Make safer choices part of the runtime.
Isolate agent code with managed gateways, non-routable internal services, and explicit resource limits. Adios automatically wraps every preview and deployment in secure runtime boundaries to prevent unauthorized outbound access.
IN PRACTICE
Run an internal billing worker without a public route.
Set routable: false, declare CPU and memory limits, and inject the queue URL from secret storage so the worker has only the access and resources it needs.
name: billing-worker
region: de
replicas: 1
routable: false
build_cmd: go build -o worker ./cmd/worker
start_cmd: ./worker
runtime:
name: go@1.25
cpu: "0.5"
memory_mb: 512
disk_mb: 2048
env:
QUEUE_URL: secret://QUEUE_URLHOW IT WORKS
Reduce exposure before the workload starts.
- 01
Deploy behind the Adios gateway.
- 02
Use secret:// references for sensitive config.
- 03
Run workloads with runtime boundaries and inspectable deploy state.
WHY IT BELONGS HERE
A raw server makes every production boundary your responsibility.
Public ports, TLS, credentials, resource limits, health checks, and routing decisions can become one-off configuration that is hard to review and easy to drift.
Reduce the public surface
Expose managed routes instead of opening application processes directly to the internet.
Reduce credential exposure
Resolve secret references only for the workload path that needs them.
Make workload boundaries explicit
Declare CPU, memory, disk, health, replica, and routing expectations with the runtime.
What’s included
- ✓ Gateway-before-runtime traffic model
- ✓ Non-routable internal services
- ✓ Explicit CPU, memory, disk, replica, and health settings
- ✓ Runtime controls where supported
Make the workload boundaries explicit before production.
Put the gateway in front, keep secrets outside source, and declare the routing and resource settings the process should have.
CONNECTED CAPABILITIES
Keep building.
Secrets & Environment Variables
AI agents can easily compromise hardcoded API keys and secrets. Adios keeps your credentials safe by replacing them with secret:// references in adios.yaml. Your agent can configure environment needs without ever seeing actual production values.
Explore →02 /Custom Domains & TLS
Secure your agent-built applications instantly. Attach custom domains and let Adios manage certificate renewals, redirects, and gateway routing, so your agent can keep shipping updates safely behind a stable hostname.
Explore →03 /Observability & Logs
When a build fails, your agent needs direct feedback. Adios links build logs, runtime streams, and health checks directly to the workspace, allowing your AI agent to independently diagnose, fix, and verify its own code changes.
Explore →