CNCF Certified Kubernetes · Distribution · Kubernetes AI Conformant
About
vCluster creates Tenant Clusters: fully isolated environments delivered as managed Kubernetes, or as the foundation for Slurm, Ray, Run:ai and inference clusters. Each gets its own API server, CRDs and RBAC, and runs on an existing cluster or standalone on bare metal. CNCF Certified Kubernetes.
Every cluster becomes a product you can ship. Sell it to customers or serve it to internal teams from the same platform, with each tenant seeing only their own cluster and nothing else. The control plane stays invisible to tenants: no shared control plane nodes, no in-cluster agent pods, and no lateral path between environments.
Because a Tenant Cluster is upstream Kubernetes, everything built for the standard API works against it unmodified: kubectl, Helm, Argo, Crossplane, operators, and CRDs.
40M+ Tenant Clusters deployed. vCluster runs in production at Adobe, CoreWeave, NVIDIA, Nebius, Lintasarta, Atlan, Deloitte, and across 50+ AI clouds and Fortune 500 platform organizations, powering 100K+ GPUs and 1M+ CPUs.
🚀 Quick start
# Install the vCluster CLI
brew install loft-sh/tap/vcluster
# Create a Tenant Cluster
vcluster create my-vcluster --namespace team-x
# Use kubectl as usual. You are now inside your Tenant Cluster.
kubectl get namespaces
Prerequisites: a running Kubernetes cluster and kubectl configured.
No Kubernetes cluster? Run a complete Tenant Cluster in Docker containers with vind (vCluster in Docker). Like kind, but with the full vCluster feature set: UI, sleep and resume, LoadBalancer, image cache, and external nodes joining over VPN.
vcluster create my-vcluster --driver docker
kubectl get namespaces
🎮 Try it in the browser
🎁 vCluster free tier
Real usage, not a gated demo. Unlimited Tenant Clusters up to 64 CPUs and 32 GPUs, plus the full vCluster Platform UI, for free. Get started free →
🧩 Every kind of cluster
One platform turns raw compute into the cluster type each tenant actually asks for. Kubernetes is the foundation; the rest are delivered on top of it.
Cluster type
What a tenant gets
Kubernetes Clusters
A dedicated, CNCF-certified Kubernetes cluster with its own API server, CRDs, and RBAC
Nested Clusters
Tenant Clusters running on the Control Plane Cluster's shared nodes for maximum density
Inference Clusters
Serving stacks such as Dynamo and llm-d, isolated per tenant
Ray Clusters
Ray for distributed training and data processing, isolated per tenant
Run:ai Clusters
Run:ai scheduling on top of an isolated Tenant Cluster
Slurm Clusters(Beta)
Managed Slurm for HPC and batch training
Agent Sandbox Clusters(Coming soon)
Isolated clusters for agentic and untrusted code execution
Slurm, Ray, Run:ai, inference, and agent sandbox clusters are delivered through vCluster Platform. This repository is the open-source engine that every one of them is built on.
vCluster supports multiple deployment architectures. Two things vary independently: where the control plane runs (an existing Kubernetes cluster, a standalone binary, or Docker) and how tenant workloads are placed (shared nodes or private nodes). The modes below combine them, offering progressively stronger isolation from dense shared infrastructure through to fully standalone deployments on bare metal.
🔹 Dedicated Nodes: isolated compute on labeled node pools
Tenant Clusters get their own set of labeled nodes on the Control Plane Cluster. Workloads are isolated but still managed by the Control Plane Cluster.
🔹 Private Nodes v0.27+: full CNI/CSI isolation
External nodes join the Tenant Cluster directly with their own CNI, CSI, and networking stack, through a token-based process. No cross-tenant visibility, and complete infrastructure separation from the Control Plane Cluster. Nodes can also join over an encrypted VPN overlay v0.30+, so one Tenant Cluster can span sites, networks, and clouds.
🔹 vCluster Standalone v0.29+: no Control Plane Cluster required
A complete, zero-dependency Kubernetes distribution. Run the whole control plane as a self-contained binary directly on bare metal or VMs. This is how providers solve the "cluster one" problem when building infrastructure from scratch.
⚡ Auto Nodes v0.28+: Karpenter-powered dynamic autoscaling
Automatically provision and deprovision private nodes based on workload demand. Works across public cloud, private cloud, hybrid, and bare metal environments. Node profiles v0.36+ let each pool carry its own node configuration.
