Free Container Provider Inventory

This page tracks external capacity for JobCache Devices. A provider is useful only if it can run brokered work without receiving Cockroach, B2, R2, S3, or provider credentials. Every hosted worker is still just a Device: it reports capability, leases through the JobCache API, submits Observations, and exits or sleeps.

The target is unpaid free capacity: no trial credits, no "free for 30 days", no usage-based overage, and no architecture that can accidentally create a bill. A provider that gives free monthly usage but can charge after that is not free enough for this layer.

Current constraints

  • OCI is unavailable for this project. Do not plan on Oracle Always Free or OKE.
  • Koyeb is already used by the Typst compile service. Do not consume that slot for JobCache workers.
  • Cloudflare budget is shared with CareerVector and dotkeeper. Do not move scrape, chunk, embed, or lease-poll loops onto Cloudflare.
  • Render is already the public JobCache interface host and worker of last resort. It must stay dormant; no keepalive loop.

Strict unpaid-free shortlist

Provider Permanent-free pricing API key / access IaC fit JobCache role Decision
Back4App Containers Free container plan: $0/month, 0.25 CPU, 256 MB RAM, 100 GB transfer, shared CPU, GitHub deploy, custom Docker, no credit card. yes: ~/.agent/secrets/back4app.yml Medium. GitHub-connected deploy is automatable by repo state; provider-side app creation still needs API/dashboard/agent proof. First hosted scrape-only Device for lightweight HTTP/feed adapters. Use first. No browser, chunk, enrich, or embed work until memory is measured.
Back4App BaaS Free BaaS plan: 25K requests, 250 MB database, 1 GB transfer, 1 GB files, no credit card. yes: ~/.agent/secrets/back4app.yml Medium-low. Useful if Cloud Code jobs can be created repeatably; do not store source-of-truth state there. Planner tick only: call JobCache API, enqueue/score bounded work, exit. Use only to save Cloudflare cron/request budget. Never use as broker or queue.
Hugging Face Spaces CPU Basic is free: 2 vCPU, 16 GB RAM, 50 GB ephemeral disk; Docker SDK supported; free hardware sleeps when unused. yes: ~/.agent/secrets/huggingface.yml High enough. A Space is a git repo; secrets and settings can be driven by Hugging Face Hub API/CLI. Manually woken or API-woken burst Device; possible heavier HTTP parsing. Use as burst/manual worker, not a reliable daemon. Sleep is a feature, not a bug.
CircleCI on corbet/unraid Self-hosted runner; work runs on owned k3s/Unraid capacity. yes: CircleCI API token in agent secrets Excellent. Pipeline config is repo YAML; dispatch goes through named only_job values. Scheduled/manual one-shot planner or one lease cycle. Use for bounded jobs. Do not create high-frequency scraping cron.
Render Free Web Service 750 free instance-hours/month per workspace for free web services; services spin down after 15 minutes idle; outbound/build limits apply; service-initiated traffic can trigger suspension. yes: ~/.agent/secrets/render.yml Good. JobCache already has custom Pulumi Render resources. Existing public interface plus dormant worker-of-last-resort. Keep as last resort only. Do not use as active scraper pool.
Self-hosted Docker/k3s Permanent free because it is owned hardware; marginal power/network cost only. operator-controlled Excellent. Docker Compose and Kubernetes manifests already exist. Reliable owned fallback Device above hosted freebies. Best stable capacity if the host is available.

Discipline-required options

These services are not part of the default unpaid-free worker pool. They may become useful later, but only with hard budget discipline: IaC-created resources, explicit scale-to-zero, low JobCache task budgets, alerts, and a tested kill switch. This project has repeatedly failed when "small background usage" was allowed to become invisible spend, so these stay fenced.

Provider Free shape API key / access Why it is fenced
Google Cloud Run Monthly free allowance for requests, CPU, memory, and limited egress. yes: ~/.agent/secrets/google-cloud.yml; gcloud auth exists Usage beyond allowance can bill; egress and side resources need strict controls.
Azure Container Apps Monthly free allowance for CPU, memory, and requests. yes: ~/.agent/secrets/azure.yml; CLI login not proven Usage beyond allowance can bill; account access and budgets need proof.
IBM Code Engine Monthly free allowance for vCPU-seconds, GB-seconds, and HTTP requests. no local secret Usage beyond allowance can bill; no credentials yet.
Northflank Developer Sandbox Free sandbox capacity for a small number of services/jobs/addons. no local secret Payment-method/sandbox posture; needs no-bill proof before use.
Zeabur Free story changes between credit/trial/BYO-server modes. no local secret Too ambiguous for default capacity; use only if an account proves a no-bill path.

Excluded by policy

These are not candidates for JobCache's unpaid-free pool.

Provider Reason
OCI / OKE Unavailable for this project.
Koyeb Free capacity is already allocated to the Typst compile service.
IBM Kubernetes Service Free Kubernetes cluster is 30 days, not permanent.
Fly.io New accounts do not get a dependable free hosted-worker tier. Legacy allowances are not useful for us.
Railway Free plan is credit-based and too spend-dynamic for baseline operations.
Cloudflare Containers Tied to Workers Paid / usage-metered containers; not a zero-spend baseline.
Generic trials Trials are useful for benchmarking only, not architecture.

IaC posture

The permanent-free architecture should prefer providers where the deployment is described in repo state and secrets are injected from the provider UI/API:

  1. CircleCI: pipeline YAML and only_job dispatch values are the source of truth.
  2. Hugging Face Spaces: Space repo, Dockerfile, README metadata, and Hub API secret/variable calls are enough for repeatable deployment.
  3. Back4App Containers: Dockerfile and GitHub repo state are repeatable; app creation/environment setup must be proven through Back4App API or documented dashboard steps before it is called IaC-complete.
  4. Render: already represented through the custom Pulumi provider in jobcache/infra/.

Do not add a provider to the active worker pool unless its IaC can express:

  • service/job image source
  • environment variables and secrets
  • scale-to-zero or sleep behavior
  • maximum concurrency/parallelism
  • daily task/byte budget at the JobCache Device layer
  • deletion/disable path that can be run by an agent

Desktop client question

Hosted free workers can probably cover the first days or months if we restrict the initial scope to HTTP/feed adapters, public APIs, light HTML fetching, and manual/backfill bursts. The likely stack is:

  1. Back4App BaaS or CircleCI jobcache_planner tick.
  2. Back4App Container scrape-only Device.
  3. Hugging Face Space for manually woken burst capacity.
  4. Self-hosted container on owned hardware.
  5. Render one-cycle fallback.

That can delay desktop-client scraping. It should not delete the desktop Device model yet. Hosted free workers use datacenter IPs, shared platform fingerprints, and platform quotas. Desktop Devices are still the path for real-user IP diversity, better browser fingerprints, and local idle compute once product adoption exists.

Source: jobcache/wiki/content/architecture/free-container-provider-inventory.md