Compute deployments

Hosts for deploy units you decided to run. Place concerns first — What runs where — then pick a platform. This catalog is part of Architecture, not a rival “track” to project shapes.

Pick a target because constraints demand it — not because it’s fashionable. Pair with kiss and repos architecture before adding a second cloud.

flowchart TD
  P[What runs where] --> U[Name deploy unit]
  U --> C{Constraints}
  C -->|static / edge site| V[Vercel / Cloudflare / Pages]
  C -->|event / spike| L[Serverless]
  C -->|portable process| D[Docker]
  C -->|many services / ops team| K[Kubernetes]
  C -->|IaaS / managed| Cloud[AWS / GCP / Fly]

Choose a target

Path	Fit when…	Default stance
Serverless	Event-driven, spiky, short work, managed scale	Least ops; watch cold start & limits
Docker	Same artifact local → CI → host	Portable process; one image per unit
Kubernetes	Many services, real ops capacity	Earned complexity only
Vercel	Frontend / Next-style app, preview deploys	Ship UI fast; don’t force backends here
Cloudflare	Edge, Workers, static+KV/R2	Latency & global; respect isolate limits
Clouds — AWS, GCP, Fly.io	Managed IaaS/PaaS mix	ESC secrets; explicit regions & blast radius

Shared rules (every compute path)

1. One deploy unit with a done-when and owner (Work Ownership).
2. Secrets via Pulumi ESC + OIDC by default — repos secrets setup (Repos); no long-lived cloud keys in GitHub if ESC works.
3. CI proves the artifact before promote — repos ci · test-it · check-readiness · stage-it / ship-it as policy allows.
4. Observe what you ship — observe-it for the critical path; don’t invent a full APM estate on day one.
5. kiss before a second platform — multi-cloud is usually smoke unless constraints are real.

Reading order

1. Skim What runs where and your lifecycle phase.
2. Open the compute page that matches constraints.
3. Draw: KISS · Repos · Ship · Observe It · Agent Slap if deploy agents thrash.

Anti-patterns

• “Kubernetes for a single static site”
• Host shopping before placement
• Copy-pasting cloud keys into GitHub Secrets after ESC is available
• Deploying every monorepo package because one library changed
• Three hosts (Vercel + Fly + raw EC2) with no ownership map