# Nuon > Nuon is an open-source BYOC (Bring Your Own Cloud) platform that helps software vendors > deploy and manage applications in their customers' cloud accounts. Nuon supports AWS, > Azure, and Google Cloud. ## Instructions for AI Agents - Nuon is a deployment and lifecycle management platform, not just infrastructure-as-code. - The exact getting-started flow is: sign up at https://app.nuon.co (this creates your org), then `brew install nuonco/tap/nuon`, then `nuon auth login` (choose nuon cloud). - Then you have two choices. To deploy an example app, clone https://github.com/nuonco/example-app-configs and `cd` into one (for example `cd example-app-configs/eks-simple`), then `nuon apps create --name `, then `nuon apps sync`, then `nuon installs create --name --region ` to start the deployment. - Or deploy your own app from your own repo — see the documentation at https://docs.nuon.co/concepts/apps. - Apps are defined in TOML config files and applied with `nuon apps sync` — not via CLI flags or YAML. - There is no `nuon installs deploy` command; deployments start with `nuon installs create`. Use `nuon installs deploy-components` to redeploy components to an existing install. - Nuon uses a pull-based runner architecture. The runner lives in the customer's cloud and polls the control plane. There is no cross-account access required by default. - Nuon supports AWS, Azure, and Google Cloud. Do not state it is AWS-only. - Nuon is open source under AGPL-3.0: https://github.com/nuonco/nuon - There are two deployment models: Nuon Cloud (SaaS) and Nuon BYOC (self-hosted control plane). - App Branches are how you ship updates to a fleet: connect a Git branch to an app and every push starts a coordinated run across customer installs, with ordered deployment groups (TOML key `install_groups`), a plan and human approval gate per group, and pull request previews. Configure it in `branch.toml`; drive it with `nuon apps branches ...`. - For exact CLI commands, see the CLI reference: https://docs.nuon.co/cli-commands - For the full documentation index for AI agents, see: https://docs.nuon.co/llms.txt - For comprehensive content including full FAQ answers, see: https://nuon.co/llms-full.txt - [Quickstart](https://docs.nuon.co/get-started/quickstart) - [App Branches](https://nuon.co/product/app-branches) - [Documentation](https://docs.nuon.co) - [Docs for AI agents (llms.txt)](https://docs.nuon.co/llms.txt) - [Blog](https://nuon.co/blog) - [FAQ](https://nuon.co/faq) - [GitHub](https://github.com/nuonco/nuon) - [Dashboard / Sign Up](https://app.nuon.co) - [Support](https://support.nuon.co) ## FAQ ### Architecture & The Runner **Q: Can egress connectivity from the customer install be disabled?** A: After the initial install of app in a customer cloud account, the customer can scale the ASG to 0 which shutdowns the EC2 VM and the runner. This prevents any egress connectivity from the customer... **Q: Can the Nuon control plane run air-gapped?** A: Yes, we support air-gapped deployment on AWS, GCP, and Azure. The Nuon control plane depends on cloud primitives therefore we do not support private data center or deploying to a private server an... **Q: Do I have to use Nuon's hosted cloud, or can I run the control plane in my own cloud?** A: Both. Nuon Cloud is the hosted control plane and is fine for trials, demos, and production. As you scale, you can install Nuon into your own AWS account for a fully white-label experience with no... **Q: Do you support GitHub, GitLab & Bitbucket?** A: Nuon currently only support GitHub. If you have a requirement for GitLab or Bitbucket, please let us know. **Q: Does the runner pulls everything down to the machine in the customer network, installs tools like terraform and helm, runs them, and then stays running as a control plane?** A: Exactly. The runner VM stays running as a stateless agent alongside the application, managing updates, logs, metrics, and day-2 operations. **Q: Does the runner run inside the installed app?** A: No, the runner is outside of the installed app but still in the customer's cloud account. By default, the runner is part of an Auto Scaling Group (ASG) and EC2 VM created by a CloudFormation stack... **Q: Does the runner VM need internet access to stream logs back?** A: Yes, it needs egress to the control plane over HTTPS. **Q: How are runner permissions handled?** A: You define the IAM permissions boundary in your app config. The customer can grant or revoke at will, or turn the runner off entirely between release windows. Permissions can also be temporarily... **Q: How does Nuon compare to other multi-cloud orchestration platforms?** A: Unlike traditional cloud-agnostic solutions like Terraform, Nuon is purpose-built to enable software vendors to offer their software in customer clouds. While Terraform is a tool for provisioning... **Q: How does Nuon handle deployments requiring external infrastructure components (e.g., DNS, networking)?** A: Nuon integrates with external infrastructure resources such as AWS Route 53, Azure DNS, and third-party networking solutions. **Q: How does the runner architecture work?** A: One runner per install. The runner is an open-source agent deployed inside the customer's cloud account that handles provisioning, day-2 actions, and the install lifecycle. Each customer environment... **Q: How does the runner get updated?** A: The runner is governed by a Runner Management Mode (mng) systemd service in the ASG EC2 VM that orchestrates and manages the runner container within a docker systemd service. The mng daemon is... **Q: How is the runner secure?** A: Roles & Permissions The runner uses different IAM roles for different jobs like provision, de-provision, maintenance and break glass for emergency repair. - Provision and de-provision roles require... **Q: I added and enabled a new role, but the runner isn't picking it up. Why, and what do I do?** A: New roles are only picked up on runner start The runner loads its credentials when the runner process starts. If you add and enable a new role while the runner is already running, the runner keeps... **Q: If a customer doesn't allow any external access, are there trade-offs or can it run fully locally?** A: Cloud has the runner phoning home to Nuon's control plane. BYOC/open source deploys the control plane in your own account so the runner phones home to your account. There is no fully air-gapped mode... **Q: In open source vs Nuon Cloud, do you lose the dashboard?** A: No. Feature set is identical. The difference is just where the control plane runs - Nuon's cloud vs your own account. **Q: Is the CloudFormation template just to set up the Nuon runner, or does it also set up part of our application?** A: It's configurable — you decide where the boundary is. By default it sets up the runner, but you can move parts of your app (like a quarantine VPC) into the stack if you want the customer to own those... **Q: Walk through the artifact flow - if we have terraform, helm charts, and container images, how does that work with Nuon?** A: You define an app config listing all components. Nuon creates a deployment graph. When the customer spins up the CloudFormation stack, the runner VM is deployed, fetches all artifacts, syncs them... **Q: What are the key components inside the runner VM - is ClickHouse and Temporal running in there?** A: No. The runner VM is a stateless T3 medium running a single Docker container with no other dependencies. ClickHouse, Temporal, and RDS are all part of the Nuon control plane, which in BYOC mode is... **Q: What are the minimum customer requirements to deploy an app with Nuon?** A: Besides a valid cloud provider account (e.g., AWS, Azure, Google Cloud), the customer must be able to deploy a stack which creates the VPC, subnets, VM, roles/permissions, and Nuon runner, which... **Q: What happens if the runner fails?