Cloud Run GPUs vs Vast.ai

Cloud Run GPUs 70

Hosted reading. Google Cloud's status page with a JSON incident feed (20). In the 90 days from 8 August 2026 the feed names Cloud Run in three multi-product incidents, a service outage on 20 August (15:40 to 19:20 UTC, 27 products, global and us-west1), a network degradation in us-central1-b on 1 September and a europe-west2 disruption on 20 October. One major (10). Resource limits and GPU quota are published with numbers (3 GPUs a region by default), but no request rate for the Admin API was found on the quotas page (10). Google's client libraries retry with backoff and the Admin API takes etags, while no GPU-specific retry guidance was found (10). An SLA for GPU services, 99.95% with zonal redundancy and 99.5% without (10). GPU services generally available since 7 April 2025 (10). 20+10+10+10+10+10 = 70.

Vast.ai 50

Graded as a hosted service. status.vast.ai is Vast.ai's own page with three components (vast, console, serverless) and 30-day bars built from roughly hourly checks, with no incident write-ups (20). The page draws its bars by script from check-log files on the same host. The 8 October count came from those files, the page's own data, which this run doesn't read (as the Docusign and SeaTable listings read their status pages' data feeds), so it's struck, and the window from 4 August to 2 November is unread (5). The page covers Vast.ai's control plane and not the independent hosts' machines. Rate limits are described as a minimum interval per endpoint and identity, re-read on 2 November, but thresholds are unpublished apart from an x-rateLimit value on 2 of 89 operations in the OpenAPI file (5 of 15). 429 is documented with backoff advice and the CLI retries it, but the docs say the API sets no Retry-After header, and there is no idempotency key for instance creation (10 of 15). No SLA found, and the terms say availability is not guaranteed (0). Instances, serverless and the REST API carry no beta label (10). 20 + 5 + 5 + 10 + 0 + 10 = 50.

Cloud Run GPUs 84

Closed service under the Google Cloud terms, with Apache-2.0 client libraries (15). The Cloud Data Processing Addendum and the privacy notice cover customer data, per the Document AI listing's 1 November reading; no Cloud Run statement on GPU instance data after shutdown was found (22). The Cloud terms promise 12 months' notice before a backwards-incompatible API change, and driver versions are announced in the release notes (16). Regions per GPU type listed, with Google's subprocessor list and data-location terms (16). 15+22+16+16 = 69.

Vast.ai 64

A closed service with an MIT CLI and SDK. The Terms of Use Agreement of 1 September 2026, re-read on 2 November, prohibits scripts and automated access to the services without a separate written agreement, which conflicts with the public API and agent tooling (17 of 30). The compliance page says data is destroyed when an instance is deleted, and the DPA allows return or deletion on written notice within 30 days of termination. The privacy policy of 18 June 2025 is written for website users, gives no retention periods, allows targeted advertising and contains an unfilled [INSERT HYPERLINK] placeholder (15 of 30). No deprecation policy was found, and the terms allow changes or discontinuation without notice. v0 and v1 routes coexist (3 of 20). The DPA names five sub-processors without locations and gives new ones only on request. Host location is shown per listing and can be filtered (10 of 20). 17 + 15 + 3 + 10 = 45.

Cloud Run GPUs 66

Platform reading. One gcloud run deploy with --gpu and --gpu-type adds a GPU to a container, and responses carry the service object with fieldMask on updates (15). List calls page with pageSize and pageToken (15). Google's status codes and messages, with quota errors that name the limit (12). Revisions are immutable, traffic can be moved back, and etags guard updates, but no idempotency key on create (12). Client libraries in many languages and gcloud, though a GPU deploy needs instance-based billing, minimum CPU and memory and, past 3 GPUs, a quota request (12). 15+15+12+12+12 = 66.

Vast.ai 57

No MCP server for account actions. The CLI skill file is about 19 KB, --raw returns JSON on every command, and the v1 instances route supports column selection (18 of 25). Search takes filter operators, sort fields and a price cap, and v1 instances use keyset pagination with at most 25 a page (16 of 20). The usual error body has success, error and msg, but some endpoints omit fields and 429 is often plain text (10 of 20). No idempotency keys were found in the OpenAPI file. The CLI retries only 429, and vastai destroy instance asks for confirmation unless -y is passed (5 of 20). Templates supply launch defaults. The only official SDK is Python, and the docs send other languages to raw REST (8 of 15). 18 + 16 + 10 + 5 + 8 = 57.

Cloud Run GPUs 78

OAuth 2.0 tokens from service accounts under IAM. Google's APIs accept access_token as a query parameter, the 10-point deduction other Google API listings take (20). IAM roles separate viewing, deploying and invoking, and services can require IAM authentication for every call (16). The platform runs your own container and returns its output (10). Cloud Audit Logs record Admin API calls, and request logs go to Cloud Logging (15). Google's vulnerability reward programme, security.txt and certifications (17). 20+16+10+15+17 = 78.

Vast.ai 70

Keys can be scoped to 11 permission categories and narrowed by constraints to resource IDs, are shown once, and can be reset or deleted with immediate effect (30). The rate-limit page, re-read on 2 November, names an api_key query parameter as part of a caller's identity while the authentication page shows only the Bearer header. We took 5 of the checklist's 10 points for a key that can travel in a URL, a judgement call because the option is acknowledged but not taught (25 of 30). Read-only categories and per-instance constraints exist. The CLI confirms a destroy, and Vast.ai's auth.md asks agents to confirm paid or destructive actions, but nothing on the server enforces approval and default keys have full access (15 of 20). The service runs the customer's own containers and returns their logs (10). vastai show audit-logs returns account action history. Its retention and fields were not reviewed (10 of 15). A vulnerability disclosure policy dated 23 July 2025, re-read on 2 November, has safe harbour, triage within 5 business days and security@vast.ai. Its bounty is discretionary, which this checklist doesn't count. The compliance page states SOC 2 Type 2 and makes a SOC 3 report available on request. There is no security.txt (404 on 2 November) and no advisories for vastai in OSV, and the security FAQ says individual hosts may have less formal security. A reporting route and SOC 2 with no counted bounty take 10, as Sinch's messaging listing (10 of 20). 25 + 15 + 10 + 10 + 10 = 70.