To

Platform team

From

Sam Rivera, Operations

Date

30 July 2026

Re

Fleet isolation moves to whole-runtime containers

Summary

Following the audit, each employee agent moves to its own whole-runtime container on the new fleet host. Profiles inside a shared process are not an isolation boundary and are retired as a deployment pattern.

Why now

The pilot showed credential sprawl across shared runtimes. Containers give us a repeatable image, per-employee state volumes, and a clean revocation story — at a fraction of the cost of one VM per person.

Decision

One container per employee by default; dedicated VMs only for principals with production-admin authority. Effective Monday, 4 August.