Managed Kubernetes · hosted in Europe
Start from a template, not an empty directory. Keep your agents running 24/7 on real infrastructure instead of your laptop. Keep your code in a git you own, in Europe. Ship it with one push.
A push to main builds an image, writes the tag to the GitOps repository, and Argo CD rolls it out. The app is live at checkout-api.acme.z3k.sh.
How it works
The first deploy takes about two minutes. Every one after that is a push — whether it came from you or from an agent.
Start from one of eleven runtime templates — Go, Node, Python, Rust, Ruby, Elixir, PHP, Java, Next.js, static, or your own Dockerfile. Already have a repo on GitHub or GitLab? Import it, and we add the Dockerfile and the build workflow it's missing.
Our runners build an immutable image tagged with your commit and push it to your private registry. The new tag is written back to the GitOps repository as a commit — so the record of what is running is a git history, not a dashboard.
Argo CD reconciles the change, Traefik picks up the route and cert-manager issues the certificate. You get app.yourteam.z3k.sh immediately, and your own domain whenever you point it at us.
Agents
A workspace is a pod on the cluster, not a process on your machine. Launch one next to any app and it comes up with the repository already cloned, a key that can push, and claude, codex and opencode already installed. Close the tab, shut the lid, get on a plane — it keeps working.
Batteries included
Eleven runtime templates on hardened base images, and one chart that already knows how to do the boring parts. Most of what follows is a toggle in the console — and every change it makes is a commit you can read.
Go · Node · Python · Rust · Ruby · Elixir · PHP · Java · Next.js · static · your own Dockerfile
distroless and alpine runtimes, non-root, read-only rootfs, matching build images with the toolchain already in them
ingress · TLS · health probes · autoscaling · resources · secrets · cron · add-ons
Open a pull request, get
app-pr-12.yourteam.z3k.sh on its own namespace.
Close it and the environment is pruned. Lock previews to an IP
range when they shouldn't be public.
Runtime logs stream into the browser live — not a 30-second refresh. Build logs sit next to them, one click from the failing job.
Every deploy is a commit, so every rollback is one too. Pick a past deploy, read the diff, and the platform commits the revert for you.
Import a repository from GitHub or GitLab and we add the Dockerfile and build workflow it's missing. Point its push webhook at us and it deploys on every commit, wherever it lives.
PostgreSQL on CloudNativePG and a Valkey cache are add-ons on a toggle. Backed up on a schedule with Velero, restore included.
Environment variables and secrets live in OpenBao and are projected into the pod. Change one and the deployment rolls itself — no redeploy to remember.
Point a record at us and the certificate is issued and renewed without you. Wildcard hostnames for every app and every preview come with the team.
CPU, memory, response time and a running monthly cost for each app — in the same console, not a separate billing portal you forget exists.
Under the hood
Not a mirror of someone else's. The forge runs on this platform, on hardware in Germany, and it holds both your application and the file that describes how it runs. The console is a nice way to edit that file — that's all it is.
image:
repository: git.z3k.sh/acme/checkout-api
tag: "main-9f2c4ab" # written by the build
replicaCount: 2
resources:
requests: { cpu: 100m, memory: 128Mi }
ingress:
hosts:
- host: checkout-api.acme.z3k.sh
- host: api.acme.example
addons:
postgres:
enabled: true
instances: 2
valkey:
enabled: true
maxmemory: 96mbIsolation
The heavy machinery — GitOps, secrets, identity, metrics — runs once on a hub cluster. Each team gets its own virtual cluster with its own API server, its own quota and its own namespaces, so a noisy neighbour stays a neighbour.
The hub holds no tenant credentials. Every team is fenced by a separate Argo CD project, a separate secret policy and a separate identity group — three locks, not one.
Pricing
No cluster fee, no ingress fee, no charge for a second environment. Preview environments are free.
€15/ month
Anyone on your team with console access — deploys, logs, secrets, rollbacks, workspaces.
€5/ month
Each deployed app, with its hostname, TLS, build pipeline and preview environments included.
Metered/ month
What your apps actually consume in CPU and memory, shown as a running total in the console before it's ever invoiced.
Billed monthly, cancel from the console. See it on your own workload →
Create a team, pick a runtime, and watch the URL come up. If it isn't live in a couple of minutes, we'd want to hear about it.