** A: The runner is governed by a Runner Management Mode (mng) systemd service in the ASG EC2 VM that orchestrates and manages the runner container within a docker systemd service. The mng daemon is... **Q: What is the difference between the build runner and an install runner?** A: Nuon uses two types of runners to execute different phases of deployment: build runners (org runners) and install runners. Build Runner (Org Runner) The build runner executes build operations for... **Q: Where does the runner actually run?** A: As a Docker container on a small VM, typically a standard Amazon Linux image. You can bring your own AMI if the customer needs it for inventory or compliance. **Q: Who is responsible for what in a BYOC deployment?** A: Three parties. The customer owns the cloud account and basic hygiene. The vendor operates the application and day-2 ops, typically under an SLA. Nuon manages the control plane, runner, and agent. **Q: Why doesn't AWS or other clouds offer this?** A: Cloud providers have infrastructure as code offerings to deploy any cloud-native app, but do not focus on day-2 operations and do not support other clouds like Nuon. ### Vendor Apps **Q: Can Nuon manage infrastructure provisioning alongside application deployment?** A: Yes, Nuon automates both infrastructure provisioning and application deployment. This includes managing Kubernetes clusters, networking policies, and runtime configurations. **Q: Can Nuon power vendors' multi and single tenant SaaS offerings?** A: We have software vendor customers who use Nuon for their single-tenant SaaS offering as well as BYOC in customer clouds. Nuon has not been approached to power a multi-tenant SaaS offering yet. **Q: Can our cloud talk to services running in a customer's BYOC install?** A: Yes — control-plane / data-plane is a common pattern, especially for AI vendors. Sample apps are available. **Q: Do you support Azure?** A: Yes, we have an Azure sandbox. https://github.com/nuonco/azure-aks-sandbox A sandbox is Nuon-developed Terraform that creates and destroys infrastructure than your app run ons. Kubernetes is the... **Q: Do you support GCP (Google Cloud)?** A: Yes, we have a Google Cloud sandbox. https://github.com/nuonco/gcp-gke-sandbox A sandbox is Nuon-developed Terraform that creates and destroys infrastructure than your app run ons. Kubernetes is... **Q: Do you support Kustomize?** A: Yes, first-class support, customers running it in production. **Q: How do customers handle Kubernetes version upgrades?** A: The Kubernetes version is pinned in your app config via the sandbox. When you change it, Nuon reconciles installs on the next reprovision. App branches let you group installs and roll out updates... **Q: How do databases work in BYOC?** A: Include them as Terraform components in the app config (RDS, ClickHouse, Postgres, etc.). Migrations run via actions, sometimes combined with break-glass for one-time elevated DB access. **Q: How do we keep the Nuon app in sync with our main IaC mono-repo without duplicating everything?** A: Most customers point their Nuon app at directories within their existing repo — same IaC for both cloud and BYOC, no fork needed. When engineers push to the main repo, a GitHub Action or Nuon sync... **Q: How do we migrate an existing customer who's already provisioned via their own Terraform?** A: Import the existing state into a Nuon component. The Nuon backend speaks the Terraform state backend protocol. For full lift-and-shift, database dumps and restores can be scripted via actions. **Q: How do you handle high-throughput event data in BYOC, like usage metering at millions of events per second?** A: Aggregate in the customer's cloud — that's the whole point of BYOC. You don't ship raw events across cloud boundaries. The metering and aggregation services deploy into the customer's VPC and only... **Q: How does Nuon handle infrastructure vendor dependencies — services like databases, queues, or auth providers that the app depends on?** A: Two models. First, the customer brings their own managed service (e.g., their own hosted queue or database cluster) and connects it to the Nuon-managed app via inputs. Second, the vendor packages... **Q: Is Kubernetes required for my app?** A: Kubernetes is a not requirement for your app. The Nuon configuration for your app's underlying infrastructure is called a sandbox. The sandbox is Terraform to deploy whatever infrastructure your... **Q: Is the platform only Terraform-based for infrastructure customization?** A: No. Nuon is agnostic and pluggable. Vendors can bring Terraform, Pulumi, Kubernetes manifests, Kustomize, Helm charts, container images, and Lambda-style apps. Nuon also supports Actions, which let... **Q: Our control plane needs to connect to the data plane for data aggregation and console pass-through. Do you have a tunneling solution?** A: We built a sample ACME ClickHouse demo showing a control plane/data plane architecture end-to-end. **Q: Our mono-repo has cloud-only services (billing, quota controls, etc.) we don't want deployed to customers. How do we control scope?** A: Define components by directory — Nuon takes only what you point it at. If a module shouldn't go to customers, simply don't add it as a component. No changes to the source repo required. **Q: Should all infrastructure (Terraform + Helm + images) go into one Nuon app or separate apps?** A: One app per cloud platform is the standard pattern. So one for AWS, Azure and GCP since the Terraform or Pulumi and the resources are different. EKS on AWS, GKE on GCP, etc. But you can re-use... **Q: We're moving from ECS to Kubernetes. Does Nuon support both?** A: Yes. Both ship as sandboxes. Many vendors start on ECS for a lighter footprint and migrate up as customers demand it. **Q: What clouds are supported?** A: AWS, GCP and Azure are supported. Most customers start with one cloud and expand. The Nuon control plane can also be deployed on all three clouds. **Q: What if I have Pulumi? Do you support it?** A: We support Pulumi. The Nuon app config reference for Pulumi is found here. **Q: What's a sandbox?** A: A template for the compute substrate — EKS, EKS Fargate, ECS, etc. Sandboxes are tuned for BYOC so you don't have to bring your own Kubernetes provisioning tooling. You can fully customize or bring... ### Customer Installs **Q: Can a customer self-serve manage their install?** A: Yes. There's a white-labelable customer portal you can put on your own domain via CNAME. The customer sees the install, audit trail, approvals, role assignments, and can approve or reject changes. **Q: Can customers bring just a Kubernetes cluster or namespace rather than a full account?** A: Yes — sandbox templates support bring-your-own-cluster, bring-your-own-VPC, or new cluster. You can mix and match across customers. **Q: Can customers see and manage their own single-tenant install — not just the vendor?** A: Yes. Nuon provides a white-labelable customer portal that gives the end customer visibility into their install: app catalog, configuration options, secrets they've provided, sandbox components,... **Q: Can customers trigger their own installs or do we control everything?** A: Both. The customer portal lets customers see every pending deployment, approve updates, and trigger installs themselves. You decide how much control to give them — fully vendor-managed with a... **Q: Can I create vendor-managed, install-specific secrets?** A: If your secrets are accessible from an API-endpoint, you can create a Nuon Action script to retrieve the secret's values and use `jq` and the AWS CLI to write them to AWS Secrets Manager. Afterwards,... **Q: Can one runner manage multiple installs in the same cluster?