Overview

Deploying Fuse for real workloads: orchestrator, hosts, and GPU hosts

Fuse is self-hosted: you run the orchestrator (the control plane) and one or more hosts (each running a host agent) yourself. This section covers bringing all of that up for real workloads, beyond the in-memory stub used in the Quickstart.

What runs where

Deploying the orchestrator

One HTTP API process, the scheduler, and the source of truth: Postgres, or in-memory for small/local deployments.

Firecracker host setup

Bring up a host running fc-agent, which drives Firecracker microVMs.

GPU host setup

Bring up a host running qemu-agent, driving QEMU/VFIO GPU passthrough: whole cards or MIG slices.

WARP egress host setup

Run Cloudflare WARP on a host as the cloudflare-warp egress provider for proxy-mode environments.

WireGuard egress host setup

Bridge each environment’s own WireGuard config to its proxy with the wireguard egress provider.

Monitoring

Prometheus metrics, health checks, and what to alert on.

Security hardening

TLS, CIDR allowlisting, fail-closed mode, and secrets encryption.

Troubleshooting

Common install and setup problems, and known limitations, with workarounds.

The simplest production topology co-locates the orchestrator on a Firecracker host and talks to fc-agent over loopback: a single command installs both as systemd services. Scaling out from there is just registering more hosts; the orchestrator itself doesn’t change.