AWS EKS

What EKS does differently, and what 3B needs as a result. The install itself is the same as on any cluster: follow the Helm installation guide. Building the cluster, load balancer, TLS, and DNS is yours to design and own.

Platform behavior described here was accurate in August 2026. AWS changes EKS defaults over time, including node image hardening and Auto Mode’s built-in add-ons, and we update these guides as we learn of changes. The node compatibility check in the installation guide is always the authority for your own cluster. If something here is out of date, please tell Tines Support.

3B runs every workflow step inside a gVisor sandbox, so its api and worker pods set hostUsers: false. EKS Auto Mode’s containerd supports that, but the node image ships the user.max_user_namespaces sysctl hardened to 0, and those pods will not start on a node until it is raised. Autoscaled and replacement nodes need it too, so fixing today’s nodes by hand isn’t enough.

The chart ships a privileged per-node DaemonSet for this, off by default:

Scope it with usernsbox.nodeSelector if only some node pools run 3B. If a privileged DaemonSet from our chart doesn’t fit your standards, set user.max_user_namespaces and user.max_net_namespaces to a non-zero value through your own node bootstrap instead. 3B doesn’t care how they get set, only that they are.

Confirm the result with the node compatibility check in the installation guide before you install.

Route to the chart’s nginx service on port 80 and nothing else. It host-routes all four hostnames internally, so one load balancer and one listener covers the whole deployment.

3B’s UI holds a long-lived websocket for real-time sync, and an ALB’s default idle timeout of 60 seconds closes it repeatedly. That surfaces as a UI which loads and then silently stops updating, so raise the idle timeout far beyond the default; we run 4000 seconds.

Terminating TLS at the ALB with an ACM certificate is the usual choice here. 3B then serves plain HTTP behind it and depends on X-Forwarded-Proto: https being forwarded, so make sure the ALB passes it. Terminating at the chart’s nginx instead is equally supported. See TLS termination.

Auto Mode ships no default StorageClass. The chart requests persistent volumes for Postgres and the blob store, so both pods sit Pending until one exists. Any SSD-backed class works, gp3 being the usual choice. Either mark a class as cluster default, or name one explicitly with postgres.storage.storageClass and blobstore.storage.storageClass. See sizing for volume sizes.