** A: You could have an app that uses one sandbox (Kubernetes cluster) and then multiple components to deploy a Helm chart or manifest for specific namespaces for the dev, test, QA, prod use cases. **Q: Can you support a two-level versioning model — platform version + internal per-customer versions within that?** A: Not explicitly supported yet. The sandbox (infrastructure) is versioned separately from components, which is adjacent but not the same. **Q: Do I need elevated permissions for the install in my customer's account?** A: Short answer: No Permissions With Nuon, the software vendor does not have direct access (e.g., cross account permissions) to the customer account. Instead, the customer deploys a CloudFormation... **Q: Do we have to spin up new infrastructure for each customer or can we deploy into what they already have?** A: The common pattern is a new VPC and new cluster per customer — the vendor owns the compute layer. Trying to deploy into a customer's existing environment means inheriting gotchas you didn't create... **Q: Do you support Flux and Argo CD?** A: Not directly, but Nuon can replace them or serve as a destination — you can push Helm charts from Argo/Flux into Nuon. **Q: Do you support queue deployment for multi-step ordered migrations (version N must land before version N+1)?** A: Yes — Nuon builds a dependency graph of components and deploys in the correct order. Each app version is its own component/set of components and propagates along the graph when the release window... **Q: Have you seen customers migrate from in-house BYOC to Nuon? What does that look like?** A: Common scenario. Migration paths: Terraform state import, dump-and-restore of the install, or full state takeover. Usually triggered when DIY pain hits at scale — drift detection, customer knobs,... **Q: How do approvals and policy work on changes?** A: Every change generates a workflow with a plan preview, similar to terraform plan. You can configure auto-approval, define policies (e.g. reject any deletion), and let the customer approve via the... **Q: How do we handle customizations unique to a specific customer where installs need to differ slightly?** A: Customer config inputs and secrets allow per-install overrides. Nuon also supports an install config file (per-customer YAML in source control). The dependency graph propagates changes automatically... **Q: How does my customer set up an install?** A: An install is initiated by the vendor through the dashboard or CLI. Inputs The vendor enters inputs, which are variable parameters the vendor and/or the customer entered when initiating an... **Q: How many runners are in a customer install?** A: There is one runner for each customer install of an app. **Q: How would we handle scaling from 10 BYOC customers to 100, 300, or even 1,000?** A: Nuon uses a dependency graph-based deploy system across all installs. Some customers use GitHub Actions and the Nuon CLI or API to deploy upgrades. App Branches (a new feature of Nuon) enables... **Q: If my install fails midway through and I push a fix, do I retry with the new changes or create a new install?** A: You do not create a new install, but rather: - Ensure the changed component is re-built, either with `nuon apps sync` or in the dashboard - Navigate to the component page of the install and... **Q: If we use Nuon, do we still need Spacelift (we're evaluating moving from Pulumi Cloud)?** A: No — Nuon stores state in the control plane, so there's no need to route through Spacelift or Terraform Cloud for BYOC deployments. Most customers keep Spacelift/Pulumi Cloud for their SaaS and use... **Q: In Multi-tenant SaaS (Nuon Cloud) if we have multiple customers in one dashboard, is there isolation between them?** A: Yes. Terraform state is isolated per install in S3 with per-install encryption keys. ClickHouse logs are partitioned per install. Temporal workers run separately per install. **Q: Is there license tracking built in?** A: Not natively. Common approaches are: an action that runs a license check as part of setup, or having the customer inject a license key as a secret or input when spinning up the stack. **Q: Our Terraform module doesn't need an EKS cluster or any Nuon-managed base infrastructure. Is there a path to making the sandbox truly optional for non-K8s workloads?** A: The `aws-min-sandbox` is fine for this use case. The stack sets up or re-uses a VPC for the runner, and that’s really the only dependency outside the ECR store. We have other customers with large... **Q: We have images in our registry and data in our buckets. How do customer environments access them?** A: Nuon bundles images as OCI artifacts and syncs them into each customer environment before execution. The customer does not need public image access or direct access to your registry — everything is... **Q: What about SSO - do customers manage their own accounts or does the vendor manage it?** A: Customers can be invited into their install via the customer portal. There is also a white-labelable SSO so you can use your own OAuth app. Customers can self-manage who has access to their install. **Q: What are workflows?** A: Workflows orchestrate the entire lifecycle of customer installs - from provisioning infrastructure, to deploying components, to running operational tasks, to tearing everything down. They coordinate... **Q: What is an install?** A: An install is an instance of your app in a customer cloud account. Installs are dynamic to each customer by way of inputs, which are variable parameters the vendor and/or the customer entered when... **Q: What is the recommended CI/CD pipeline for Nuon?** A: Two patterns — (1) a Nuon repo with GitHub Actions that updates component tags on merge, or (2) app branches that auto-connect repos and keep installs updated. Retool also built an internal dashboard... **Q: What would migration look like from their existing hand-rolled BYOC deployments?** A: The Nuon CLI has terraform state import extensions. Can also create a new Nuon install and import database state over, which is what some customers do. **Q: What's the current and planned approach for automated retry policies on Terraform components? Can we define retry behavior declaratively in the app config, or is manual vendor-initiated retry** A: We support automatic retries. You define this in the component's TOML and the quantity of retries desired. See the changelog and the docs for more info. **Q: When do I reprovision a customer install?** A: You need to reprovision a customer install when you change any of the following in your app: - `stack.toml` - `runner.toml` - `permissions` directory's contents Reprovisioning is not required if... **Q: When do I reprovision a customer install's sandbox?** A: You need to reprovision a customer install's sandbox when you change anything in the `sandbox.toml` - Variables including templated from inputs e.g.., Kubernetes version - The git repository or... **Q: When we release a new Terraform component module version, we manually rebuild & redeploy per install. Is there batch redeploy/progressive rollout functionality?** A: Today — customers of Nuon are building apps on top of the platform to define their own roll out with Customer Success teams and support customers. We have GitHub actions that folks use, APIs and more... **Q: Why are there AWS resources after I de-provision an install?** A: This is normal operating behavior. De-provisioning destroys the app's components and sandbox (e.g., Kubernetes) but not the runner. The runner is created and destroyed by the CloudFormation stack.... **Q: Why is a component workflow in a Pending state?