August & September 2026 | Changelog

August and September brought a major new way to work with Northflank: Harnesses, which let you run coding agents against your repositories in managed workspaces with browser terminals, SSH, and persistent storage. We also expanded our AI, sandboxing, and BYOC capabilities with self-service microVMs on BYOC and AWS launch template support.

Across the platform, we added organization-wide security policies and access controls, customer-managed envelope encryption, and new BYOC capabilities. We also introduced container snapshots, scheduled volume backups, per-replica volumes, and private VPC load balancers. Template version history and run diffs, richer addon metrics, and a new Delhi region round out the updates.

Harnesses

Coding agents can now work directly inside a managed Northflank workspace. Choose Claude Code, OpenAI Codex, Cursor, OpenCode or Pi, authenticate with your own account or API key, and connect through the browser terminal or SSH.

Harnesses include persistent workspace volumes, custom runtime images, GPUs and networking, and can be created from the dashboard, public API, or as a template node. Teams can also set harness policies and make harnesses private. Harnesses are billed like other runtime resources.

Self-service microVMs on BYOC

You can now install sandbox security on your own clusters and run workloads with microVM or gVisor isolation inside your own cloud. This is designed for untrusted code, coding agents, and multi-tenant workloads that need a stronger isolation boundary, while keeping compute and data in your own infrastructure.

Services, jobs, addons, and builds can each use their own sandboxing mode, with support for Kata microVMs, gVisor or no sandboxing. AWS instances with nested virtualization can also be used for microVM workloads.

AWS launch templates

BYOC node pools on AWS can now use your own EC2 launch templates, so nodes can be provisioned with your own AMI, user data, storage, and network configuration instead of Northflank's defaults.

Launch templates can also be used to enable nested virtualization on EKS nodes, allowing supported instance types to run microVM workloads.

Envelope encryption with your own keys

You can now use your own cloud KMS key to wrap encryption keys, or opt into Northflank-managed envelope encryption. This lets you retain control over your secrets even when they are stored on the Northflank control plane. Encryption configuration can be managed through the API, and default encryption keys can be rotated.

Organization security policies and access controls

Organization administrators can now define ingress security policies that apply across teams. Policies can be organised into required and optional controls, giving organizations more control over the security requirements applied across their teams.

Organizations can also require SSO for managed accounts, stop teams from creating their own clusters, and prevent addons from being made publicly accessible.

Improved invitations

Team and organization invitations have been redesigned. The invite page shows which account you're signed in as and anything stopping you from joining, fills in the invited email address, and takes you straight to the team or organization once you accept. Pending invitations are shown in the dashboard header.

AWS EU Sovereign Control Plane

Northflank now supports the AWS EU Sovereign Control Plane for BYOC clusters, extending BYOC deployments to AWS's European sovereign infrastructure. ECR registries, Route 53 DNS, OpenTofu, workload identity and launch templates all work within the sovereign partition.

Nebius support

Nebius is now available as a bring your own cloud provider. Create and manage Nebius clusters from Northflank, including GPU node pools, with networking and subnet configuration handled through the standard cluster creation flow.

BYOC cluster improvements

AWS BYOC clusters can now use Kata microVM sandboxing through nested virtualization and can be converted from the default VPC to a custom VPC. Oracle OKE clusters and node pools can also be upgraded to newer Kubernetes versions.

Cluster autoscaler events now appear alongside your other cluster events, and AWS clusters have a direct link to the autoscaler logs. Azure cluster creation picks a default vNet mode and suggested node types for you, and the integrations list now shows which BYOC features each integration supports.

Cursor Origin as a Git provider

Connect Cursor Origin to Northflank and use it to build and deploy your repositories. Repository sync, pull requests, build checks, and webhooks are supported.

New Delhi region

Asia South (Delhi) is now available as a public Northflank Cloud region.

More GPUs

On-demand NVIDIA L4 GPUs are now available in the Netherlands region, NVIDIA H100s in Frankfurt, and NVIDIA RTX PRO GPUs in US West.

Private VPC load balancers

Private load balancers can now be created inside your VPC, allowing services to remain accessible only from your private network. Private AWS load balancers support security groups, and BYOK clusters can configure public and private ingress load balancers separately.

Load balancer network policies

Network policies can now control ingress traffic to load balancers.

