Build & Run Agents·production

IAM.Hosting

Serverless runtime and lifecycle management for hosted agents in Kubernetes.

Landing Application

Key capabilities

  • Scale-to-zero agent workloads
  • Execution isolation and scoped credentials
  • Wake, reap, quota and runtime-health lifecycle

Step-by-step guides

Use cases

Start with the outcome: open a guide, prepare prerequisites, follow the steps and verify the success signals.

01 Find and wake a serverless agentA sleeping deployment moves to waking/running and the operator sees latency and replica state.
Audience
Platform operator
Outcome
A sleeping deployment moves to waking/running and the operator sees latency and replica state.

Before you start

  • Operator-console access
  • Deployment id
  • Available capacity

Steps

  1. Verify the environmentSelect staging or production in the header and verify the namespace before every action.
  2. Open DeploymentsFind the deployment by id, agent or tenant and confirm it is serverless.
  3. Click WakeThe command submits a wake request; do not click repeatedly.
  4. Verify the phaseWait for waking → running and check repl/avail, session count and recent wake.

Step screenshots

Step 1. Verify environment, health and spare capacity.
Step 1. Verify environment, health and spare capacity.
Step 2. Find the deployment and review its phase.
Step 2. Find the deployment and review its phase.
Step 3. A notification confirms Wake; then watch the phase.
Step 3. A notification confirms Wake; then watch the phase.

Video guide

The frames follow the sequence above; every screenshot caption names the state to verify.

Media provenance: Captured on 6 August 2026 in the operator console's built-in demo mode; no Kubernetes state was changed.

Verify the result

Phase is running, available replicas are above zero and wake latency meets SLO.

If it does not work

On timeout, check Capacity, Events, image trust and node selector before retrying Wake.

02 Diagnose a hosted-agent startup failureThe failure is classified before retry and is not hidden by endless retries.
Audience
SRE or operator
Outcome
The failure is classified before retry and is not hidden by endless retries.

Before you start

  • Deployment id and correlation id
  • Events/Logs access
  • Expected image digest

Steps

  1. Record phase and reasonRecord failed state, timestamp, desired class and digest before changing the deployment.
  2. Check EventsDistinguish capacity, image pull, policy, crash and readiness failures.
  3. Check Trust and NetworkVerify image signature, runtime policy, egress allowlist and credential refs.
  4. Fix the cause and retry onceAfter the fix, run Wake and compare the new correlation id with the original.
Verify the result

Deployment is running, readiness is green and the original incident links to remediation.

If it does not work

Do not undeploy before saving evidence or root-cause context will be lost.

Application sections

Open detailed manual

Every application screen has a separate page with controls, safe example values, CLI/API alternatives and status-specific recovery steps.

Open detailed manual →

Role in the ecosystem

IAM.Hosting turns the published AgentPackage into a managed runtime session based on the Rust engine iam-agent and Kubernetes. The service is responsible for launching isolation, health, quotas, stopping idle workloads and sending the result back in Marketplace.

Execution life cycle

install → wake → hydrate scoped config → execute → persist result → reap

A user request wakes up a workload or creates a new instance. Runtime gets the required version of the package and links to allowed credentials, publishes running state, and after a period of inactivity is scaled to zero.

Isolation and data

  • separate identity and resource envelope for launch;
  • prohibition of undescribed capabilities and network directions;
  • secrets are mounted only during execution;
  • logs should not contain credential material;
  • user artifacts are saved separately from the ephemeral container.

Observability

The operating minimum includes the run queue, wake latency, execution time, OOM/timeout, number of retries, reaper state and cost per tenant. Correlation id associates the Marketplace action with the pod/runtime event and delivered result.

Limit of responsibility

IAM.Hosting is not a standalone directory or visual builder. The public control surface is located at IAM Marketplace, and capability contracts can be resolved via IAM.Core.