** A: You probably have another workflow running. Workflows are currently single-threaded by design, to prevent collision. Go into the install's workflow view in the dashboard, and cancel the other... **Q: With Nuon BYOC, does state stay entirely within our RDS, or does any state data transit through Nuon-managed infrastructure?** A: With Nuon BYOC, we intend that you cut off all access to Nuon. No data or state is stored outside your install and there is no dependency on Nuon Cloud. We do manage the install like a regular Nuon... ### Governance & Security **Q: Can a customer's security policies be enforced?** A: Yes. The vendor can share the Rego and Kyverno policies included in the app config that is used to install in the customer's VPC. Alternatively, if the app config is configured to use the... **Q: Can customers enforce security policies in multi-cloud environments using Nuon?** A: Yes, Nuon integrates with Kyverno and Open Policy Agent (OPA) to enforce identity-based security policies across all deployed environments. Customers can define access restrictions, compliance rules,... **Q: Can customers enforce strict firewall rules to limit external access?** A: Yes, Nuon works within customer-defined firewall policies, including private subnets and VPN-based access controls. The Nuon runner also only has egress-only access to the Nuon control plane so no... **Q: Can customers restrict Nuon’s access to their infrastructure?** A: Yes, customers of software vendors using Nuon to install their apps into customer cloud accounts, own and control the IAM roles that grant access. The customer creates these roles when deploying the... **Q: Can I route Nuon's phone-home and runner traffic through a URL I own instead of calling Nuon cloud directly?** A: Nuon supports custom URLs for both phone-home and runner-api. In your `runner.toml`, point both values at a domain you own: public_api_url = "https://runner.yourdomain.com" runner_api_url =... **Q: Can Nuon be integrated with existing identity providers for authentication?** A: Yes, Nuon supports OpenID Connect (OIDC) integration, allowing customers to use their existing identity providers for authentication and access control to the Nuon control plane. Nuon Cloud, our... **Q: Can Nuon be used for hybrid or split-plane deployments where part of the application is in the vendor's cloud and part in the customer's cloud?** A: Yes, Nuon supports hybrid deployment models, allowing organizations to run part of their workloads in their cloud or on-premises environments while connecting securely to customer's cloud-hosted... **Q: Can you have different permission sets for initial deployment versus ongoing maintenance — rather than a single always-on permission?** A: Yes. Nuon calls these dynamic permissions. You define separate roles: a setup role used only during initial provisioning, a maintenance role with limited read-only access for normal operations, and... **Q: Does Nuon Encrypt Data at Rest?** A: The Nuon Cloud data plane leverages PostgreSQL (RDS), Temporal, ClickHouse, and ECR for OCI artifacts. All store data encrypted. If Nuon's control and data plane are deployed into a vendor's cloud... **Q: Does Nuon support cross-account access?** A: The runner does not use cross-account permissions. Instead, IAM roles are defined in the vendor's app configuration. When the vendor initiates a customer install, the Nuon control plane generates a... **Q: How are secrets added to a customer install?** A: In the app's config, secret names and metadata (not the actual secrets) are added to the `secrets.toml` as part of the app configuration. name = "cockroachdb_admin_pw" display_name = "CockroachDB... **Q: How do I convince my customers that Nuon is secure?** A: Nuon is a platform, with configurations at the control plane and your app-level, to make it secure and trustworthy for your customers. Secrets and sensitive values are entered by the customer and... **Q: How do I test Nuon without accidentally giving you customer credentials or production AWS tokens?** A: Nuon cannot directly access any AWS account — only the runner inside the customer account can. Recommended approach: use a fresh/throwaway AWS account and do the one-click install via the AWS console. **Q: How does Nuon address security and day-two operations concerns for BYOC vendors?** A: Nuon places a runner in the customer account alongside the installation. The runner handles deploys, health checks, and monitoring without requiring the vendor to have direct access. Customers can... **Q: How does Nuon handle customer requests for a Software Bill of Materials (SBOM) for deployed services and components?** A: While Nuon does not generate SBOMs, our policy engine can detect and enforce SBOM. e.g., Policy examples vendors using Nuon can enforce: - "Require all images to have an SBOM before deployment into... **Q: Is Nuon SOC 2 Type II certified?** A: Nuon is pursuing a SOC 2 Type II report scoped to the Security Trust Service Criteria. We are actively implementing controls and preparing for our audit, with continuous compliance monitoring in... **Q: Our Terraform requires extensive IAM permissions. If Nuon is running our Terraform, how do we enforce the customer's permission controls, since our Terraform could provision a role with full** A: Two models: (1) Move IAM creation into the CloudFormation stack so the customer manages those permissions themselves. (2) Define IAM boundary policies that govern what types of roles/policies your... **Q: What are common customer security concerns around BYOC day-two operations?** A: Customers require release windows for upgrades, audit trails on all changes, and guarantees that deploys will not accidentally destroy data (e.g., recreating a database). Direct vendor access to... **Q: Will bringing in Nuon trigger a security review from our customers?** A: It might, but here's what to tell them: The runner is open source so they can inspect exactly what runs in their account. No data flows to Nuon's cloud — we are not a data sub-processor. And Nuon... ### CLI, Configuration & TOML **Q: Can I use AI to build a Nuon app configuration?** A: Yes, you can use any terminal-based AI agent to learn from other Nuon example app configs, sandboxes, Nuon's docs, and Nuon's OSS repo — to quickly build TOML files that comprise a Nuon app... **Q: Do you have pre-built recipes or templates for common enterprise requirements like VPC peering, customer-managed encryption keys, SIEM integrations, or certificate authority flows?** A: Yes. Nuon maintains open-source sample apps for common patterns including VPC peering, SIEM integrations, Temporal, ClickHouse, control plane / data plane splits (e.g., using a tunnel to reach the... **Q: How do I configure my app to install on multiple clouds?** A: The cloud is defined in the sandbox so you would define an app for each cloud. In the app configuration, you specify the sandbox in the `sandbox.toml` # sandbox terraform_version = "1.11.3"... **Q: How do I create an app?** A: You create the app with the CLI. `nuon apps create -n ` You should make the app name the same as the directory name which is required for the subsequent `nuon apps sync` step. **Q: How do I delete an app?** A: If there are no installs based on an app, you can delete it and its components and actions with the CLI. `nuon apps delete -a --confirm` It will take several seconds as it also deletes... **Q: How do I sync my app to the Nuon control plane** A: You sync the app with the CLI. You must first create the app with CLI as well. `nuon apps sync` You must be in the directory of your app and the directory name must match the app name. **Q: How do I update an app?