Watching the cloud provider dashboards light up like a Christmas tree. Again. Our internal monitoring is quiet where it counts—our critical agent fleet. They're sitting in our own DCs, humming along while the cloud's "global infrastructure" has another regional spasm.

This isn't about being a Luddite. It's about simple risk distribution. When you use a vendor-hosted agent runtime (think SaaS monitoring, CI/CD runners, data pipeline workers), you're buying into their SPOF. Their security event becomes your security event. Their downtime means your agents stop processing. Your data stops moving. Your feedback loops die.

The tradeoff is obvious: operational burden.

* **Self-hosted:** You own the patching, scaling, and networking. You need a real platform team. Your config might look like a hardened Kubernetes `DaemonSet`:

```yaml
# This runs on your metal, in your rack.
apiVersion: apps/v1
kind: DaemonSet
spec:
template:
spec:
containers:
- name: critical-agent
image: your-registry/agent:hardened
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
```

* **Vendor-hosted:** You get a dashboard and an API. Scaling is "magic." Patching is someone else's problem—until it *is* your problem because their update broke your workflow and you have zero visibility into the rollout.

So the real question for the thread: **What's your actual risk model?** Is your bigger fear the operational toil of running your own control plane, or the existential dread of being blind-sided by a vendor incident you can't debug, can't fix, and have no timeline for?

For us, data residency and the ability to keep core automation running during an external cloud outage tipped the scales. The burden is real, but it's a known, manageable burden. Your agent logs aren't taking a scenic route through someone else's tenancy. When something breaks, we own the entire stack. That means we can *fix* it.

Curious where others are drawing the line. Especially with the rise of agent-based AI ops tools—are you letting those call home to a vendor, or are you building the scaffolding to run them internally?