code to stay up to date and properly managed, or drift silently.
    - nickmonad 5mo ago
      I agree that keeping things up to date is a good practice, and it would be nice if enterprise CISOs would get on board with that. One challenge we've seen is that other aspects of the business don't want things to be updated automatically, in the same way a fully-managed SaaS would be. This is especially true if the product sits in a revenue generation stream. We deal with "customer XYZ is going to update to version 23 next Tuesday at 6pm eastern" all the time.

nickmonad 5mo ago

> So you're stuck debugging a system you don't control, through screenshots and copy-pasted logs on a Zoom call. This is very real. I work with a deployment that operates in this fashion. Although unfortunately, we can't maintain _any_ connection back to our servers. Pull or push, doesn't matter. The goal right now is to build out tooling to export logs and telemetry data from an environment, such that a customer could trigger that export on our request, or (ideally) as part of the support ticketing process. Then our engineers can analyze async. This can be a ton of data though, so we're trying to figure out what to compress and how. We also have the challenge of figuring out how to scrub logs of any potentially sensitive information. Even IDs, file names, etc that only matter to customers.

jcgrillo 5mo ago
> This can be a ton of data though, so we're trying to figure out what to compress and how. We also have the challenge of figuring out how to scrub logs of any potentially sensitive information. This is fundamentally a data modeling problem. Currently computer telemetry data are just little bags of utf-8 bytes, or at best something like list<map<bytes, bytes>>. IMO this needs to change from the ground up. Logging libraries should emit structured data, conforming to a user supplied schema. Not some open-ended schema that tries to be everything to everyone. Then it's easy to solve both problems--each field is a typed column which can be compressed optimally, and marking a field as "safe" is something encoded in its type. So upon export, only the safe fields make it off the box, or out of the VPC, or whatever--note you can have a richer ACL structure than just "safe yes/no". I applaud the industry for trying so hard for so long to make everything backwards compatible with the unstructured bytes base case, but I'm not sure that's ever really been the right north star.
- quesera 5mo ago
  Grand solutions require broad coordination, and they often devolve back into a modified-but-equivalent version of the previous problem. :( Stream-of-bytes is classically difficult model to escape. Many have tried.
  - 5mo ago

munksbeer 5mo ago

I very seldom, if ever, see a "Show HN" title with a suffix of "written in Java" or "written in python" or "written in Go". "Written in Rust" seems to be a very popular thing to add. My assumption is that people know it will get the thread more visibility?

irickt 5mo ago
The signal works both ways. "Written in Java" would save a lot of clicks. So the Java author may omit the label for the same reason. /s

nhatcher 5mo ago

I like it! I think if we are moving to a world (that is a big if) with more people self-hosting ideas like this one might have a future. A different take: https://www.cloudron.io/ https://www.cloudron.io/

pixelbyindex 5mo ago
same, I think there are a few folks who are starting to see the feasibility and the desirability in hosting their own solutions. I have been working on an idea to solve this, called minima host[0]. It is intended to be simple: - with the power of a mac mini, you can host (almost) anything - pay for the mini, it is your machine to do with as you please (we will host it for you) - if you decide you no longer need hosting, we will mail you back the machine that rightfully belongs to you if anyone is interested in becoming a partner, shoot me a message, felipe@ind3x.games - [0] https://www.minimahost.com/ https://www.minimahost.com/

huksley 5mo ago

Is it for managing my software deployed in the customer's cloud environment? Would you support simpler deployment targets, like on premises VMs etc? At DollarDeploy we developing the platform to deploy apps to VMs with managed services provided, kind of like Vercel for your own servers. Would be interesting to try alien for enterprise customers.

alongub 5mo ago
> Would you support simpler deployment targets, like on premises VMs etc? https://github.com/alienplatform/alien/blob/main/crates/alien-core/src/platform.rs#L12 https://github.com/alienplatform/alien/blob/main/crates/alie... :)
mamcx 5mo ago
Yep, I work for small companies and already have a sync server that wish to manage centrally for more than just updates

pruthviraja 5mo ago

Interesting approach. The managed self-hosting gap is real..we have run into this exact pain point with kubernetes based deployments where customers modify their cluster configs and things break silently. If I may ask how does Alien handle rollback if an update fails in a customer environment?is there any plan for on-prem/bare metal support beyond the big three clouds?

alongub 5mo ago
Alien is basically a huge state machine where every API call that mutates the environment is a discrete step, and the full state is durably persisted after each one. If something fails mid-update, it resumes from exactly where it stopped. You can also point a deployment to a previous release and it walks back. This catches and recovers from issues that something like Terraform would just leave in a broken state. For on-prem: we're working on Kubernetes as a deployment target (e.g. bare metal OpenShift)
- pruthviraja 5mo ago
  i think the durable state machine approach is smart...that resume from where it stopped behavior is a big deal during incident response when you really dont want to rerun an entire deployment just because one step failed. K8s as a deployment target would be huge especially for the on-prem enterprise crowd. Will definitely keep an eye on that
  - alongub 5mo ago
    Thanks so much! If you have any other ideas, I'd really appreciate it if you could shoot them my way (alon AT alien dot dev)
    - pruthviraja 5mo ago
      For sure.. Thank you
- rendaw 5mo ago

tanki 5mo ago

Such a big pain, I’ve experienced those issue first hand in my last two startups and it took so much time and effort Super cool product, I’ve gotta try it

i_think_so 5mo ago
Account created yesterday, exactly one comment. Meta: I presume youngish accounts like mine (who can't downvote yet) have no role to play in policing astroturfing like this, correct?

dvirsegev 5mo ago

I’ve been waiting for a solution like this for too long, can’t wait to try it!

EverMemory 5mo ago

[dead]