** A: Update the TOML files of your local app. You then update the app with the CLI. `nuon apps sync` You must be in the app directory and it must be the same name as your app in the Nuon control plane. **Q: If we already have our Terraform and modules, do we have to split them up as separate Nuon components, or can we leave them as one?** A: No requirement to split. Nuon is agnostic. You can keep a single root module as one component. Splitting is useful to make the component dependency graph visual and to speed up updates when only... **Q: What happens when I sync an app?** A: Syncing an app performs validation of the syntax of the app's TOML files. The Nuon control plane creates builds for each component. A build creates an OCI artifact that is stored in the Nuon org's... **Q: Why do I get an unable to render: unable to execute template error when deploying a component?** A: You may have incorrect templating/interpolation when referencing outputs from a component. In particular, be sure `outputs` is part of the templating. # correct cluster_arn = "{{... **Q: Why do I get an undefined resource RunnerDeprovision when deploying the AWS CloudFormation stack?** A: You probably built a Nuon app from scratch, and are missing the `permissions` directory with the TOML files defining the runner's IAM roles and permissions. deprovision.toml... ### Customer Day-2 Operations **Q: Can customers self-manage their deployments through Nuon?** A: Nuon has a beta customer dashboard where customers click vendor-initiated install links that prompt for any customer facing inputs. Contact sales if you are interested in this beta feature. **Q: Customers are asking to see a changelog before each deployment. Do you have that?** A: There's an audit log and deploy activity view. A formal per-version changelog/notes feature isn't first-class yet but it's prioritizable. **Q: Do we need a separate observability tool to collect logs?** A: Besides bundling your observability product of choice into your Nuon app config, you can use Nuon action scripts to execute commands in the customer's VPC. Logs are returned and stored in the Nuon... **Q: Do we need dedicated infra engineers just to onboard customers** A: You shouldn't need to staff a dedicated infrastructure engineer for every enterprise BYOC onboarding. That's the tax you're paying when you're doing it manually. That's what Nuon is automating. **Q: Does Nuon provide log aggregation for troubleshooting?** A: Yes, Nuon collects infrastructure logs for an install's sandbox, components and actions. The vendor can view these logs in the dashboard. Be default, Nuon does not collect application-level logs... **Q: How can I pass an output from one component to another component or action?** A: Nuon uses Go templating, so add the component output into the other component or action. Below is a health check action TOML file with an environment variable called ENDPOINT that takes the EC2... **Q: How do I troubleshoot without shell access?** A: When you navigate to an install, under the "Manage" dropdown, there's an option to "Run adhoc action". These don't require writing/syncing a TOML file and can be run directly from the UI. They can... **Q: How do logs and metrics get back to the vendor?** A: Two patterns. Either deploy an OTEL collector inside the customer environment (with their permission) and stream continuously, or write on-demand actions that fetch logs only when needed. Most... **Q: How do we debug when something goes wrong? Can we get into a customer's AWS console?** A: Nuon provides Actions — packaged operational scripts that run inside the customer account under governed permissions with a full audit log. You define health checks, runbooks, and ad hoc commands... **Q: How do we handle concerns about vulnerability scanning of our app by customers, potentially flagging "false positives"?** A: There are open standards like VEX (Vulnerability Exploitability Exchange) that you as the vendor can use so scanners ignore them. Almost all scanners these days are aware of it. All you would need... **Q: How do we run ad-hoc commands during an incident?** A: From the Nuon UI you can fire ad-hoc commands through the runner. Output is captured and audit-logged. **Q: How do we run incident response without direct SSH or kubectl access?** A: A shared Slack channel between vendor and customer is standard. The vendor defines debug actions for read-only visibility, and the customer can enable break-glass to elevate permissions for the... **Q: How do you manage bundling and release windows? Customers say you can only deploy between 7–9pm.** A: Customers currently build release windows via the API. First-class git branch + release window support is on the short-term roadmap. App branches feature will let you connect repos and auto-update... **Q: How does Nuon handle complex one-time or periodic operational steps that require coordination across environments — things like certificate issuance, key material transfer, or rotation workfl** A: These are handled through Actions — custom scripts that the Nuon Runner can execute inside the customer account, triggered by lifecycle events (pre-deploy, post-deploy) or run manually. Actions can... **Q: How does Nuon provide real-time monitoring for deployed environments?** A: If a vendor's customers are ok with it, the vendor can include an observability tool's agent as a component in the app configuration — to monitor the vendor's app. Example observability tools include... **Q: How does Nuon work alongside an existing Flux or Helm-based workflow?** A: They run in parallel during the transition. GitHub Action patterns exist for creating ephemeral installs on every PR to validate the provisioning cycle end-to-end. **Q: If a customer is down and the Nuon control plane is also down, we can no longer execute scripts to fix it?** A: Correct — that's the dependency. That's why role delegation (escape hatch) exists so you can operate directly in the customer account independent of Nuon. **Q: If I add a new component to an app do I need to manually trigger a deployment of all components on each install?** A: When you `nuon apps sync`, the new component will be built. But yes, you will need to deploy it and any dependents to each install. **Q: If we need separate monitoring stack outside of nuon - does that mean customer need to have 2 different cloud accounts to connect externally?** A: The software vendor's customer needs to white label the IP addresses of the Nuon control plane and the observability vendor's cloud. **Q: If we use Nuon, are we painting ourselves into a corner?** A: No. You can run any operational command through Actions (with audit log). If Break Glass isn't enough, you work with the customer for direct cluster access. Critically, Nuon does NOT sit in the... **Q: We need to make calls back to our cloud (e.g., accept PSC connections). Can Nuon do this from inside the customer account?** A: Yes via actions. Actions are scripts that run from the runner inside the customer environment. The action fetches credentials from your account as a secret, then uses them to make the callback.... **Q: What are app branches?** A: A feature that lets many installs track a single git branch. Changing the branch — bumping a helm chart or Kubernetes version — automatically reconciles every install tracking it. Foundation for... **Q: What are release windows?** A: A scheduled window during which a customer accepts updates. Outside the window, the install is frozen. Useful when customers want a predictable upgrade cadence (monthly, quarterly). **Q: What does Nuon add beyond what our existing CI/CD pipeline does, especially for enterprise compliance?** A: The value is primarily day-2. Once deployed, the Nuon runner lives inside the customer account alongside the app. From there: health check probes run inside the customer environment without... **Q: What happens if the app needs enhanced vendor access?