Autoscaling

You don’t size the fleet; bytetourist does. Nodes are provisioned, replaced, and retired automatically to keep each provider at its floor and to swap out failing nodes, all without touching the request path. The fleet does not scale with request volume.

Multi-cloud provisioning

Nodes can be provisioned on AWS, Fly, Modal, E2B and exe.dev, so the fleet isn’t tied to a single vendor. Each enabled provider has a floor (the fewest nodes it keeps, typically one) and a ceiling, and new providers can be added without changing how you send requests. Every provider supplies datacenter nodes; residential nodes are run separately (see IP type).

Self-healing

A freshly provisioned node boots, dials the core, and is registered into the fleet on a short-lived (30-second) lease that the core renews while the node stays connected. If a node crashes or its connection drops, the lease is revoked or runs out and the node stops receiving traffic. If it hasn’t reconnected within about two and a half minutes it is torn down, and a replacement is provisioned if that leaves its provider below its floor. A node that never comes up within the boot timeout (five minutes) is torn down the same way, and its provider is backed off before the next attempt.

What triggers a change

The fleet is evaluated every 30 seconds, with cooldowns and per-pass limits to keep churn down:

Trigger	Action
An enabled provider has fewer nodes than its floor	Scale up: provision a node on that provider, up to its ceiling
A node’s requests fail (connection failures, cut-off responses, or sites refusing its IP with 403/429/451) on at least 50% of 20+ requests in a minute or 30% of 100+ over five minutes; or, while lightly loaded, its p99 latency reaches 25 s on three or more sites	Recycle: request a replacement on the same provider and region, and remove the old node
A node that has served traffic sits idle for 30 minutes	Scale down: remove it, unless that would take its provider below its floor

A recycle requests the replacement and removes the old node in the same pass: the old node is torn down without waiting for its replacement to connect, so its provider runs one node short while the replacement boots.

Nothing scales on request volume or queue depth, and a site blocking an IP doesn’t add nodes; blocks count toward the recycle rule above. bytetourist’s operators can also change a provider’s floor and ceiling, or add and remove nodes, by hand.

Reconciliation

A separate provisioning loop (every minute, and whenever the fleet changes) carries these decisions out and cleans up stragglers: nodes that were provisioned but never joined, and nodes that disappeared without a clean exit. Every three hours it also compares each provider’s list of machines with the fleet and deletes any machine that has no fleet record and isn’t connected (once it has seen it on two checks in a row), keeping the real fleet and the provider state in sync.

Health feeds routing

Routing doesn’t wait for a recycle. The circuit breaker and per-site IP health (which edge IPs each site is refusing) are updated from every response the core relays, and lowest_latency routing uses latency measured on each response plus a per-node median the core fetches from the scaler every 5 seconds. The recycle rules above use their own, separate fault measure.