Shared types

Number of virtual CPUs the workload sees. Required, must be at least 1.

CPU time reserved on the host, in millicores (1000 = one full core).

Must be <= vcpus * 1000. Zero means "reserve the full vcpus * 1000", i.e. no oversubscription. Below that, the VM is burstable and the difference is the burst headroom.

Hard ceiling on host CPU time, in millicores, enforced by the agent via cgroup cpu.max. Zero means the ceiling is vcpus * 1000. Set this below vcpus * 1000 to cap a burstable VM that would otherwise consume all idle capacity on the node.

CPUID feature flags the workload requires, lowercase as they appear in /proc/cpuinfo — e.g. "avx2", "aes". Placement rejects nodes lacking any of them. Anti-cheat and DRM in game servers occasionally depend on these.

Pin each vCPU to a distinct physical core and let no other workload share those cores. Removes noisy-neighbour jitter for latency-sensitive tick loops, at the cost of a dedicated-core price.

Require SMT siblings of the pinned cores to stay idle. Only meaningful with dedicated_cores; used for workloads that are sensitive to hyperthread contention or that need side-channel isolation.

Memory the workload sees, in bytes. Required.

Memory guaranteed to the workload, in bytes. Must be no more than size_bytes. Zero means all of size_bytes is guaranteed.

Reserving less than size_bytes requires balloon_enabled, so unused memory can be reclaimed when it is needed elsewhere.

Allow memory the workload is not using to be reclaimed. Required when reserved_bytes is less than size_bytes.

Back the workload's memory with 2 MiB pages. Noticeably faster for memory-heavy servers — large voxel worlds, big entity counts — but can only be placed where such memory is available.

Allow memory to grow to this size while running, without a restart. Zero disables it. Must be at least size_bytes when set.

Allow identical memory pages to be shared with other workloads on the same machine. Saves memory when many servers run the same game, at some CPU cost and with weaker isolation between them.

Identifier for this disk within the workload, e.g. "root" or "world-data". Must be unique within it.

Size of the device. Required for a blank disk; for an image or snapshot source, zero means "the source's own size" and any larger value grows the filesystem on first boot.

Attach read-only. Several instances may share one read-only volume, which is how a common asset bundle is mounted into many game servers at once.

Marks the disk the workload boots from. Exactly one disk may set this.

Delete the underlying storage when the instance is deleted. Always true in effect for LOCAL_NVME.

Use direct IO (O_DIRECT), bypassing the host page cache. Lowers memory pressure on the node and makes latency more predictable, at the cost of losing host-side caching.

Stable identifier within the instance, e.g. "eth0".

Private network to attach to, as a resource name. Empty means the project's default network in this location.

Requested private IPv4 address. Empty allocates one from the subnet.

The interface's MAC address. Empty generates one. Pinning it matters for game licences tied to a MAC.

Enable multi-queue virtio-net with one queue pair per vCPU. Raises packet throughput for servers handling many concurrent clients.

Network tags, which firewall rules on this interface's network target.

Per interface rather than per instance because a rule belongs to one network, and an instance with an interface on each of two networks is answerable to two sets of rules. Lowercase letters, digits and hyphens, up to 63 characters each.

Refuse every inbound connection on this interface, whatever the network's firewall rules say. Replies to connections the workload opened still arrive.

For an interface that exists so a workload can reach a network rather than be reached on it — a sandbox connected to one of your networks, for example.

Send no internet traffic and no DNS through this interface: only the network's own range is reached through it. Without this, a workload with two interfaces could send its internet traffic out of either.

Zones the instance may land in, as location ids ("eu-west-2a"). Empty means any zone in the region. More than one entry is a preference list in priority order, not a hard set.

Hard node requirements. A node must satisfy every entry.

Soft node preferences. Nodes satisfying more of these score higher, but none of them can make placement fail.

Group this workload belongs to, scoped to the project. Workloads sharing a group are spread out or packed together according to policy.

Class of capacity to draw from. Leave empty to let Plany choose, which is right for almost every workload.

Refuse to place onto pre-emptible (spot) capacity. Spot is materially cheaper and fine for a dev server, but wrong for a ranked match in progress.

Pin to one node by resource name. Bypasses scoring entirely; intended for debugging and for rescheduling a VM back onto the node holding its local disk.

Run as spot: on spare capacity, at the spot rate, reclaimable with two minutes' notice when an on-demand workload needs the room.

Warning given before a spot reclaim, readable at /metadata/spot/instance-action on the metadata service. The notice is always two minutes; leave this unset.

Stop the instance automatically once it has run this long. Zero means no limit. This is the guard rail that stops a forgotten dev server draining a hobby account's credit overnight.

Time between the shutdown signal and a forced stop, so a game server can save its world. Zero uses the default of thirty seconds.

With preemptible: place as an ordinary on-demand workload when no spare capacity fits, rather than waiting for some. The allocation says which happened, and it is what the instance is billed at.