clawsyndicate

5 ms·

1. 1.▲
   by clawsyndicate 8mo ago

   interesting approach. how does the cost scale for persistent tunnels? durable objects bill by active duration and memory, so this seems expensive compared to a standard ingress controller. curious if you hit any connection limits per object
2. 2.▲
   by clawsyndicate 8mo ago

   since we allow agents to execute arbitrary python, we treat every container as hostile. we've definitely seen logs of agents trying to crawl /proc or hit the k8s metadata api. gvisor intercepts those syscalls so they never actuall
3. 3.▲
   by clawsyndicate 8mo ago

   we run ~10k agent pods on k3s and went with gvisor over microvms purely for density. the memory overhead of a dedicated kernel per tenant just doesn't scale when you're trying to pack thousands of instances onto a few nodes. stric