Concepts

Quotas, limits and measured cost

What stops a create, what closes a desktop, and how compute cost is measured. Nothing is billed.

Workspace limits

Each workspace has limits that only its owners can change (under Usage > Limits). The defaults:

Limit	Default	Enforced
Live computers	10	On every create and fork (the copies count), through the SDK, the HTTP API and the console
Default computer lifetime	3600 s	Used when a create passes no `ttl` (or `ttl <= 0`)
Maximum computer lifetime	14400 s	Longer `ttl` values are capped to it
Parallel runs	2	Console runs at once
Run parallelism	8	Copies per task in a run (and fork size for runs)
Spend cap	none	Per period (month or day, UTC), on measured compute cost

A refused create or fork answers 403 with quota_exceeded (and details.limit, e.g. max_live_computers) or budget_exceeded. These are 403 on purpose, never 429: a 429 means "try again shortly" and clients retry it, while a limit does not go away by waiting.

Host limits

Your worker host has its own limits, shared by your workspace's members and keys. On the current pilot host:

Limit	Value
Desktops on the host	10
Saved states on the host	5
Copies per fork	8
Desktop size	4 vCPU, 4 GiB, no swap

When the host is full, a create or fork answers 429 overloaded with Retry-After. Nothing was started; retry later or close desktops you no longer need. client.health()["capacity"] shows {live, max}.

What closes a desktop

You: env.close(), the end of a with block, client.close(), or the SDK's cleanup at process exit.
Its lifetime (ttl) runs out.
Its idle timeout runs out: no request named it for 1800 s (or the idle_timeout you set). Listing computers does not count as a use. The record's closed_reason then reads like lease: idle 1800 s.
The workspace reaches its spend cap: every live computer is closed and every active run is cancelled.
An operator suspends the workspace.

Any call on a closed desktop raises EnvGone (HTTP 410). The SDK closes the desktops a client created when the process exits normally or gets SIGTERM/SIGHUP; a kill -9 cannot run cleanup, and the lifetime and idle timeout close those desktops.

Measured compute cost (not billed)

Note

Billing is not enabled. No tariff, contract or payment processor is configured, so nothing is invoiced or charged. Cost figures in the console and the API are measured compute cost (not billed). Spend caps are enforced on that measured cost regardless.

How it is measured:

Desktop-seconds come from the runtime's own create and close times for each desktop, cut into 60-second buckets, one ledger row per bucket. Desktops that failed after they got a slot are measured too.
Saved-state seconds are measured the same way.
Each bucket's cost is its seconds times the host's hourly cost basis set by the operator. It is a measurement of what the host costs to run, not a price.

Where to see it:

Console Usage: desktop-hours, snapshot-hours and measured cost, grouped by day, run or resource, with CSV export.
client.metrics() (GET /v1/metrics): the runtime's window for the host, including cost per valid episode and per verified reward. The window's wall time includes idle time; it starts at the runtime's start or the last reset_metrics().
env.metrics(): one desktop's share by desktop-seconds.

API rate limits

Limit	Value
Requests per API key	20 per second, burst 60
Failed authentications per source IP	1 per second, burst 20 (checked before any key lookup)
Viewer frames per grant	2 per second

Over the limit the gateway answers 429 rate_limited with Retry-After. The SDK raises Overloaded for it.