Evaluate dedicated Hetzner screening host (128GB) for concurrent builds + reviews

[Peyton-Spencer]

Idea (from operator)

An unused Hetzner machine with 128GB RAM could run screening builds and reviews concurrently, replacing/augmenting the Targon-first + Cloud Run fallback stack:

• Builds: Kaniko (or plain BuildKit) with persistent local build caches — eliminates both the Targon 409 capacity roulette and the Cloud Run Docker Hub anonymous-pull rate limit (fix(screener-orchestrator): pull Kaniko base images through mirror.gcr.io #1211 mirrors around it, but a warm local cache is strictly better). Requires managed cache eviction (disk budget, per-base-image pinning) since miner Dockerfiles are untrusted — caches must be content-addressed and never shared into untrusted build contexts in a way that leaks other miners' layers.
• Reviews: the court is network+CPU bound (model calls to OpenRouter); a single big host can run many concurrent one-shot review processes with the same credential-minimal contract (job token + Secret Manager materialization) as today.

Considerations

• Prior art exists: ditto-assistant/backend already operates a Hetzner host with Ansible roles and Secret Manager access over ADC — same pattern can enroll this box.
• Untrusted-execution boundary: miner builds/smokes are hostile code; the host needs the same isolation posture as the GCE fallback did (no cloud/GitHub/Platform creds inside build sandboxes; see docs/UNTRUSTED-EXECUTION-RUNBOOK.md). This is the main design cost vs serverless Cloud Run, where isolation is free per-job.
• Cost: current GCP screening spend rides Cloud Run per-job pricing; fleet-cost analysis (2026-08) put the GCE fleet at ~$671/mo with a ~$359 rightsized floor — a Hetzner box undercuts both, but only wins if the isolation + cache-management engineering is cheap enough.
• Provider mix stays policy-controlled via screener_provider_settings (ordered lanes), so a "hetzner" provider could slot in as primary with Cloud Run remaining the serverless fallback.

Ask

Decide whether to spec this as a real provider (Terraform/Ansible + provider adapter + trusted-build path) or shelve until screening volume justifies it.

🤖 Generated with Claude Code