Platform
What sits underneath your application.
gh0stcloud is Kubernetes, but nobody asks you to operate Kubernetes. This page describes what we run, how a change reaches the runtime, and what we explicitly do not promise.
- Foundation
- Kubernetes
- Open formats: container images and Helm charts. No proprietary application format holding you here.
- Location
- Germany
- Hetzner data centres certified to ISO 27001, powered by renewable electricity.
- Route to runtime
- Git only
- Every change is a commit, so it stays traceable who wanted what and when.
Structure
Four layers, and who operates them
gh0stcloud keeps three things apart: what you want, what is permitted, and what is actually running. That separation is why we can operate the platform without taking control of your application.
| Four layers, and who operates them | What it is for | Who operates it |
|---|---|---|
| Portal | Shows applications, cost and state. Takes change requests. | gh0stservice |
| Platform API | Decides what your account is allowed to do, and records the decision. | gh0stservice |
| Git | Holds the desired state of your application. | You |
| Runtime | Your workloads, their namespaces, network rules, storage and monitoring. | Operated by us, filled by you |
Included
What the platform brings with it
All of this is in place before your first application starts.
Separated environments
Each organisation runs in its own namespaces with its own access and resource boundaries.
Managed sign-in
Accounts, organisations and roles, without you running an identity provider.
Secrets
Passwords and tokens live in a managed vault rather than in your repository.
Networking and TLS
Ingress, certificates and network rules are in place. You describe what should be reachable.
Storage and backups
Persistent volumes with backups and a documented way back.
Per-organisation monitoring
Metrics and logs for your applications, separated from every other customer's.
Cost attribution by the hour
Usage is measured and attributed rather than estimated at the end of the month.
No cluster admin required
Everything you are allowed to do goes through the portal, Git and gh0stcli. A compromised laptop does not become a compromised cluster.
Sequence
How a change reaches the runtime
You describe the target state
As a commit in your repository. That commit is the record of what you wanted.
The platform checks it
Against what your account may do. A repository cannot grant itself rights the account does not already hold.
The change is delivered
In a controlled way, and then held against drift.
You see the result
In the portal, showing the state that is actually running. Not the one that was planned.
The details are in the documentation.
Architecture, security, networking, storage and billing are publicly documented, including the parts that are inconvenient.
This page describes how the product is built, not its internals. Component versions and internal boundaries change during normal operation; none of that changes what you can do or what you pay. What is binding is in your contract and your support agreement.