For production GPU cloud deployments with untrusted tenants, Private Nodes (dedicated worker nodes joined directly and privately into each tenant cluster over encrypted WireGuard VPN) are the recommended default. In dev, test, and trusted-team scenarios, provision fully isolated, CNCF-certified tenant clusters directly on GPU hardware. vMetal eliminates VM overhead and k3s dependencies so you launch faster at bare metal performance.
Traditional approaches force costly tradeoffs between performance, isolation, and time to market.
Hypervisor layers between your bare metal and workloads waste GPU cycles and add latency your tenants will notice.
Tenants can see platform internals they should not: cluster-wide agents, other tenants' nodes and pods.
Building a GPU cloud platform in-house requires significant engineering investment.
vCluster delivers the complete path from GPU rack to managed Kubernetes. vMetal handles zero-touch bare metal provisioning, vCluster Standalone runs as a binary directly on bare metal with no k3s or kubeadm dependency, and every tenant gets a fully isolated, CNCF-certified Kubernetes cluster in seconds.
Every layer of the stack is purpose-built for AI cloud providers running workloads directly on GPU hardware.
vMetal handles PXE boot, OS installation, machine registration, and full GPU server lifecycle management from rack to production, with no manual steps and no external dependencies.
vCluster Standalone runs directly on bare metal Linux as a lightweight binary, no k3s, kubeadm, or external Kubernetes layer required. The simplest path to bare metal Kubernetes.
Each tenant gets a dedicated API server, etcd, scheduler, and RBAC running as a lightweight pod, fully isolated, CNCF-certified Kubernetes without provisioning separate physical clusters. For production deployments with untrusted tenants, Private Nodes, dedicated worker nodes with per-tenant CNI and storage, deliver hardware-level isolation.
Auto Nodes acts as bare metal Karpenter, automatically provisioning GPU nodes via Terraform when tenants schedule workloads, so hardware scales with demand without manual intervention.
vNode delivers container breakout protection using seccomp, cgroups, namespaces, and AppArmor, preserving bare metal GPU performance while preventing workload escape across tenant boundaries.
This isn’t a side project. Behind every vCluster deployment is 5+ years of deep K8s engineering, security hardening, and battle-tested infrastructure work at massive scale.
Talk to our team about your stack
Deploy vCluster on your infra in minutes
Go live with a hyperscaler-grade tenant experience in days
vCluster Standalone runs as a single binary directly on bare metal Linux, replacing k3s or kubeadm as the base layer entirely. Beyond the control plane binary itself, vMetal adds zero-touch provisioning (PXE boot, OS installation, machine registration, and network automation) so you go from a bare rack to a production Kubernetes cluster without manual steps. Stacked on top, each tenant gets a fully isolated, CNCF-certified Kubernetes cluster in seconds: which k3s and kubeadm do not provide natively without additional tooling.
vCluster virtualizes the Kubernetes control plane itself. Each tenant receives a dedicated API server, etcd, scheduler, and RBAC running as a lightweight pod inside the control plane cluster. Tenants cannot see other tenants' nodes, pods, or platform internals. For stronger isolation, tenants can be assigned Private Nodes: fully dedicated physical hardware with their own CNI and CSI. vNode prevents container breakout and limits blast radius at the container level without any hypervisor overhead.
Yes. The full stack (vMetal for bare metal provisioning, vCluster Standalone as the CNCF-certified control plane binary, and vCluster for tenant cluster orchestration) is production-proven across 100K+ GPU nodes. vCluster is named in the NVIDIA DGX SuperPOD reference architecture. Auto Nodes automatically provisions GPU bare metal via Terraform when tenant workloads are scheduled, and vNode preserves bare metal GPU performance while enforcing workload isolation.
Boost Run launched a managed Kubernetes service in less than 45 days using vCluster. Lintasarta launched a GPU cloud in Indonesia in 90 days using vCluster and vMetal. vMetal's zero-touch provisioning eliminates the manual steps typically required to stand up bare metal Kubernetes, and partner integrations with Run:AI, Ray, and Jupyter can dramatically reduce platform integration time.
Yes. Every tenant cluster created by vCluster runs a CNCF-certified Kubernetes control plane: 100% API-compatible with upstream Kubernetes. Tenants interact with a real Kubernetes API server, can install their own CRDs, and have full cluster-admin access within their isolated environment. This holds true whether control planes run as lightweight pods or as dedicated VMs for stricter OS-level separation.
Yes. vCluster supports air-gapped and FIPS deployment for environments with strict compliance or network isolation requirements. Combined with vMetal's on-premises bare metal provisioning and vNode's container breakout protection, the full stack can operate in disconnected environments without dependence on cloud APIs or external registries. This makes it suitable for regulated enterprises and GPU cloud providers with data sovereignty requirements.
See how vCluster powers GPU clouds from rack to isolated tenant clusters.
