Concepts

Projects & accounts

How workspaces, resource pools, and the isolation between projects work.

Your account is the top-level container: it owns billing, members, and the resource pool. Projects live inside your account; each project is an isolated environment where your apps run. Most users start with one or two projects (e.g. staging, prod) and grow from there.

Projects belong to a workspace: your personal one, or a shared workspace whose owner adds members with the role admin or member. Projects in a shared workspace run on the workspace owner’s plan. Your agent sees every workspace it can act in, and the projects in it, through nyx_project_list.

The RAM pool

Each project draws RAM from your account pool: your plan’s baseline plus any RAM packs you’ve booked. Storage comes from a separate pool (your plan’s storage plus any storage packs), not from RAM.

If your pool is 8 GB and you’ve assigned 5 GB to prod and 2 GB to staging, 1 GB is left. Raising staging to 4 GB needs either less for prod or another RAM pack. Your agent handles the resize; booking a pack is a person’s step in the console. The calls, and which step changes the bill, are in Scaling and RAM.

Isolation between projects

Projects are sealed off from each other, also inside the same workspace. Where a resource has its own login, each project (or each bucket) gets its own identity, and the system that holds the resource checks it: the separation is not a filter in front of a shared account.

Inside a project, apps reach each other privately. Between projects, only the public endpoint is reachable, the same way it is for anyone on the internet.

Resource	What keeps other projects out
Apps and databases you run	Each project has its own network boundary. Apps in a project reach each other; traffic from other projects is blocked. A database you run in one project is not reachable from another.
Your agent’s access	The tools that act inside a project run with a role bound to that project alone.
Buckets (where object storage is available)	Every `Bucket` gets its own credentials at the storage provider, and a bucket policy there refuses every other key, including those of other projects. See Storage and backups.
Git on a connected Gerrit	Every project reads with its own read-only account, and only the repositories the repository owner granted to that project. See Deploy from a private repo.
Secrets	Project and app secrets live in their project. Its workloads and its agent can read them; no other project can.

Console

In the console, a project’s RAM sits on its Apps & agents page, next to the apps that use it. From the CLI: nyx account ram and nyx project state.

Next: The cookbook →