Start here
Deploy your first workload
Create a Global Virtual Cloud (GVC), run a sample application as a workload, and open it on a global TLS endpoint.
Understand the concepts
Read these pages first to learn what each building block is and how they fit together.
Follow a how-to guide
Configure a domain, create a secret, push an image, set up a CI/CD pipeline, and more.
Point an AI agent at it
Which path your tool takes: the AI Plugin, or the MCP server.
Compliance
PCI DSS Level 1 and SOC 2 Type II: the attestations, the audit scope, and the responsibility matrix.
Build with AI
Sandboxes
Isolated environments for AI coding agents, reachable from a browser IDE, VS Code, Cursor, or SSH.
AI Plugin
Skills, agents, and guardrails that teach Claude Code, Codex, and Antigravity CLI to drive Control Plane.
MCP Server
Connect Cursor, Claude Desktop, VS Code, or any other MCP client to your org.
Run a model
Ollama, LiteLLM, Qdrant, and Langfuse install from the Template Catalog as versioned releases.
Build and deploy
Create a GVC
Pick the locations your workloads run in. Workloads, identities, and volume sets live inside it.
Create a Workload
Run a container as a serverless, standard, stateful, cron, or VM workload.
Push an image
Build into your org’s free private registry, or push an image you already have.
Create a Secret
Credentials, keys, and certificates, plus the identity and policy chain a workload reads them through.
Configure a Domain
Route your own domain to a workload. TLS certificates are issued and renewed for you.
Install from the Template Catalog
PostgreSQL, Redis, Kafka, and more, installed into a GVC as versioned releases.
Run a full virtual machine
A VM workload brings its own kernel, init system, and guest OS, including Windows. Lift an existing disk image across without re-platforming it, and it still gets the same encrypted internal networking, the same credential-free access to cloud services, and the same firewall rules as your containers.
Interfaces
Console
The web UI. Explore resources, make one-off changes, and read logs and metrics in the browser.
CLI
cpln scripts the same operations, and adds exec, port-forward, and cpln apply manifests.
REST API
Every operation over HTTP at
api.cpln.io, generated from an OpenAPI spec.
Terraform
The official
cpln provider, managing every resource kind in HCL.
Pulumi
The same resources in TypeScript, Python, Go, or C#.
MCP Server
The same operations over MCP at
mcp.cpln.io, for an AI agent to call directly.
Kubernetes Operator
Already running a cluster? Manage Control Plane resources as CRDs, so
kubectl and ArgoCD drive them alongside your Kubernetes manifests.Infrastructure
Managed Kubernetes
Control Plane provisions and operates the clusters, on your cloud accounts or your own servers.
CPLN BYOK
Bring your own Kubernetes: register a cluster you already run and it becomes a location workloads roll out to.
Wormhole agent
Reach TCP and UDP endpoints inside a VPC, an on-prem data center, or a developer’s laptop.
Native networking
AWS PrivateLink and GCP Private Service Connect, for services that never leave the VPC.
Observe and automate
Logs
Workload, access, and cron logs, queryable with LogQL from the Console, CLI, API, Grafana, or an AI agent.
Metrics
What every org, workload, replica, and volume emits before you instrument anything.
Audit Trail
Every platform action, plus your application’s own events written to the same trail.
External logging
Forward org logs to S3, CloudWatch, Datadog, Coralogix, Loki, and other providers.
CI/CD
Working pipelines for GitHub Actions, GitLab CI, Bitbucket Pipelines, and CircleCI.
Tracing
Follow one request across every workload it passes through, at a sampling rate you set.
Reference documentation
Workload
Containers, autoscaling, firewall, volumes, load balancing, and termination.
GVC
Locations, pull secrets, the shared identity, and GVC-wide environment.
Identity
Credential-free cloud access, and the network resources a workload may reach.
Policy
Bindings, permissions, and the principals a policy grants them to.
Domain
Routing modes, routes, ports, TLS settings, and CORS.
All resources
Every kind, including secrets, volume sets, images, locations, cloud accounts, and quotas.