What runners do
A runner handles everything that touches your code:- Environment provisioning — spins up isolated VMs from your Dev Container configuration
- Source code access — clones repositories using credentials stored on the runner, not the management plane
- Secret injection — delivers secrets into environments at startup
- Agent execution — runs Ona Agent tasks inside the same isolated environments developers use
- Build and test execution — runs prebuilds, tasks, and services defined in your project
How runners fit into the architecture
Ona uses a two-plane architecture:| Management Plane | Runners | |
|---|---|---|
| Hosted by | Ona | Ona Cloud or your VPC |
| Handles | Authentication, org settings, guardrails, coordination | Environment provisioning, code access, secret injection, agent execution |
| Touches your code | No | Yes |
- Data sovereignty. Source code and SCM credentials are handled by runners, not the management plane. With a runner in your VPC, all sensitive assets stay in your infrastructure.
- Compliance. Guardrails are defined centrally on the management plane and enforced at the runner level. Audit logs track every action.
- Flexibility. Deploy runners in different regions and cloud providers. Each runner supports multiple environment classes with different compute specs.
Deployment options
Ona Cloud
Zero-setup managed infrastructure. A runner in your nearest region is automatically provisioned when you create your account.- No infrastructure to manage
- Available in EU (Frankfurt) and US (N. Virginia), with more regions on the way
- Included with Free and Core plans
AWS
Requires Enterprise plan. Contact sales for access.
- Private networking with AWS PrivateLink
- Custom domains with your own SSL/TLS certificates
- Fine-grained IAM permission boundaries
- HTTP proxy and custom CA support
GCP
Requires Enterprise plan. Contact sales for access.
- External or internal load balancer configurations
- Private Google Artifact Registry access
- Vertex AI private connectivity
- Full control over networking and security
Choosing a deployment option
| Ona Cloud | AWS / GCP (your VPC) | |
|---|---|---|
| Setup time | Instant | 30–60 minutes |
| Infrastructure | Managed by Ona | Managed by you |
| Data residency | Ona’s infrastructure | Your VPC |
| Network control | Standard | Full (PrivateLink, internal LB, VPN) |
| Compliance | SOC 2 | Your controls + Ona guardrails |
| Best for | Getting started, small teams | Enterprise, regulated industries |
Shared capabilities
All runners — Ona Cloud, AWS, and GCP — support:- Prebuilds for fast environment startup
- Ona Agent for AI-powered development
- Environment classes with configurable compute (CPU, memory, storage)
- Dev Container caching for faster rebuilds
- Monitoring and metrics for operational visibility
- Runner sharing across organizations
Next steps
- Ona Cloud — get started with zero setup
- AWS Setup — deploy a runner in your AWS account
- GCP Setup — deploy a runner in your GCP project
- Architecture overview — how the management plane and runners interact
- Capacity planning — plan infrastructure requirements for runners in your VPC