> ## Documentation index
> The full klickops handbook index is at https://klickops.io/en/llms.txt
> The HTML of this page is at https://klickops.io/en/docs/limits
> Language: en

# What klickops does not do

Every limit of the platform on one page, with the way around it where there is one.

## What it is

klickops runs your apps, databases, buckets and scheduled jobs on a platform you share with other customers. Some things are locked so that nobody can get in anyone else's way. This page collects those limits. Nothing listed here can be switched on through the CLI or the API either.

Where your plan does not fit, the way around it is listed next to the limit. If there is none, read [If you need more](#if-you-need-more).

## Inside a container

| Limit | What it means | Way around |
| --- | --- | --- |
| No access to the Kubernetes API | A container gets no token for the cluster. Tools that start pods or create resources themselves do not run. That includes operators, Helm inside a container and your own CI runners. | Use the klickops [CLI](/en/docs/cli) or API. |
| No privileged containers | Docker-in-Docker does not run. The only extra capability is `NET_BIND_SERVICE`, so an app can listen on a port below 1024. | Build the image in your CI and let klickops roll it out ([Git](/en/docs/git)). |
| No access to the server | No host network, no host paths, no devices. | None. |
| No GPU | There are no servers with a graphics card. | None. |
| Linux only | Windows containers do not run. | None. |

An image that runs as root still starts. klickops then isolates it where the cluster supports that ([Apps](/en/docs/apps)).

## On the network

- **Inbound is HTTP and HTTPS only.** Traffic comes in through a [domain](/en/docs/domains). There are no TCP or UDP ports of your own and no IP address of your own. To reach a database or an app's port from your machine, use `klops pf`, for example `klops pf svc/pg-main 5432`.
- **Outbound reaches the public internet only.** klickops cannot reach a private network, a VPN or your own data centre.
- **Outbound uses a few ports only.** HTTP (80), HTTPS (443), SSH (22), DNS (53), NTP (123) and ping are open. Mail over SMTP therefore does not go out. Use your mail provider's HTTPS API. An external database on port 5432 is out of reach too. [Firewall](/en/docs/firewall) has the details.
- **No fixed outbound IP address.** A service that only accepts requests from known IP addresses cannot let klickops in.
- **One region.** Everything runs in Switzerland. There is no second region and no global edge network.

## Services

- **Databases:** PostgreSQL and Valkey (compatible with Redis). There is no MySQL, MariaDB or MongoDB.
- **Storage:** [buckets](/en/docs/buckets) with an S3 API, and [volumes](/en/docs/volumes).
- **Not offered:** Kafka, RabbitMQ, Elasticsearch, OpenSearch and ClickHouse. An external provider is reachable only if it answers on one of the open ports, which usually means HTTPS.
- **Valkey is a single instance.** It has no replication and no backups.
- **A volume belongs to one app.** Two apps cannot write to the same volume. An app with a volume restarts on an update instead of keeping the old version running alongside. Put shared files in a bucket.

## Fixed sizes

| What | Limit | If you need more |
| --- | --- | --- |
| One configuration entry | 8 KiB | Put larger files in a volume or a bucket. |
| All entries of one configuration | 64 KiB | The same. |
| Dump upload into a database | 2 GiB | Export and import in parts, for example one schema at a time with `pg_dump --schema`. |
| One API call | 1 MiB | Applies to calls with JSON. |
| API calls | 10 per second, briefly up to 50 | Wait and try again. |
| One build | 45 minutes | A build that was stopped does not start again on its own. |
| Backups | at most hourly, kept up to 365 days | None. |

## Plans

Every plan sets upper limits. klickops checks them when you create something and refuses what goes beyond. The message names the limit.

| | Free | Hobby | Starter | Pro | Scale |
| --- | --- | --- | --- | --- | --- |
| Projects | 1 | 2 | 5 | 15 | 40 |
| Apps | 1 | 10 | 30 | 75 | 200 |
| Databases | 1 | 2 | 5 | 15 | 40 |
| Custom domains | 0 | 3 | 10 | 30 | 100 |
| Replicas per app | 1 | 3 | 5 | 10 | 20 |
| Builds at once | 1 | 1 | 2 | 4 | 8 |
| vCPU per project | 1 | 4 | 8 | 16 | 32 |
| Memory per project | 1 GB | 8 GB | 16 GB | 32 GB | 64 GB |
| Storage per project | 3 GB | 50 GB | 200 GB | 500 GB | 2,000 GB |

Scheduled jobs are counted apart from apps, with the same upper limit. On Free an app cannot draw more than it reserved, and a bucket holds at most 1 GB. A Custom plan from CHF 200 brings more credit. Its upper limits are those of Scale. [Plans and costs](/en/docs/billing) explains what you pay.

## In operation

- **klickops is in beta.** There is no SLA and no availability commitment. Keep your own backups of anything important.
- **No CI.** klickops builds your image from a repository but runs no tests and no pipelines ([Git](/en/docs/git)).
- **A workload stays in its project.** Apps and databases cannot move to another project ([Organizations, projects, workloads](/en/docs/concepts)).

## If you need more

If you hit a limit with no way around it, an environment of your own fits better. That can be your own Kubernetes cluster with full access, virtual machines, or one of the services missing here. [Pricing](/en/pricing#beyond) says when that fits and how to reach us.

## Related

- [Firewall](/en/docs/firewall) explains what your apps may reach.
- [Plans and costs](/en/docs/billing) shows what you pay.
- [When something is wrong](/en/docs/troubleshooting) helps when a limit looks like an error.