Infrastructure

Deploy into environments you don’t control.

Deploy and update thousands of customer clouds, clusters, and servers from one control plane, with least-privilege access and continuous health checks.

Read the docs Talk to us
Release 3f9a2c1124 of 1,240 environments updated
AWS6/412
Google Cloud4/236
Azure3/171
Kubernetes56/254
On-prem servers55/167
Push: updated right away Pull: updated on the next check-in Retrying a failed step

Approved once. Updated every day.Their security team approves it once. You ship every day.

FrozenCreated once at initial setup
  • VPCNetwork
  • S3 bucketStorage
  • IAM roleManagement identity
  • KMS keyKey

By the customer’s admin, with their own credentials.

LiveRelease b47e0d9 arriving
  • apiContainer×33f9a2c1
  • webContainer×23f9a2c1
  • ingestContainer×23f9a2c1
  • workerWorker3f9a2c1
  • schedulerWorker3f9a2c1

By Alien, on every release. No admin involved.

Frozen and live

Start from the code you have.Paste one prompt into your coding agent.

Add Alien to this product
Help me add Alien (https://alien.dev/docs) to this product so it meets an enterprise customer's data requirements. 1. Install the Alien skills: npx skills add alienplatform/skills 2. Use the alien-architecture skill. Inspect this repository, including its services, Dockerfiles, Helm charts or Docker Compose files, and Terraform. Ask me what the customer requires, then propose the smallest option that meets it: customer-managed keys, local AI models, or a deployment in their cloud or on their servers. 3. Wait for my choice before editing. 4. Use the alien-integration skill to build it and verify one request end to end. Treat the installed packages and `alien --help` as the API source of truth. Don't publish a release or create a customer deployment without asking.
Build with an AI agent

Write against one set of well-tested primitives.

WorkerServerless functions that run on requests, events, and schedules.Runs onAWS: LambdaGoogle Cloud: Cloud RunAzure: Container AppsKubernetes: Deployment and ServiceLinux servers: Not supportedContainerLong-running services.Runs onAWS: EC2 machinesGoogle Cloud: Compute Engine machinesAzure: Azure VMsKubernetes: Deployment, or StatefulSet when statefulLinux servers: Containers on your hosts (stateless)DaemonOne process on every machine or node.Runs onAWS: One per EC2 machineGoogle Cloud: One per Compute Engine machineAzure: One per VMKubernetes: DaemonSetLinux servers: One per hostStorageFiles and objects.Runs onAWS: S3Google Cloud: Cloud StorageAzure: Blob StorageKubernetes: An existing service (external binding)Linux servers: An existing service (external binding)QueueWork items between components.Runs onAWS: SQSGoogle Cloud: Pub/SubAzure: Service BusKubernetes: An existing service (external binding)Linux servers: An existing service (external binding)PostgresManaged PostgreSQL.Runs onAWS: Aurora Serverless v2Google Cloud: Cloud SQLAzure: Flexible ServerKubernetes: An existing service (external binding)Linux servers: An existing service (external binding)KeyAn encryption key the customer owns and can revoke.Runs onAWS: KMSGoogle Cloud: Cloud KMSAzure: Key Vault keysKubernetes: Only on a cloud base platformLinux servers: Not supportedAIModels in the customer’s account.Runs onAWS: Amazon BedrockGoogle Cloud: Vertex AIAzure: Azure AI FoundryKubernetes: An existing AI endpointLinux servers: An existing AI endpoint
See more primitives$ alien devThe whole stack on your laptop. No cloud account.

Update a thousand customers.Without running a thousand processes.

terraform apply1,000 runs
0 of 1,000~42 hours left
Still creating... [2m6s elapsed]the rest wait in line
terraform apply, one customer at a time. Each run takes minutes, so a thousand customers wait in line.
Alien1 process
308 of 1,000in flight
1,000 in flight · nothing held while waitingchecks back when each cloud is done
Alien, one manager for all of them. Every update starts at once.

Push, pull, or air-gapped.Whatever their network allows, every customer still gets your releases.

Architecture diagram. Left: Your cloud containing Alien manager. Right: Their AWS containing IAM role.

Push: Alien calls their cloud’s APIs through a scoped role. No agent to install.

Architecture diagram. Left: Your cloud containing Alien manager. Right: Their cluster containing Operator.

Pull: the Operator connects out over HTTPS. Nothing listens inbound.

Architecture diagram. Left: Your cloud containing Alien manager. Right: Isolated site containing Operator.

Air-gapped: an admin carries a signed folder of updates in, and a report out.
Push, pull, and air-gappedThe engine is open source, and deployments use standard cloud APIs.alienplatform/alien

Every step is saved. Every failure resumes.When an API call fails, Alien retries that call, not the deployment.

  1. 1Create functionCreateStart
  2. 2Wait until activeCreateWaitForActive
  3. 3Import certificateImportingCertificate
  4. 4Create HTTP APICreatingApiGateway
  5. 5Wait for DNSWaitingForDns
  6. 6Call it over HTTPSRunningReadinessProbe
  7. 7Grant permissionsApplyingResourcePermissions
  8. 8LiveReady

Each step makes one API call and saves the result.

A throttled API, an expired session, or a restarted process costs one step.How it works

Terraform stops at apply. Alien keeps watching.Heartbeats and drift checks on every environment.

Customer 4AWS · us-east-1 · 3f9a2c1Healthy
apiLambdachecked 0s agoHealthy
dataS3checked 7s agoHealthy
tasksSQSchecked 14s agoHealthy
secretsSSM Parameter Storechecked 21s agoHealthy
Every resource, every 30 seconds, with read-only calls.

Customers change IAM policies, delete resources, and edit settings in their console. You see it before they open a ticket.Deployment health

What if Alien goes down?Their deployment keeps running. New releases, commands, and operations wait until the connection returns.

Alien managerConnected
  • Nothing waiting
Their deploymentRunning
  • processorWorker
  • indexKv
  • documentsStorage
18,240 requests served

Code, resources, and data in their environment don’t depend on the connection. With pull, the Operator retries until Alien answers.When Alien is unreachable

And after it’s deployed.

Permissions from your code

Setup gets one policy. Day-to-day management gets a smaller one. Neither reads customer data.

Permissions

Automatic updates

Ship a release and every deployment follows, or waits for the customer’s approval.

Releases

Setup in their tool

Their admin runs the setup Alien generates: CloudFormation, Terraform, Helm, or your CLI.

Customer setup

Deploy your first stack.

Run it locally with alien dev, then deploy it to a cloud account you control.

Talk to us Open the quickstart