The heavy tier at team scale¶

This page is part of Team scale.

Sandboxes with Docker inside, and the large (8 vCPU / 32 GiB / 100 GiB) and xlarge (16 / 64 / 200) profiles, run as Kata microVMs on their own pool, sandboxes-heavy (terraform's enable_heavy_pool; environments.md, gke.md). It scales from zero and powers down with the other sandbox pools, so it costs nothing while nobody runs heavy work.

Machine type¶

Kata boots a VM per pod, so the pool needs nested virtualization: C3, C4, C4D, N2, N4 or N4D. Compute Engine excludes E2, memory-optimized, Arm, and AMD machines other than N4D, and states a CPU penalty of 10% or more for nested VMs, more for I/O (nested virtualization). GKE Sandbox's Hyper-Threading rule is gVisor's, so it doesn't halve an Intel Kata node. Prices for us-central1 from gcloud-compute.com (third party, Google's SKU prices, fetched 2026-10-15; Spot prices change daily):

The default is N2, the series the Kata pool already uses and whose quota (N2_CPUS) projects usually have. On Spot, c3-standard-44 holds more per dollar; check your C3_CPUS quota first. A large gVisor-sized comparison: an n2d-standard-16 Spot node holds 14 standard sandboxes at ~$0.023 each an hour, so a large heavy sandbox costs about 13 standard ones.

Packing an n2-standard-32¶

From GKE's reservation formulas ([plan node sizes][nodes], the conservative case) and kata-deploy's RuntimeClass overhead for its QEMU runtime (320 MiB and 250 m a pod, kata-deploy chart); estimates, not measured:

Memory decides, as on the gVisor pool, and a sandbox's Docker (its containers, its page cache) lives inside its own memory limit: a stack that needs more than the profile gives is OOM-killed inside the VM, not on the node.

How many nodes, and the caps¶

HANGAR_HEAVY_PERSON_MAX caps what one person holds: 3 large or larger, at most 1 of them xlarge. Work no person owns (jobs from senders linked to nobody, webhooks, schedules without a person) counts as one more person, a team bucket with the same caps; repo builds aren't counted. Six people at their caps would need ~7 nodes; heavy_max_nodes = 4 (12 large) assumes about two heavy sandboxes per person at the busiest time. Past it, sandboxes wait with "the sandbox node pool is at its maximum". Quota: N2_CPUS ≥ 128 for 4 nodes, on top of the Kata pool's, and 2,000 GB of SSD_TOTAL_GB for their disks.

Cost¶

Estimates from the prices above, with each node's 500 GB pd-balanced boot disk ($0.0685 / h while the node exists; the autoscaler deletes it with the node):

Not included: the nested-virtualization penalty (CPU-bound work runs ~10% slower, I/O more), and the Docker Hub remote repository's storage (Artifact Registry, cleaned after 30 days).