Global edge PoPs
Fly.io runs anycast in dozens of cities. SkyForge targets sovereign and shared regions, not a large edge PoP fleet — if your bottleneck is last-mile latency in many countries, that is Fly.io's turf today.
Compare
Every managed PaaS can deploy an app and most offer a database, secrets and team SSO. What none of them offer is one governed, sovereign platform where those primitives are shared, admission is mandatory, and the audit trail is signed.
At a glance
| Capability | SkyForge | Northflank | Render | Railway | Fly.io |
|---|---|---|---|---|---|
| Free tier | Yes — 1 app + previews | Trial / free dev | Yes (limited) | Trial credit | Yes (limited) |
| Usage-based pricing | vCPU-hr / GB-hr / egress | Compute + storage | Instance + usage | Usage-based | Per-second usage |
| Regions / PoPs | Sovereign + shared regions | Multi-region | Multi-region | Multi-region | Many global PoPs |
| BYO build runners | Yes (self-hosted, ADR-0070) | Yes (BYOC) | No | No | Partial |
| Built-in database | Yes (SS-02 claim) | Yes | Yes | Yes | Yes |
| Built-in secrets | Yes (SS-05 Vault) | Yes | Yes | Yes | Yes |
| Built-in identity / SSO | Yes (SS-01 OIDC) | Team SSO | Team SSO | Team SSO | Team SSO |
| Built-in observability | Yes (SS-06) | Yes | Metrics/logs | Metrics/logs | Metrics/logs |
| Non-negotiable admission | Cosign + SBOM + scan | Optional | No | No | No |
| Sovereign tenancy & signed audit | Yes — 7-yr signed chain | No | No | No | No |
Capability by capability
The competitors are strong products — this is not a strawman. The point-by-point below separates table stakes (where everyone is fine) from the places SkyForge is structurally different.
| Capability | SkyForge | Point-PaaS (Northflank / Render / Railway / Fly) |
|---|---|---|
| Git push to deploy | Yes — 10 providers, one webhook | Yes across all four |
| Crash-safe resumable deploy | Yes — persisted saga, per-step compensation | Rebuild on failure (typical) |
| Auto-rollback on unhealthy | Yes — first unhealthy signal → last-good | Health checks + manual rollback (varies) |
| Immutable revisions | Yes — rollback re-points, never rebuilds | Yes (most) |
| Capability | SkyForge | Point-PaaS (Northflank / Render / Railway / Fly) |
|---|---|---|
| Mandatory image admission | Cosign signature + SBOM + scan, non-negotiable | Optional or absent |
| Quality gates block deploys | Yes — test %, vuln ceilings, signed-image floor | CI checks, not a platform gate |
| Signed, tamper-evident audit | Yes — hash chain, Vault-Transit signed (ADR-0014) | Activity logs |
| Agents can't approve promotions | Yes — structural refusal (OPS09) | N/A |
| Capability | SkyForge | Point-PaaS (Northflank / Render / Railway / Fly) |
|---|---|---|
| Identity / SSO | SS-01 OIDC — same identity gates every call | Team SSO add-on |
| Database | SS-02 claim + SS-05 secret ref | Managed DB (separate product/bill) |
| Observability | SS-06 built in; drives autoscale + audit | Metrics/logs, often third-party |
| Test & device lab | SS-53 TestGrid on the same plane | Bring your own |
| Capability | SkyForge | Point-PaaS (Northflank / Render / Railway / Fly) |
|---|---|---|
| Self-hosted build runners | Yes — linux, drain on your terms (ADR-0070) | BYOC on some; none on others |
| Portable desired-state export | Yes — GET /apps/{app}/export (ADR-0055) | Config export varies; rarely first-class |
| Dedicated / sovereign regions | Yes — Enterprise | Region choice, not sovereignty |
| One governed control plane | Yes — 60 services, one mesh, one tenancy model | A deploy product + a market of add-ons |
Honest gaps
Sovereignty and integration are the wedge — they are not everything. These are the places another vendor legitimately leads today.
Fly.io runs anycast in dozens of cities. SkyForge targets sovereign and shared regions, not a large edge PoP fleet — if your bottleneck is last-mile latency in many countries, that is Fly.io's turf today.
Northflank, Render and Railway have years of templates, marketplace integrations and community content. SkyForge leads with an integrated platform and governance, not a marketplace.
GPU is feature-gated off by default (ADR-0060): requests park in a requested state until accelerator pools are attached. Competitors with live GPU fleets ship that today.
Addons cover distributed SQL, cache, object and search as SS-02 claims. If you need an exotic managed engine a competitor lists in its marketplace, check the catalog first.
Competitor capabilities are summarised in good faith and change often — check each vendor for current details. SkyForge's differentiator is not any single row but the integrated, sovereign platform the whole column sits on.