We've spent the last year building RunOS, a platform that spins up production-ready Kubernetes clusters in 5-10 minutes with databases, message queues, observability, and AI tooling configured.

The Problem

Every team rebuilds the same Kubernetes infrastructure: networking, certificates, monitoring, databases, storage. The existing solutions either lock you into a vendor ecosystem or dump you into raw Kubernetes complexity. We wanted the control of self-hosting without weeks of setup.

Architecture

Our system uses two agent types:

Server agents run on VM hosts and communicate with our backend via gRPC bidirectional streams. When users request a cluster node, the agent provisions a KVM-based VM and bootstraps it.

Node agents run on each Kubernetes node and handle cluster operations, monitoring, and service installations.

Key insight: gRPC streams initiated by agents eliminate firewall configuration and public IP requirements. Agents reach out to our backend, not vice versa.

Why KVM?

- Battle-tested, works great with Ubuntu - Solid Go bindings via libvirt - Excellent GPU passthrough for AI workloads like Ollama - Good isolation/performance balance

Sometimes boring technology is the right choice.

Provisioning Flow

1. User clicks "Create Cluster" 2. Backend selects available server agents 3. gRPC commands sent to provision VMs 4. KVM VMs spin up (Ubuntu Cloud 24.04, 30-60 seconds) 5. Node agents install and connect 6. Kubernetes bootstrap with kubeadm + Cilium 7. WireGuard mesh established between nodes 8. Storage configured (OpenEBS + Longhorn) 9. Cluster ready (5-10 minutes total)

The WireGuard Decision

We manage WireGuard at the OS level, not Kubernetes level. Why?

- Same VPN secures both K8s traffic and SSH access - Nodes communicate securely even if Kubernetes fails - Simpler troubleshooting with separated layers - Easier multi-cluster peering (coming soon)

Our backend orchestrates WireGuard configs across nodes via the agents. Centrally coordinated, locally executed.

Version Management Hell

The hardest problem? Keeping 20+ services compatible across updates.

We offer one-click installation of: PostgreSQL, MySQL, ClickHouse, Kafka, RabbitMQ, MinIO, Longhorn, Harbor, Traefik, Grafana, Prometheus, Ollama, LiteLLM, Open WebUI, and more.

Each has opinions about K8s versions, storage, and networking. We use Helm charts, operators, and custom YAML as appropriate. The real work is maintaining compatibility matrices and testing every combination.

Deployment Models

RunOS Cloud: Managed dedicated servers with fixed 8 CPU/16GB instances (free trial credits available). KVM handles VM provisioning with GPU passthrough for AI workloads. Strict security since it's early access.

Bring Your Own Node: Run node agents on any hardware. Complete tenant isolation since you control infrastructure.

Coming soon: Self-managed VM hosts with custom sizing.

What's Next

Agent code will be open source. One company runs three production clusters already. Common feedback: "I can't believe how fast I went from zero to a working cluster with Postgres, Kafka, and monitoring."

We're planning weekly updates here on HackerNews about new features, technical challenges, and production lessons.

Try it at runos.com - free trial credits for 8 CPU threads and 16GB memory.

Questions? Happy to discuss architecture in the comments.

Paystack suspends co-founder, Ezra Olubi, over sexual misconduct allegation

Show HN: A 1600 Page Data Structures Book with 130 Problems for Interviews

Ask HN: What's your solution to tech addiction?

Show HN: A desktop tool for Kubernetes and GitOps (Flux/Argo) in one view

Ask HN: Is Computer Science still a good choice?

Ingress Nginx Retirement: Deadlines, Risks, and Your Path Forward

Show HN: A website to compare team activity on GitHub

Fedora 44 Looking at Replacing Fbcon with Kmscon as Default VT Console

Our local GitLab server has been under attack by Anthropic Google OVH and more

Show HN: We built instant Kubernetes provisioning with KVM and gRPC

GNU C Library Adds Linux "Mseal" Function for Memory Sealing

Show HN: Java Fake Data Generator

X Did This Years Ago

Ogham Transliterator

A Novel Concurrency Testing Tool That Improved the Kotlin Compiler

The Lost Nuance of Grep vs. Semantic Search

Jeffrey Epstein's Links to Scientists Are More Extensive Than We Thought

Kubernetes, cloud-native computing's engine, is getting turbocharged for AI

Show HN: TalkiTo – enabling voice and Slack for Claude Code and Codex CLI

A Plumber Will Earn More Than a Programmer in the Next Decade

Secret EU plans to allow Big Tech to train AI with our personal data

There is no such thing as a 3.5 inch floppy disc

Why Moving Fast Matters More Than Getting Everything Perfect

I Just Lost $150

IPv6 in the UK 6 years after World IPv6 day

Google must pay German price comparison platform 465M euros in damages

Static Bundle Object: Death by a thousand cuts

Long ago my first JavaScript project was a Pythagorean tree – I overreached

Egypt's 155mph high-speed trains unveiled

AGCI: A Benchmark for Testing Long-Chain Reasoning Stability in AI Models

Ask HN: What's a good app for recording YouTube tech videos?

Comments