Limits
Last updated 2 November 2026
Machines are not open yet. These pages describe Machines as they will open; until then, a create answers region_not_offered (422), “Machines are not offered in any region yet.”
Size a Machine, or plan many, before you build: how much one Machine can take, and the bounds of a wake, its settings, an image, its database and an account.
How much one Machine can take
| What | How much |
|---|---|
| CPU | Up to its shape’s vCPUs, sharing the host’s cores with other Machines. |
| Memory | Up to its shape’s. A host never promises more memory than it has, so that much is there when the Machine uses it. A Machine that uses more is stopped, and the next request starts it fresh. |
| Disk | The image with 1 GiB free, and the shape’s scratch disk at /scratch; both start empty at every wake (see What a wake starts with). |
| Requests | No limit on how many, how many at once, or how long each one lasts. |
| Data | Its database, below. |
| Shape | vCPUs | Memory | Scratch disk |
|---|---|---|---|
s-1 | 1 | 2 GiB | 10 GiB |
s-2 | 2 | 4 GiB | 20 GiB |
m-4 | 4 | 8 GiB | 40 GiB |
m-8 (the CLI’s default) | 8 | 16 GiB | 80 GiB |
What each shape costs is on Pricing.
One wake
- A request that wakes the Machine waits up to 25 seconds, then is answered
503withRetry-After: 1 second while it starts, 5 seconds while its image is pulled, 15 seconds while its credit is checked, and 30 seconds when no host has room. - Credit for 10 minutes at the shape’s full price before it starts, and before each further 10 minutes (see Credit).
- It sleeps its sleep-after time after its last request: 10 minutes by default, from 30 seconds to 24 hours; or after about 2 minutes when no request and no connection of its own is open and it uses almost no CPU or network.
- A stop grace of 0 to 230 seconds, 10 by default, and at most 60 when credit runs out.
- After 3 failed wakes within 5 minutes, wakes are refused for 5 minutes.
One Machine’s settings
- A name of 1 to 40 lowercase letters, digits and dashes, starting with a letter; with your account’s name,
<name>-<account>, at most 55 characters. - Up to 8 ports, 1 to 65,535 but not 22 or 1023, one of them the default.
- Up to 128 environment variables, each value up to 32,768 characters.
- A command of up to 64 arguments, each up to 4,096 characters.
One image
linux/arm64, public, and at most 8 GiB compressed, 16 GiB uncompressed, 128 layers and 500,000 files and directories.
Its database
- Up to 256 MiB compressed, like every database.
- A transaction changes at most 16 MiB of pages, and a crash loses at most 16 MiB of unconfirmed commits plus one, when the program opens the database as shown.
- About 40 commits a second, and 4 MiB a second of committed data, averaged over a second: each commit sends Tonbo one request, and the reads of a cold start count among the requests. Past them Tonbo refuses the extra requests until the second’s allowance refills (see Database wiring).
Its Volume
- 1 to 100 GiB, billed for the bytes it holds, not its size.
- At most 1 per Machine and 10 per account, each in one region and attached only to a Machine there.
- No snapshots, backups or resizing, and no Volume shared between Machines. Volumes are not offered yet.
One account
- As many Machines as your account’s database limit allows: 10,000, shared with its other databases.
- No limit on how many are awake at once; your balance pays for each.
- Regions:
us-east-1andap-southeast-1, at the same prices.
What a Machine does not offer
- Running a command in it, reading or writing its files from outside, or connecting with SSH.
- gRPC, or your own domain (see What reaches your program).
- Reading what your program prints, or a store for secrets only some members may read (see Run your own image).
- An image built only for x86 (amd64), or one in a private registry: images are public and
linux/arm64. - Opening the Machine’s database from a language other than Node.js; any language can keep files on the Volume.
Outbound connections
IPv4 only, with the blocked ports and ranges on Network guarantees.