🐳 vind v0.32+: a complete Tenant Cluster in Docker, no Kubernetes required
The control plane and worker nodes run as containers on a single Docker host, using private nodes underneath. There is no Control Plane Cluster and no Kubernetes dependency at all, which makes this the fastest way to get a real Tenant Cluster on a laptop or a CI runner. Docker deployment is driven by the CLI rather than by vcluster.yaml.
vcluster create my-vcluster --driver docker
✨ Key features
Feature
Description
🎛️ Its own API server, per tenant
Every Tenant Cluster runs a dedicated control plane: API server, controller manager, and data store. Full Kubernetes API isolation, not a namespace with rules layered on top
🔒 Strong tenant isolation
Tenants hold admin inside their Tenant Cluster while holding minimal permissions on the Control Plane Cluster
🎮 GPU-aware scheduling
Dynamic Resource Allocation with resource claims, resource claim templates, and device classes, plus in-place pod resizing
⚡ Auto Nodes
Karpenter-powered provisioning and deprovisioning of private nodes across cloud, hybrid, and bare metal, with per-pool node profiles
🖥️ Standalone deployment
Run without a Control Plane Cluster on dedicated infrastructure or bare metal, purpose-built for AI factories and on-prem GPU fleets
🐳 Runs on Docker
A complete Tenant Cluster in Docker containers with no Kubernetes dependency, through vcluster create --driver docker
🔐 Node VPN(Platform)
Private nodes join over an encrypted overlay, so a single Tenant Cluster can span sites, networks, and clouds
📸 Snapshot and restore
Snapshot a Tenant Cluster to S3, OCI, Azure Blob, or local storage, and restore it elsewhere
💤 Sleep mode(Platform)
Pause inactive Tenant Clusters to save resources, with instant wake when needed
🔗 Shared platform stack(Shared / Dedicated Nodes)
Reuse the Control Plane Cluster's CNI, CSI, ingress, and other infrastructure, with no duplicate platform components
🔄 Resource syncing(Shared / Dedicated Nodes)
Bidirectional sync of any Kubernetes resource: pods, services, secrets, configmaps, CRDs, and Gateway API objects
🧩 Integrations
Native support for cert-manager, external-secrets, KubeVirt, Istio, and metrics-server
📊 High availability
Multiple replicas with leader election. Embedded etcd or external databases (PostgreSQL, MySQL, RDS)
Shared platform stack, resource syncing, and Control Plane Cluster integrations apply in Shared and Dedicated Nodes modes, where the Tenant Cluster reuses the Control Plane Cluster's CNI, CSI, and platform stack. Private Nodes and Standalone deployments bring their own CNI, CSI, and platform components.
Start turnkey with the vCluster Platform UI and CLI, or call the APIs and put your own portal and brand in front. It is a two-way door, with no re-platforming.
🌐 The vCluster stack
vCluster is the foundation of a broader platform for running Kubernetes and AI infrastructure on your own hardware, from a single rack to 100K-GPU superclusters.
Hardware-enforced network isolation via programmatic VLANs, VRFs, and ACLs
Together they provide the full stack for an AI factory: certified Kubernetes, isolated Tenant Clusters, runtime workload sandboxing, and GPU infrastructure operations. The ClusterMAX™ security criteria call for strong isolation between tenants, and name vNode Private Nodes.
What is this?vCluster creates Tenant Clusters: fully isolated virtual Kubernetes clusters, each with its own API server, CRDs, and RBAC, running on top of an existing Kubernetes cluster or standalone on bare metal.
Is this a Kubernetes add-on or a full cluster distribution?Both: it is a tool/engine you run on top of an existing Kubernetes cluster (as a workload) or as a standalone, zero-dependency Kubernetes distribution directly on bare metal or VMs.
How do I get a Tenant Cluster running?With a running Kubernetes cluster and kubectl configured, follow the quickstart guide; or if you have no cluster at all, run a full Tenant Cluster locally in Docker containers using vind (vCluster in Docker).
Do I need an existing Kubernetes cluster to try it?Not necessarily: Shared/Dedicated/Private Nodes modes need an existing host cluster, but the Standalone and vind (Docker) modes have no Kubernetes dependency at all.
Is Slurm support ready for production?No, Slurm Cluster support is listed as Beta, and Agent Sandbox Clusters are marked 'Coming soon', so not all cluster types are production-ready yet.
Who actually uses vCluster in production?AI cloud providers, platform engineering teams, and enterprises running shared GPU infrastructure; it's used in production at Adobe, CoreWeave, NVIDIA, Nebius, Deloitte and 50+ AI clouds and Fortune 500 companies.
Does a Tenant Cluster work with my existing tools like kubectl and Helm?Yes, because a Tenant Cluster is upstream Kubernetes, tools built for the standard API work unmodified, including kubectl, Helm, Argo, Crossplane, operators, and CRDs.
How is isolation enforced between tenants?Each tenant gets a dedicated control plane (API server, controller manager, data store), with no shared control plane nodes or in-cluster agent pods, and Private Nodes mode adds full CNI/CSI network isolation.
Can vCluster handle GPU workloads specifically?Yes, it supports GPU-aware scheduling via Dynamic Resource Allocation with resource claims and device classes, plus Karpenter-powered Auto Nodes for dynamic GPU provisioning across cloud, hybrid, and bare metal.
What is vind?vind (vCluster in Docker) runs a complete Tenant Cluster as containers on a single Docker host with no Kubernetes dependency, making it the fastest way to try a real Tenant Cluster on a laptop or CI runner.
vCluster creates Tenant Clusters: fully isolated virtual Kubernetes clusters, each with its own API server, CRDs, and RBAC, running on top of an existing Kubernetes cluster or standalone on bare metal.