Why this exists
The usual answer to “can we run this on our own infrastructure?” is a self-hosting guide: here is the whole platform, good luck operating it. That trade is bad for most teams — they wanted their data and their compute to stay put, not to inherit a distributed system to run.
Forge splits the two. The control plane stays managed — scheduling, workflow state, the audit trail, the dashboard. The execution moves to you. A turn runs on your machine, inside your network, with access to the things only your network can reach.
How it works
Install the daemon on a machine you control and authorise it. It registers as a runner bound to your organisation, declares how much concurrent work it can take, and starts receiving turns. From then on the machine behaves like any other worker in your fleet — the difference is that it is yours.
Nothing about the workflow changes. The same workflows , the same characters , the same git-backed record . Only the question of where the work physically happened has a different answer.
When this is the answer
- The data cannot leave. Policy, contract, or regulation says the work happens inside your perimeter.
- The systems are internal. An agent that needs to reach something only reachable from your network has to run from your network.
- You already own the compute. Machines you have paid for doing work you would otherwise rent.
- Sovereignty matters. Where the inference happens and where the execution happens can be different answers, and both can be yours — combined with provider routing , including self-hosted models.
Honest boundaries
- The control plane is still ours. This is bring-your-own-execution, not a full air-gapped install. If that distinction matters to you, it is a conversation, not a checkbox.
- A registered host is a trust decision. Authorisation is deliberately explicit — a machine joins your fleet because someone approved it, never by discovering it.
- Your hardware, your reliability. A laptop that closes is a worker that disappears; the fleet handles it, but capacity planning is yours.
Under the hood
- Cloud & Local Development — the same runtime, run anywhere
- Isolated Stacks — what bounds a run wherever it executes
- Secrets & Egress — why moving execution does not move your credentials