# Where your agents run

> Kindgi Cloud runs Kindgi for you, or you run it in your own infrastructure. Where to start for each, and the pages that apply to both.

Your agents run in one of two places:

- **Kindgi Cloud:** we run Kindgi for you. You deploy your pack with the Kindgi CLI, and Kindgi Cloud builds it and runs it.
- **Self-hosted:** you run Kindgi in your own infrastructure, next to your data, and operate it there.

Either way, you build and test the pack on your machine with `kindgi dev`.

## Kindgi Cloud

We run it for you. In private preview.

- **[Deploy your agent to Kindgi Cloud](https://docs.kindgi.com/v0.1.10/hosted/deploy-your-agent.md):** sign the CLI in, sign the pack, give it your model key, deploy it, try it and go live. Then change an agent once it's live.
- **[Limits](https://docs.kindgi.com/v0.1.10/hosted/limits.md):** the limits every Kindgi Cloud account has, what a call or a run sees past each one, and how to ask for more.

## Self-hosted

Kindgi is self-host first: the runtime you run on your machine with `kindgi dev` is the same image you deploy. Your pack's code runs beside it, in a pack service built from your app.

> **Note: Access to the runtime image**
>
> Sign in at [access.kindgi.com](https://access.kindgi.com/) with GitHub for the runtime image's pull credentials, and log in once with `kindgi auth registry` (see [Install](https://docs.kindgi.com/v0.1.10/start/install.md#access-to-the-runtime-image)). Questions or trouble: <contact@kindgi.com>.

- **[Self-host with Docker](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/self-host.md):** the runtime and your pack service as containers, with your own Postgres.
- **[Operate it](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/operate.md):** health and logs, backups and restores, upgrades, and rotating its tokens and keys.
- **[Serve many tenants](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/serve-many-tenants.md):** one runtime for tenants who don't trust one another: the settings it starts only with, the operator's system keys, a pack service for each deployment, and closing and purging a tenant.
- **[Keep secrets in your own secret manager](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/secret-manager.md):** Azure Key Vault, Google Secret Manager or HashiCorp Vault holds the secrets set through Kindgi's API, and Kindgi keeps their names and versions.
- **[Keep and purge deleted data](https://docs.kindgi.com/v0.1.10/deploy/retention.md):** how long deleted records are kept, and the retention policies and sweeps that purge them.
- **[Turn on sign-in](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/sign-in.md):** people sign in to the console with their organization's identity provider, Google, Microsoft or GitHub, or a link by email.
- **[Publish the addresses your calls come from](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/egress-addresses.md):** for a site that admits only known addresses, and `kindgi egress` to print them.
- **[Google Cloud Run](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/cloud-run.md):** the runtime and your pack's service as two Cloud Run services, with Cloud SQL, from Kindgi's Terraform module.
- **[Azure Container Apps](https://docs.kindgi.com/v0.1.10/deploy/self-hosted/azure-container-apps.md):** the runtime and your pack's service as two container apps, with PostgreSQL Flexible Server and Key Vault, from Kindgi's Terraform module.

## On both

These pages apply on Kindgi Cloud and on a runtime you run. Each says, in an **On Kindgi Cloud** note, what's different there.

- **[People, API keys and service accounts](https://docs.kindgi.com/v0.1.10/deploy/people-and-keys.md):** add people and give them roles and their own keys, give pipelines service accounts, and remove someone in one step.
- **[Run with authorization](https://docs.kindgi.com/v0.1.10/deploy/authorization.md):** what it gives and what it doesn't. On a runtime you run, you run OpenFGA next to it.