I-Capy · 2025 · Production
Production GCP Platform
Production cloud infrastructure for an EdTech product on GCP, owned end to end by a single engineer: environment isolation, managed runtime, database durability, and a cost model that holds as the user base grows.
Context
An EdTech startup running its entire product on GCP with one engineer responsible for the infrastructure end to end. The system had to stay reliable in production while staying cheap enough for an early-stage company, and legible enough that a second engineer could pick it up.
Architecture
Decisions & trade-offs
Cloud Run
chosen over GKE / Kubernetes
Traffic is spiky with a low baseline, and there is exactly one engineer on call. Kubernetes would have added a control plane, node upgrades and an operational surface with no product benefit at this scale. Cloud Run scales to zero, bills per request and removes cluster maintenance entirely. Trade-off accepted: less control over networking, and no long-lived workloads.
One GCP project per environment
chosen over A single project with environment prefixes
Prefix-based separation relies on discipline and IAM conditions to stop a staging job from writing to production data. Separate projects make the blast radius a hard boundary — separate billing, separate service accounts, separate quotas. Costs a little more setup, removes a whole class of incident.
Cloud SQL with HA and point-in-time recovery
chosen over Single-zone instance with nightly dumps
Nightly dumps mean the worst case is losing a day of student progress. HA covers zone failure and PITR covers human error, which is by far the more likely failure mode. Priced against the per-tier cost matrix and it stayed inside budget for the current user base.
CI/CD & operations
- GitHub Actions builds a container image per service, tags it with the commit SHA and pushes to Artifact Registry.
- Deploys are promoted by environment: dev on every merge, staging on demand, production behind a manual approval gate.
- Cloud SQL runs with high availability and point-in-time recovery, so a bad migration is recoverable without restoring an entire instance.
- Rollback is a redeploy of the previous image tag — no rebuild, no branch surgery.
Results
Environments
3 isolated GCP projects
Runtime
Cloud Run, scale-to-zero
Database
HA + PITR
Ownership
Sole engineer, end to end