# pulumi-esc

Published articles for pulumi-esc.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Preview ESC Changes with Environment Overrides

DevFeed: [Preview ESC Changes with Environment Overrides](<https://devfeed.tech/articles/preview-esc-changes-with-environment-overrides-19020.md>)

Original publisher: [Read original article](<https://www.pulumi.com/blog/preview-esc-environment-changes-with-draft-references/>)

Author: Sean Yeh

Published: 2026-07-23T00:00:00Z

Content type: release

Language: en

Sources: [Pulumi](<https://devfeed.tech/sources/pulumi.md>)

Topics: [Command-line interface](<https://devfeed.tech/topics/cli.md>), [configuration](<https://devfeed.tech/topics/configuration.md>), [Testing](<https://devfeed.tech/topics/testing.md>)

Tags: [cli](<https://devfeed.tech/tags/cli.md>), [configuration](<https://devfeed.tech/tags/configuration.md>), [configuration-management](<https://devfeed.tech/tags/configuration-management.md>), [critical-infrastructure](<https://devfeed.tech/tags/critical-infrastructure.md>), [esc](<https://devfeed.tech/tags/esc.md>), [features](<https://devfeed.tech/tags/features.md>), [product](<https://devfeed.tech/tags/product.md>), [production](<https://devfeed.tech/tags/production.md>), [pulumi-cli](<https://devfeed.tech/tags/pulumi-cli.md>), [pulumi-esc](<https://devfeed.tech/tags/pulumi-esc.md>), [release](<https://devfeed.tech/tags/release.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>)

### AI overview

Pulumi introduces the --override-env flag for the Pulumi CLI, allowing teams to preview draft or alternate ESC environments during operations such as preview, up, refresh, and destroy. The feature helps reviewers validate configuration changes before approval and supports overrides through imported environment chains.

### Source excerpt

Pulumi ESC makes it easy to store configuration and secrets for your Pulumi programs, and with Approvals for ESC you can review and approve changes before they go live. The new --override-env flag lets you preview any environment change, including an unapproved draft, to see exactly how it would affect your stack before it becomes the latest version. Example scenario Your team stores production app configuration in ESC and has enabled Approvals to keep bad values out of critical infrastructure. But one important question remains: how can reviewers properly validate a configuration change before approving it? Introducing: draft references and the -override-env flag We are introducing a new --override-env flag to the Pulumi CLI that works with every Pulumi operation that can consume ESC environments: preview, up, refresh, and destroy. This makes it easy to test configuration changes on the fly, giving your team the confidence to validate them as part of the review process. Example usages The basic usage is --override-env <env>=<replacement>, and you can override multiple environments at once! In this example, we are running a pulumi preview with environments app/myenv and app/myenv2 replaced by their draft versions (denoted by @draft:<draft-id>). pulumi preview \ --override-env "app/myenv=app/myenv@draft:123e4567-e89b-12d3-a456-426614174000" \ --override-env "app/myenv2=app/myenv2@draft:123e4567-e89b-12d3-a456-426614174000" The --override-env flag not only works with draft references, but for any environment too! Here is an example of deploying your stack with your AWS test environment: pulumi up --override-env "aws-login/prod=aws-login/testing" Note: --override-env can also override environments that are imported (directly or indirectly) from the ESC environment in your stack config. This allows you to override any environment in the import chain for full flexibility. Ways to use it Validate a draft ESC environment with your stack before approving One-off debugging w

## Fully Automated AI Inference on AWS, Azure, and Google Cloud with Pulumi

DevFeed: [Fully Automated AI Inference on AWS, Azure, and Google Cloud with Pulumi](<https://devfeed.tech/articles/fully-automated-ai-inference-on-aws-azure-and-google-cloud-with-pulumi-19002.md>)

Original publisher: [Read original article](<https://www.pulumi.com/blog/fully-automated-ai-inference-aws-azure-gcp-pulumi/>)

Author: Engin Diri

Published: 2026-06-30T00:00:00Z

Content type: tutorial

Language: en

Sources: [Pulumi](<https://devfeed.tech/sources/pulumi.md>)

Topics: [Ollama](<https://devfeed.tech/topics/ollama.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [Infrastructure as code](<https://devfeed.tech/topics/infrastructure-as-code.md>), [model-serving](<https://devfeed.tech/topics/model-serving.md>), [GPU](<https://devfeed.tech/topics/gpu.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [Ubuntu](<https://devfeed.tech/topics/ubuntu.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [aws](<https://devfeed.tech/tags/aws.md>), [azure](<https://devfeed.tech/tags/azure.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [gcp](<https://devfeed.tech/tags/gcp.md>), [google-cloud](<https://devfeed.tech/tags/google-cloud.md>), [gpu](<https://devfeed.tech/tags/gpu.md>), [inference](<https://devfeed.tech/tags/inference.md>), [infrastructure-as-code](<https://devfeed.tech/tags/infrastructure-as-code.md>), [model-serving](<https://devfeed.tech/tags/model-serving.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [ollama](<https://devfeed.tech/tags/ollama.md>), [pulumi-esc](<https://devfeed.tech/tags/pulumi-esc.md>), [tutorials](<https://devfeed.tech/tags/tutorials.md>), [typescript](<https://devfeed.tech/tags/typescript.md>), [ubuntu](<https://devfeed.tech/tags/ubuntu.md>)

### AI overview

This tutorial shows how to use Pulumi to provision GPU virtual machines on AWS, Azure, and Google Cloud, install drivers, run Ollama, and pull an open-source model without manual setup. It also uses Pulumi ESC with OIDC instead of a long-lived access key and avoids treating model-download completion as an infrastructure resource.