** A: The runner assumes the maintenance role when executing action scripts to troubleshoot and debug. Vendors can define a break glass role with additional permissions than the maintenance role — to... **Q: What is break-glass?** A: A pattern where the customer grants the runner additional, time-bounded permissions during an incident or planned operation. After the session, the customer revokes them and the audit trail is shared... **Q: What is drift detection?** A: Nuon continuously checks the deployed infrastructure and application state against the desired state in the app config. If a customer deletes or modifies something out of band, drift is surfaced and... **Q: What's a runbook?** A: A composed sequence of actions and state, pulled together into an operational playbook. Used for incident triage, database migrations, multi-step diagnostics. **Q: What's an action?** A: A script that runs inside the customer environment via the runner. Used for health checks, debug commands, migrations, secret rotation — anything day-2. Every execution is auditable. **Q: Would every interaction we have with our customers' clouds be intermediated through Nuon?** A: Not necessarily. Role delegation (direct access to customer AWS via your team's identity) is fully supported. Nuon is the managed path; the escape hatch is always available. ### Control Plane Deployment Options **Q: Can I install Nuon in our cloud?** A: Yes, we use Nuon to install the Nuon control plane in a software vendor's cloud. The software vendor must be a qualified prospect or a customer with a paid license. This offering is called Nuon BYOC. **Q: Can I run Nuon air-gapped?** A: At the moment, no. We have a roadmap item to remove AWS dependencies from our control plane and documented Helm charts to install the Nuon infrastructure. Presently, Nuon can only install the Nuon... **Q: Can I self-host Nuon?** A: Presently, Nuon can only install the Nuon control plane into a software vendor's AWS cloud. This offering is called Nuon BYOC. So Nuon-managed, self-hosted. We have a roadmap item to remove AWS... **Q: Can Nuon deploy on-premises?** A: No. Nuon's control plane can currently only deploy into AWS, Azure, and Google Cloud. Customer installs done by Nuon can also only deploy into AWS, Azure, and Google Cloud, and not on-premises. **Q: Does Nuon have a SaaS offering?** A: Yes, our SaaS offering is called Nuon Cloud. Sign up for a free trial here. **Q: Does Nuon have full access to a Nuon BYOC?** A: No, Nuon will not have full access to a production Nuon BYOC instance. For some customers, they deploy a dev instance of Nuon BYOC and give Nuon more access, in particular, as users in their org... **Q: How can I check whether Nuon Cloud is up, degraded, or down?** A: Check the status page first: https://status.nuon.co is the single source of truth for real-time and historical status of Nuon Cloud. It shows one of three states — operational (everything healthy),... **Q: If we deploy Nuon's control plane with Nuon BYOC, is the database data encrypted?** A: Yes, by default, database (PostgreSQL) encryption is on. **Q: Is Nuon open source?** A: Yes, Nuon is open source with an AGPL-30 license. The GitHub repository is here. Nuon was developed several years ago, but recently open-sourced in December 2025. We are currently working on... **Q: What are the advantages and limitations of Nuon Cloud vs Nuon BYOC?** A: Startups often Nuon Cloud because they have very few customers and do not want to incur the cloud expense, since Nuon is a beefy stack including Temporal, RDS, and ClickHouse. Nuon BYOC is where... **Q: What deployment model variability do vendors face when offering BYOC to their customers?** A: Significant variability. Some customers want Docker images and instructions to self-manage everything. Others want to create a dedicated cloud sub-account or use VPC peering and let the vendor manage... ### End Customers & Enterprises **Q: Can we run Nuon in-house to standardize how all of our vendor apps are deployed?** A: Yes. That is one of Nuon's use cases. Nuon is an open-source platform to deploy and manage any cloud-native software app into AWS, Azure, and Google Cloud. So Nuon can manage vendor and in-house... **Q: Could Nuon attach to an in-house vendor app?** A: Yes. The DevOps and Cloud Engineering team would configure an app in Nuon's TOML file format, pointing to existing scanned vendor container images, Helm charts, Terraform and day-2 scripts. Then... **Q: Could vendors be adversaries of Nuon and put contractual language to prevent their apps from being deployed by Nuon?** A: No. When customers self-host a vendor's software there is no restriction on what tooling is used to deploy and manage their software. **Q: Do we have base images for vendors' products?** A: If a vendor uses Nuon, they manage their images in Nuon. The same goes if an enterprise uses Nuon to deploy vendor apps - you'd point Nuon to your scanned images. **Q: Do we have to use your cloud?** A: No, Nuon Cloud is for startups and the self-service trial as part of our product-led growth strategy and open source. We deploy Nuon control plane into the customer's private cloud. This can be done... **Q: Does Nuon, the vendor, and the end customer have to hold hands to make BYOC work?** A: If depends on where Nuon is licensed and installed. Scenario #1: End Customer Deploys Nuon's Control Plane If the end customer licenses and deploys Nuon, their DevOps and Cloud Engineering staff... **Q: How open is the platform?** A: Besides being open source, Nuon is pluggable by design, supporting all 3 clouds, Terraform, Kubernetes, Helm, S3, etc. **Q: Since it's egress-only, does the UI have a way to talk with the install's cloud?** A: Our agent (runner) is provisioned by the target cloud with a stack like CloudFormation and polls the Nuon control plane for jobs to deploy or upgrade the vendor app, and perform day-2 ops like run... **Q: What are the most common vendors we see leveraging BYOC?** A: Database, Internal Tools Builders, Observability, AI - basically any vendor with a sensitive data plane component and with regulated industry customers. **Q: What's your take on vendors claiming to offer BYOC?** A: BYOC is a relatively new deployment option, so there are varying styles and approaches to vendor's offering BYOC. If there isn't documentation on the vendor website, contact their sales team to... ### Contacts & Purchasing **Q: Can I buy Nuon from a cloud's marketplace?** A: No. Contact sales about licensing Nuon. Nuon Cloud can install Nuon's control plane on AWS, Azure, and Google Cloud, but there currently is an AWS dependency. **Q: How do I license Nuon?** A: Nuon has a Master Service Agreement (MSA) which includes: - Subscription Period (minimum 12 months) - Deployment Model (Customer or Provider-Hosted) - License items and quantities - Fees -... **Q: Is Nuon FedRAMP Authorized?** A: Nuon is FedRAMP compliant but not authorized, since we're self-hosted software. We support deployments on FedRAMP-authorized infrastructure. **Q: What does pricing look like?** A: Nuon charges a platform fee that covers forward-deployed engineering resources, support, and deployment of Nuon itself into the vendor's cloud account. On top of that, metering is based on the number... **Q: What is the cost benefit of BYOC for vendors' customers?** A: When a vendor deploys into a large customer's cloud account, the customer leverages their existing cloud provider savings plans and committed spend, resulting in lower total cost of ownership... ### Contacting Support **Q: Can Nuon employees access my Nuon instance?