DEV Community

Cover image for Choosing between the open-source sovereign stack and managed public cloud
binadit
binadit

Posted on • Originally published at binadit.com

Choosing between the open-source sovereign stack and managed public cloud

Sovereign stack or managed cloud: the real math behind the decision

Your cloud bill just crossed six figures a month and someone on the platform team asked, "could we just... run this ourselves?" If you've had that conversation, you already know the answer isn't obvious. Let's break down when self-hosting Proxmox, Ceph, OpenStack, and Kubernetes actually beats renting from a hyperscaler, and when it doesn't.

Who actually hits this decision

Three groups keep running into this:

  • SaaS teams where cloud spend stopped scaling sanely
  • Regulated companies (fintech, healthcare, gov contractors) that need provable EU data residency
  • Platform teams burned by a surprise pricing change or an outage nobody on their side could fix

This isn't really "open source vs cloud." It's "who operates your infrastructure": you, or a partner/hyperscaler doing it for you.

The sovereign stack, layer by layer 

Kubernetes        <- container scheduling
   |
OpenStack         <- API layer: compute, Neutron networking, Keystone identity
   |
Ceph              <- distributed block/object/file storage
   |
Proxmox VE (KVM/LXC) <- virtualization layer
Enter fullscreen mode Exit fullscreen mode
  • Proxmox VE: your VMware replacement. KVM + LXC, web UI, clustering, built-in backup.
  • Ceph: distributed storage with no single point of failure. Lose a node, keep serving traffic, if your CRUSH map and replication factors are sane.
  • OpenStack: turns a rack of Proxmox/KVM hosts into something you provision like EC2.
  • Kubernetes: usually sits on top, scheduling containers on the VMs OpenStack provisions.

Real result: a fintech client cut cloud spend 65% moving core services to Proxmox + Ceph, keeping only CDN/edge on public cloud. Gov and defense-adjacent contractors like this stack because OpenStack's API compatibility means AWS-style automation, but on hardware sitting in an EU data center with zero CLOUD Act exposure.

What you're actually signing up for

Pros:

  • No per-core licensing tax (Proxmox support subscription, Ceph/OpenStack are Apache-licensed)
  • Full control over physical location, network path, access
  • Cost flattens hard past ~15-20 sustained VMs
  • No rate limits, no vendor deprecation surprises

Cons:

  • Ceph will punish you if you don't understand placement groups, replication, failure domains. A bad CRUSH map turns one dead disk into cluster-wide latency.
  • OpenStack ships every 6 months. Skip releases and upgrades get harder, not easier.
  • Engineers who can debug a flapping Ceph OSD or trace a Neutron issue through OVS are rare and expensive.
  • Getting to production-ready is a multi-month project, not a weekend.

The managed cloud alternative

This means AWS/Azure/GCP, EU alternatives like Scaleway/OVHcloud, or a managed infrastructure partner running the stack (sovereign or otherwise) on your behalf.

Pros:

  • Compute/storage/managed DBs available in minutes
  • Managed Kubernetes, managed DBs, managed LBs remove whole failure categories from your plate
  • Autoscaling handles traffic spikes without manual capacity planning
  • Multi-continent presence without building your own PoPs

Cons:

  • Egress fees, IOPS charges, managed service premiums scale linearly or worse. We covered the real numbers in cheap hosting vs managed cloud infrastructure.
  • "EU region" doesn't mean sovereignty. A US-HQ'd provider's EU region still carries CLOUD Act exposure. More on that in our EU region toggle piece.
  • Vendor controls the roadmap: pricing, deprecations, API changes happen on their schedule.
  • You're boxed into whatever abstractions the provider gives you.

Quick decision framework 

if dedicated_infra_engineers < 3:
    stay_on_managed_cloud() or hire_a_partner_to_run_sovereign_stack()

elif vm_count < 15:
    managed_cloud_or_simple_vps()  # capex won't pay back fast enough

else:
    run_the_numbers_on_sovereign_stack()  # now it's worth modeling
Enter fullscreen mode Exit fullscreen mode

The honest takeaway: fewer than 3 dedicated infra engineers or under ~15 VMs means self-hosting Ceph/OpenStack is a risk you're probably underpricing. Above that threshold, the math starts favoring ownership, especially if data sovereignty is a hard requirement, not a nice-to-have.

Full breakdown with the complete comparison table and framework: read the original article.

Originally published on binadit.com

Top comments (0)