### Source excerpt

Putting Ollama on a cloud GPU is something I keep coming back to. A while ago I wrote up running open-source LLMs on an AWS EC2 box with Ollama and Pulumi, and the shape never really changes: a GPU instance, a model server, and a firewall rule in front. Infrastructure as code earned its place by making that kind of setup predictable and repeatable, and AI infrastructure is no exception. A GPU box serving a model is still a VM, a disk, and a firewall rule, and it should be declared like one. Thorsten Hans made exactly that case in his Akamai post, Fully Automated AI Infrastructures with Terraform and Akamai Cloud, which stands up a single GPU instance on Linode, installs the drivers, runs Ollama, and pulls a model, with no manual steps after terraform apply. I liked the shape of it, so this post ports the same idea to Pulumi and runs it across AWS, Azure, and Google Cloud instead of one. The result is one program shape per cloud: a single pulumi up brings up a GPU box that installs its own driver, runs Ollama, and pulls a model with no manual steps, and a single pulumi destroy takes it back down. Along the way it drops the two imperative bits the Terraform version leans on: a static access token sitting in an environment variable, and a null_resource running a shell loop to wait for the model. The first becomes an OIDC login from a Pulumi ESC environment, so no long-lived key lives anywhere. The second turns out not to be a resource at all. What you are building Strip away the per-cloud naming and every version of this is the same three things: a GPU virtual machine, a firewall in front of it, and a cloud-init script that turns a bare Ubuntu box into a running inference server. The model serving runs on Ollama, which exposes an HTTP API on port 11434 and keeps the model resident in GPU memory between requests. flowchart LR Dev([Your machine / curl]) -->|"HTTP :11434"| FW["Firewall / security group
(allow 11434, optional 22)"] FW --> VM["GPU VM (Ubuntu 24.04)

## Deploy a Private Hermes Agent on Render Securely with Pulumi, Modal, and Tailscale

DevFeed: [Deploy a Private Hermes Agent on Render Securely with Pulumi, Modal, and Tailscale](<https://devfeed.tech/articles/deploy-a-private-hermes-agent-on-render-securely-with-pulumi-modal-and-tailscale-18995.md>)

Original publisher: [Read original article](<https://www.pulumi.com/blog/deploy-a-hermes-agent-with-pulumi/>)

Author: Engin Diri

Published: 2026-06-24T00:00:00Z

Content type: tutorial

Language: en

Sources: [Pulumi](<https://devfeed.tech/sources/pulumi.md>)

Topics: [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Deployment](<https://devfeed.tech/topics/deployment.md>), [Self-hosted](<https://devfeed.tech/topics/self-hosted.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [hosting](<https://devfeed.tech/topics/hosting.md>), [cloud-infrastructure](<https://devfeed.tech/topics/cloud-infrastructure.md>), [Code](<https://devfeed.tech/topics/code.md>), [ui](<https://devfeed.tech/topics/ui.md>), [Messaging](<https://devfeed.tech/topics/messaging.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [building](<https://devfeed.tech/tags/building.md>), [code](<https://devfeed.tech/tags/code.md>), [hosting](<https://devfeed.tech/tags/hosting.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [modal](<https://devfeed.tech/tags/modal.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [pulumi](<https://devfeed.tech/tags/pulumi.md>), [pulumi-esc](<https://devfeed.tech/tags/pulumi-esc.md>), [python](<https://devfeed.tech/tags/python.md>), [render](<https://devfeed.tech/tags/render.md>), [security](<https://devfeed.tech/tags/security.md>), [self-hosting](<https://devfeed.tech/tags/self-hosting.md>), [server](<https://devfeed.tech/tags/server.md>), [services](<https://devfeed.tech/tags/services.md>), [tailscale](<https://devfeed.tech/tags/tailscale.md>), [tutorials](<https://devfeed.tech/tags/tutorials.md>), [typescript](<https://devfeed.tech/tags/typescript.md>), [ui](<https://devfeed.tech/tags/ui.md>)

### AI overview

A tutorial for deploying a private Hermes AI agent with Pulumi across Render, Modal, and Tailscale. Render hosts private services, Tailscale provides tailnet access, and Modal runs agent-generated code in temporary sandboxes.

### Source excerpt

Personal AI agents had their breakout this year. OpenClaw crossed 100,000 GitHub stars within months of launching, and self-hosting your own assistant went from a hobbyist trick to something a lot of developers actually do. I wrote up how to deploy that lobster to AWS or Hetzner back when it was everywhere. The one people are switching to now is Hermes, the open-source runtime from Nous Research, and it caught on just as quickly. The reason shows up in every "I ditched OpenClaw for Hermes" thread: it actually learns, building up memory and writing its own skills as it goes instead of running off a static, human-written list. Here is the part the launch videos skip. Hermes writes and runs its own code, with no human approving the commands. A model that can write code will eventually write a bad one, and the only thing between that command and your credentials is the sandbox it runs in. That is the box you do not want on the public internet. Researchers found 175,000 exposed Ollama servers sitting open in early 2026, and attackers hijack the ones they find for compute. The fix is not a better lock on the front door. It is to have no front door at all. So this post deploys a private Hermes agent as one Pulumi program across Render, Modal, and Tailscale. The agent and its chat UI run as Render private services with no public URL, Tailscale puts the UI on your tailnet, and Modal runs the agent's code in throwaway sandboxes. One pulumi up to stand it up, one pulumi destroy to tear it down, around $50 a month. No Makefile, no CLI escape hatches, and an honest look at the few places "nothing on the public internet" still leaks. What is Hermes? Hermes is the open-source, MIT-licensed agent runtime from Nous Research. It runs continuously on a server rather than living in a browser tab, and you talk to it through a chat UI or a messaging platform like Telegram, Discord, Slack, or Signal. A few things make it more than a chatbot: It is model-agnostic. You point it at any provi