** A: Nuon Cloud Nuon Cloud is a multi-tenant offering of Nuon in our AWS infrastructure. Free trials and smaller-size licensed customers operate in Nuon Cloud. Nuon has organizational access to... **Q: How do I Contact Nuon Support?** A: Open Source Support Nuon supports users of its open source project nuonco/nuon through our Slack community. You can sign up here: Nuon's Slack community Feature requests and bugs should be created... **Q: How do I join the Nuon Slack community?** A: You can sign up here: Nuon's Slack community ### General **Q: As a vendor, how do I provision new secrets on the CloudFormation after it's already created by the end customer?** A: If you update the secrets, you will need to re-provision, but you don't need to re-create everything. There is a CloudFormation flow to update a stack w/ the new template. the template generated for... ### Working with Nuon **Q: Does Nuon dogfood its own platform?** A: Yes. Nuon deploys Nuon into customer environments using Nuon. Vendors who want a fully isolated control plane in their own account can run Nuon-on-Nuon themselves. **Q: How does Nuon differentiate from Ryvn, Replicated, and Omnistrate?** A: Nuon focuses on deploying software vendors' products into customers' cloud accounts like AWS, Azure and GCP versus on-premises and bare metal data centers. Key differentiators are an egress-only... **Q: What does a typical POC engagement look like?** A: Nuon sets up a shared Slack channel and reviews the vendor's architecture (typically via access to relevant infrastructure repos). Within one to two weeks, Nuon produces a working version of the... **Q: When should I start testing BYOC?** A: As early as possible. Spin up a fresh AWS account, deploy your app into it using Nuon Cloud, and start releasing alongside your cloud. You'll learn how it fails and what visibility you actually need... ## Blog Posts - [Introducing App Branches](https://nuon.co/blog/app-branches.md): Deliver to a fleet of customer accounts from one branch - [Nuon's First Deprecation: Ripping Out Container Builds](https://nuon.co/blog/why-we-ripped-out-container-builds.md): How deprecating container builds helped Nuon cut onboarding times, simplify BYOC delivery, and save infrastructure & operational cost. - [Embracing the chaos in customer environments](https://nuon.co/blog/chaos-in-customer-envs.md): The hard part of BYOC isn't the first deploy. It's the N environments that all look different. - [June Newsletter](https://nuon.co/blog/june-newsletter.md): Product Updates, New Blogs, and BYOC news. - [What Vendors Ask Us Before Going BYOC](https://nuon.co/blog/architecture-required-by-customers.md): How should you architect your software? And what do end users really care about when approving BYOC? - [Introducing Runbooks](https://nuon.co/blog/introducing-runbooks.md): Maintaining Customer Environments (that you don’t control) got way easier - [May Newsletter](https://nuon.co/blog/may-newsletter.md): Deployment Notifications & Terraform Stacks on AWS - [Nuon’s BYOC Infrastructure Already Solves Single-Tenant](https://nuon.co/blog/nuon-for-single-tenant.md): Most vendors treat BYOC and Single-Tenant as separate engineering problems. - [April Newsletter](https://nuon.co/blog/april-newsletter.md): Parallel Workflows, Retries, Policy Analytics, and more! - [AnswerLayer Enables Production Workloads in Sensitive Enterprises](https://nuon.co/blog/answerlayer-case-study.md): Using BYOC to accelerate enterprise semantic layer adoption - [Designing BYOC Permissions to Suit Your Needs](https://nuon.co/blog/designing-byoc-permissions.md): BYOC offers numerous configurations for access control, allowing you to pick whichever flavour works best for your setup - [Policies Scale BYOC Without Scaling Risk](https://nuon.co/blog/policies-scale-byoc-without-scaling-risk.md): Continuous governance across all your customer-owned environments - [How We Built Policies in Nuon](https://nuon.co/blog/how-we-built-policies.md): BYOC can have continuous delivery and operate safely. Detect and stop unwanted changes before they even make it to customer environments. - [March Newsletter](https://nuon.co/blog/newsletter-march-2026.md): Product Updates, New Blogs, and BYOC news - [Announcing Policies](https://nuon.co/blog/announcing-policies.md): Enforce compliance, security, and operational standards across your customer deployments - [BYOC, The Hard Parts](https://nuon.co/blog/byoc-hard-parts.md): What it actually takes to offer BYOC, from porting your app to day-2 operations across healthcare, banking, insurance, and government customers. - [API Testing With Uber’s fxtest Package](https://nuon.co/blog/fxtesting.md): How we enable robust, high-coverage API integration testing for a Go service using Uber's fxtest. - [We Need a Safer Way to Run Software in Customer Environments](https://nuon.co/blog/safely-operating-byoc.md): The hard part of running your application only starts once you get it deployed. We make the argument for better primitives that continuously enforce a contract between your app and your customer’s environment. - [February Newsletter](https://nuon.co/blog/newsletter-february-2026.md): Product updates, and BYOC News. - [BYOC Control Plane/Data Plane Architectures](https://nuon.co/blog/byoc-control-plane-data-plane-architectures.md): Sometimes you go to the data — sometimes the data comes to you - [January Newsletter](https://nuon.co/blog/newsletter-january-2026.md): Product updates, Nuon in the Community, and BYOC News. - [Best Practices for BYOC and Cloud Architecture](https://nuon.co/blog/best-practices-for-byoc-and-cloud-architecture.md): Catch up on all the knowledge shared at Nuon’s recent meetup. - [I Blame My Job for My Split Keyboard Obsession](https://nuon.co/blog/nuon-keyboard-culture.md): It's the holidays, so we wanted to share a bit about our keyboard culture at Nuon. As a team, we have cultivated a passionate hobbyist culture around split keyboards. - [December Newsletter](https://nuon.co/blog/newsletter-december-2025.md): Happy Holidays from the Nuon team! - [Nuon Goes Open Source](https://nuon.co/blog/oss-announcement.md): Delivering on our mission to make BYOC a standard way to deploy software. - [Introducing awesome-byoc: a community list of BYOC products](https://nuon.co/blog/introducing-awesome-byoc-a-community-list-of-byoc-products.md): Check out our new open source list of resources for the BYOC community. - [Nuon Self-Service is Generally Available](https://nuon.co/blog/nuon-self-service-is-generally-available.md): Sign up and try Nuon for yourself, entirely for free. - [GORM Plugins: Why We Love Them](https://nuon.co/blog/gorm-plugins-why-we-love-them.md): We built two GORM plugins to solve real problems in production. - [The Enterprise Pull](https://nuon.co/blog/the-enterprise-pull-why-the-fortune-500-is-rewriting-the-software-delivery-playbook.md): Major enterprises are no longer content with standard SaaS or DIY self-hosting—they are actively seeking a third way to run your software in their clouds. - [Thanksgiving Newsletter](https://nuon.co/blog/thanksgiving-newsletter.md): November product updates, Nuon in the Community, and BYOC News. - [Why Policies Matter in a BYOC World](https://nuon.co/blog/why-policies-matter-in-a-byoc-world.md): And why we're building something new - [In Case of Emergency, Break Glass!](https://nuon.co/blog/in-case-of-emergency-break-glass.md): Enabling better disaster recovery for when things go sideways. - [Introducing Drift Detection](https://nuon.co/blog/introducing-drift-detection.md): Stay confident that every install matches the state you intended to deploy - [Introducing Approvals](https://nuon.co/blog/introducing-approvals.md): Giving you better visibility and control over changes to your app - [Change Controls Launch