At Namespace (namespace.so), we also take things one step further: GitHub jobs run under a cgroup with a subset of privileges by default.
Running a job with full capabilities, requires an explicit opt-in, you need to enable "privileged" mode.
Building a secure system requires many layers of protection, and we believe that the runtime should provide more of these layers out of the box (while managing the impact to the user experience).
I spend a lot of time in CI (building https://namespace.so) and I agree with most of this:
- Treat pipelines as code.
- Make pipelines parts composable, as code.
- Be mindful of vendor lock-in and/or lack of portability (it is a trade-off).
For on-promise: if you're already deeply invested in running your own infrastructure, that seems like a good fit.
When thinking about how we build Namespace -- there are parts that are so important that we just build and run internally; and there are others where we find that the products in the market just bring a tremendous amount of value beyond self-hosting (Honeycomb is a prime example).
Hugo here, founder at Namespace. We built Foundation based on what we learned from building Boq at Google — the app platform that drives the dev/prod workflow of many of Google’s main apps.
We leaned heavily on composition that spans build, test and production. You can define assets that yield code-level infrastructure definitions and also are automatically configured based on environment (dev vs test vs prod).
It was great building it, and we use it to build Namespace (namespace.so); our development-focused platform.
100% -- EC2's general purpose nature is not in my opinion the best fit for ephemeral use-cases. You'll be constantly fighting the infrastructure as the set of trade-offs and design goals are widely different.
This is why CodeSandbox, Namespace, and even fly.io built special-purpose architectures to guarantee extremely start-up time.
In the case of Namespace it's ~2sec on cold boots with a set of user-supplied containers, with storage allocations.
Hi -- Namespace's CEO here; if you have a chance, please drop me a note at hugo-at-namespacelabs.com; I'd love to hear what we could be doing better in the UI, and product overall. Thank you!