Tailnet services

Northflank can now automatically create Tailscale VIP services for resources in a project, exposing their TCP and HTTP ports on your tailnet. You can optionally restrict the resources using tags.

CDN caching presets and purging

Northflank CDN now includes caching presets for common workloads, including safe mode and static assets. You can also purge a subdomain's CDN cache from the dashboard, CLI, or API.

Domain and TLS controls

You can now configure a minimum TLS version and TLS mode for wildcard domains on shared gateways, and renew certificates before they expire.

Container snapshots

You can now capture the filesystem of a running or terminating service pod and restore a service from a successful snapshot. Snapshots are available through the dashboard, CLI, and API and require a Kata runtime.

Scheduled volume backups

Platform volumes can now be backed up on a schedule from the dashboard, with failure alerting built in. Backups can also be restored after the source volume has been deleted.

Backup improvements

Backup destinations now support S3 Object Lock and workload identity authentication. Forks can use the latest available backup without specifying one, while PostgreSQL dumps now run against a read replica instead of the primary.

Per-replica volumes

Stateful set services can now use persistent volumes that follow each replica. These volumes are managed alongside your other project volumes, making it easier to give each replica its own persistent storage.

Addon metrics and status

Addons now have a metrics summary with storage warnings, and HA addons show which replica is the primary. Bucket addons now show metrics too. New MongoDB, Redis and RabbitMQ versions are available.

Rebuilt billing dashboard

Billing has a new layout with separate Overview, Usage, and Invoices tabs. You can drill into spend over time, see itemised cloud runtime costs on invoices, and track egress IP and load balancer usage in metered billing.

UK customers with a verified tax ID can now see VAT in GBP on invoice PDFs. Payment-method prompts are now clearer for both free and paid plans, and you can add a card while creating a team.

Template version history and run diffs

Templates now keep a history of previous versions, with a detail view and the ability to revert to an earlier revision. Each template run also records a per-node diff so you can see what changed during the run.

Template node update modes

Supported template nodes can now specify how their target resource should be handled: create, update, or patch.

Global secret template triggers

Templates can now be triggered automatically when a global secret is updated, making it easier to keep dependent resources in sync.

Template shareable links

Shareable template links can now be limited to your organization, and they expire after a year of inactivity.

Build services from source bundles

Build services can now build directly from a bundle URL instead of a Git repository. Bundle builds can also be started from the dashboard with an optional branch and commit SHA.

Build improvements

BuildKit's local disk cache is now generally available. Builds can also be skipped when a commit contains no changes.

Job run overrides

Job runs can now override GPU settings along with plan and storage. Eligible jobs and cron jobs can also run without init containers.

Secret group restrictions

Secret groups can now be restricted to specific environments as well as tags. Teams can also define a default restriction mode for newly created secret groups.

Addon secret rotation

Addon credentials can now be rotated without immediately invalidating the previous credentials. The old credentials remain valid until rotation is finalised, with support for PostgreSQL HA and MongoDB.

Redis ACL support

Redis addons can now persist and synchronise ACLs across primaries, replicas and sentinels. A Northflank-managed superuser keeps platform operations working even when access for the default user is restricted.

API and CLI improvements

API tokens can now be listed, rotated and deleted, while Git accounts can be linked directly from the CLI. Teams can also be deleted through the API, and a new authentication endpoint returns details about the credentials used for a request. Billable resource responses now include a UID.

Sentry log sink

Workload logs can now be forwarded to Sentry through the existing log sink configuration.

Convert teams into organizations

Teams can now be converted into organizations directly from team settings through a resumable migration flow.

Redesigned documentation

We’ve redesigned the Northflank documentation with a new look and improved navigation, making it easier to find and work through the information you need.

New stack templates

We added Bucardo and GitLab stack templates, along with a Qwen3 template configured for speculative decoding.

Region selection improvements

Project creation now separates recommended regions from the full list and shows region counts. Regions also display their provider city where available.

Plus many smaller fixes and refinements

We improved sign-in and SSO, API token filtering, preview blueprint pagination, project editing, deployment restart information, command menu coverage (now including workflows and preview blueprints), metrics charts (now with annotations), and Observe navigation. Resources can now be duplicated into another project. Pod lists now load more reliably, build and job timings have been corrected, add-on Slack alerts are quieter, and several rate-limit, crash, and type-error issues have been fixed across the platform.