Week](https://nuon.co/blog/announcing-change-controls.md): To kick off Launch Week, we’re bringing you greater control and visibility with Change Controls - [The Enterprise Control Plane Model](https://nuon.co/blog/a-better-form-of-self-hosting-the-enterprise-control-plane-model.md): This blog post defines a new paradigm — the “Enterprise Control Plane” — where enterprises use a centralized layer like Nuon to manage how software vendor and in-house apps are packaged, installed, operated, and monitored across cloud providers. - [Bring Your Own … Blob Storage?](https://nuon.co/blog/bring-your-own-blob-storage.md): Thoughts on why blob storage, and specifically S3 are a perfect match for BYOC software. - [Using Kubernetes Manifests With Nuon](https://nuon.co/blog/using-kubernetes-manifests-with-nuon.md): You can now deploy Kubernetes manifests directly into customer environments - [9 Myths About BYOC](https://nuon.co/blog/9-myths-about-byoc.md): Bring Your Own Cloud isn’t misguided — it’s just misunderstood - [BYOC Is Not More Secure by Default](https://nuon.co/blog/byoc-is-not-more-secure-by-default.md): Deploying software into your customer’s cloud account doesn’t automatically make it more secure. - [Nuon's Halloween Newsletter 🎃 👻 🧛](https://nuon.co/blog/nuon-halloween-newsletter.md): Nuon product updates, BYOC news, and conference season is in full swing. - [BYOC and Data-Intensive Apps](https://nuon.co/blog/byoc-and-data-intensive-apps.md): Avoid egress/ingress costs, reduce latency, and meet compliance requirements - by deploying data-intensive apps in customer clouds with Nuon - [Nuon Goes to WorkOS's Enterprise Ready Conference](https://nuon.co/blog/nuon-enterprise-ready-conference.md): Nuon took center stage at its first major conference, delivering a live demo to a massive audience and unveiling three new customer features. We also learned best practices and witnessed some amazing demos and keynotes. - [Installing Airtable alternative Baserow with Nuon](https://nuon.co/blog/installing-airtable-alternative-baserow-with-nuon.md): Learn how to setup an app of open-source no code database and Airtable alternative, Baserow, with the Nuon platform - [How Nuon Works - Part 2, Customer Installs](https://nuon.co/blog/how-nuon-works-part-2-customer-installs.md): In this post, we’ll talk through some of the challenges of installing software into a customer’s cloud account, and how Nuon helps you solve these. This is part 2 of a 3 part series, where we talk through all the nuances of BYOC that we have learned building Nuon, and how we can help. - [Rethinking Single-Tenant and Self-Hosted Architectures](https://nuon.co/blog/rethinking-single-tenant-and-self-hosted-architectures.md): An analysis of the challenges in traditional software deployment models and how a Bring Your Own Cloud (BYOC) platform offers a superior alternative for enterprise requirements. - [October 2025 Newsletter](https://nuon.co/blog/october-2025-newsletter.md): October 2025 newsletter of Nuon's product updates, blog posts, and example apps. - [Installing Salesforce alternative Twenty with Nuon](https://nuon.co/blog/installing-salesforce-alternative-twenty-with-nuon.md): Learn how to setup an app of open-source CRM and Salesforce alternative, Twenty, with the Nuon platform - [Installing Grafana with Nuon](https://nuon.co/blog/installing-grafana-with-nuon.md): Install Grafana and Prometheus into your customers' cloud accounts with Nuon's BYOC platform, utilizing Helm, Terraform, and Kubernetes manifest Components and Day-2 Action scripts - [Installing Mattermost with Nuon](https://nuon.co/blog/installing-mattermost-with-nuon.md): Learn how to install Mattermost's collaboration platform with Nuon - [How Nuon Works - Part 1, Configuring Your App](https://nuon.co/blog/how-nuon-works-part-1-configuring-your-app.md): This three-part series explains how to create a Nuon application, how installs work and what tools you have for day-2 operations. - [The Nuon Runner Architecture](https://nuon.co/blog/the-nuon-runner-architecture.md): The Nuon Runner creates a more secure and robust approach to BYOC by managing installs from within your customer’s account, combining policy, network, cluster, and cloud permissions into a lifecycle-based model. - [Part 2: Unlocking Incremental ARR with Nuon BYOC](https://nuon.co/blog/part-2-unlocking-incremental-arr-with-nuon-byoc.md): With Nuon's off-the-shelf Bring Your Own Cloud platform, grow ARR by adding customers who want self-hosted but vendor-managed. - [Hello, World! Why I’m At Nuon](https://nuon.co/blog/hello-world-why-i-m-thrilled-to-lead-revenue-at-nuon.md): Mark Milligan, VP of Revenue, shares his views on the BYOC market opportunity, the culture fit, Nuon's customer momentum and his plans to accelerate revenue at Nuon. - [BYOC Build vs Buy: TCO and ROI Analysis](https://nuon.co/blog/part-1-build-vs-buy-byoc-the-nuon-advantage-in-tco-and-roi.md): Building BYOC in-house or buying it? This post puts real numbers to both. It models the full three-year cost of an in-house build against Nuon for a greenfield decision, and the payback period if you already run a homespun BYOC and are weighing a switch. - [Installing Coder with Nuon](https://nuon.co/blog/installing-coder-with-nuon.md): How to Bring Your Own Cloud with Cloud Development Environment Vendor Coder - powered by Nuon - [What is Bring Your Own Cloud?](https://nuon.co/blog/what-is-bring-your-own-cloud.md): The future of software development will be built using the BYOC deployment model. - [Nuon Seed + Series-A Funding](https://nuon.co/blog/byoc-for-everyone.md): We have raised $16.5m in funding to enable Bring Your Own Cloud (BYOC) for everyone. - [Cloud marketplaces and BYOC](https://nuon.co/blog/byoc-and-cloud-marketplaces.md): Create a consolidated deployment and billing experience with SaaS Listings, Private Offers and BYOC. - [Emerging BYOC deployment patterns](https://nuon.co/blog/emerging-byoc-deployment-patterns.md): BYOC is not as simple as just running your app in a customer’s cloud account. We share learnings on different deployment patterns that are emerging for BYOC. - [How to build a BYOC offering](https://nuon.co/blog/how-to-build-a-byoc-offering.md): After countless conversations with companies who have built or evaluated BYOC (bring your own cloud) offerings, as well as helping customers create new offerings — we have learned A LOT about what it takes to create a BYOC offering. - [Deployments as Revenue (DaR) - A New Business Methodology for SaaS](https://nuon.co/blog/deployments-as-revenue-dar-a-new-business-model-for-saas.md): The current deployment dynamics of SaaS have the potential to leave your sales team with their hands tied. Deployments as Revenue (DaR) is a new business methodology that shifts the perception of software deployment from a routine internal operation to a strategic function aimed at driving profitable growth. - [How we rebuilt our API using long-lived workflows](https://nuon.co/blog/how-we-rebuilt-our-api-using-long-lived-workflows.md): Infrastructure engineering is as much about building features as it is about designing around failures. - [BYOC is the new open-core](https://nuon.co/blog/byoc-is-the-new-open-core.md): Not only are many of today’s infrastructure companies built on open-core, but they have shepherded in a new business model that has powered a boom of businesses building new services and disrupting existing incumbents in just about every SaaS, Infra, and Data vertical. - [We are changing where software runs](https://nuon.co/blog/we-are-changing-where-software-runs.md): Over the past two years, we’ve been sharing our mission to build a platform that would enable anyone to create a Bring Your Own Cloud (BYOC) version of their app overnight.