Overview

Exoscale Compute Instances are high-performance, KVM-based virtual machines designed for workloads ranging from small applications to complex distributed systems. You can provision and manage them through the Exoscale Portal, CLI, API, or infrastructure-as-code tools such as Terraform and Ansible.

Architecture

Each Compute instance runs on an Exoscale-managed KVM hypervisor in a single Exoscale zone. A template supplies the initial operating system, while the selected instance type determines the available CPU, memory, and local storage.

Each instance boots from a root volume backed by local SSD storage. You can attach Block Storage volumes when you need independently managed persistent storage. Network interfaces connect instances to public or private networks, while Security Groups control allowed traffic. SSH keys, IAM permissions, and instance metadata control administrative and automated access.

Instance Pools manage groups of instances for scaling and availability. Anti-Affinity Groups place selected instances on different physical hypervisors to reduce the impact of a host failure.

Terminology

Understanding the basic terms used in Exoscale Compute will help you get up and running quickly.

Instance

A Compute Instance is a virtual machine (VM) running in the Exoscale cloud. It behaves like a traditional server but is virtualized and runs on shared physical infrastructure. Instances are fully self-contained environments and can run various operating systems (Linux, Windows, custom ISOs).

Instance Type

The Instance Type defines the resource configuration of your VM — such as number of vCPUs, amount of RAM, and local SSD storage. Exoscale offers different instance families optimized for CPU, memory, storage, or GPU workloads.

Instance Family	Use Case	RAM Range	CPU Cores	Local Storage	Availability
Standard	General-purpose workloads	512MB - 225GB	1 - 24	10GB - 1.6TB	All zones
CPU Optimized	Compute-intensive applications	16GB - 128GB	8 - 40	10GB - 1.6TB	All zones
Memory Optimized	RAM-intensive applications	16GB - 128GB	2 - 12	10GB - 1.6TB	All zones
Storage Optimized	Data-heavy workloads	16GB - 225GB	4 - 24	1TB - 15TB	All zones
GPU Servers	AI/ML, HPC, simulations, and rendering	56GB - 2.5TiB	12 - 248	100GB - 10TiB	Selected zones

Template

A Template is a pre-configured disk image used to launch instances. Templates define the base OS and system configuration. You can use public templates provided by Exoscale or upload your own.

Zone

A location in which an instance and its zone-scoped resources are created. An instance cannot be moved to another zone after creation.

Root Volume

The instance’s boot volume, created from the selected template and backed by the local SSD storage included with the instance type. Its capacity depends on the selected instance type.

Local Storage

SSD storage provided by the hypervisor. Its capacity and performance characteristics depend on the selected instance family.

Block Storage

Persistent storage that can be attached to an instance and managed independently from the instance lifecycle.

Snapshot

A point-in-time copy used to preserve a volume or instance state and create new storage or templates.

Instance Pool

A managed group of Compute instances used to maintain capacity and support automated scaling and replacement.

Anti-Affinity Group

A placement rule that distributes member instances across different physical hypervisors.

Security Group

A set of stateful ingress and egress rules controlling traffic to and from an instance.

Features

Provisioning and Automation

Rapid Deployment

Launch virtual machines within seconds through the Exoscale Portal, CLI, or API.

Custom Templates and Snapshots

Create and deploy instances from custom templates, and take snapshots for backup, cloning, and recovery workflows.

Built-In IAM

Use granular Identity and Access Management policies to control API permissions.

Compute and Scaling

Flexible Instance Types

Choose from instance families designed for general-purpose, CPU-intensive, memory-intensive, storage-intensive, or GPU workloads.

Instance Pools

Automatically manage groups of instances for availability and scalability.

Storage

Local SSD Storage

Use enterprise-grade local SSD RAID10 storage for high I/O performance and low latency.

Block Storage

Attach persistent volumes that can be managed independently of the instance.

Availability

Anti-Affinity Groups

Distribute instances across different physical hypervisors to improve fault tolerance.

Instance Pools

Maintain the requested number of instances and replace unavailable members.

Security

vTPM and Secure Boot

Use vTPM for TPM 2.0 workloads, including Windows BitLocker, and Secure Boot to load only signed operating-system components.

Security Groups

Control inbound and outbound network traffic with stateful firewall rules.

Encryption at Rest

Exoscale encrypts Compute root volumes and Block Storage volumes transparently at the hypervisor layer. You do not need to install agents in the guest operating system or change your workflow. Encryption is enabled by default and cannot be disabled.

The encryption capability will integrate with Exoscale Key Management Service (KMS) for managed key lifecycle functionality.

How it works

Exoscale uses AES-256 in XTS mode to encrypt volume data.

Instance local storage is encrypted with unique key material for each volume. The encryption key is destroyed when the volume is deleted.

Block Storage volumes receive unique encryption keys when they are created. Snapshots inherit the key of their source volume, and volumes promoted from snapshots inherit the key of the source snapshot.

Encryption and decryption are transparent to the instance operating system, filesystem, applications, and tooling. They see a normal block device.

A volume encryption key is present in plaintext only in the memory of the hypervisor actively running the attached workload. The key is removed from that hypervisor when the instance stops or migrates away.

What is covered

Compute root volumes

Every new Compute instance is provisioned with an encrypted root volume.

Block Storage volumes

Every new Block Storage volume is encrypted by default.

Block Storage snapshots

Snapshots inherit the encryption key of their parent volume and remain encrypted throughout their lifecycle. A volume promoted from a snapshot uses the same key as the source snapshot and its parent volume.

Instance snapshots and templates on Object Storage

Instance snapshots and templates are stored on Object Storage with bucket-level encryption, so their data remains encrypted on the underlying storage media.

Key management today

Exoscale manages encryption keys on your behalf. Each volume key is generated randomly when the volume is created and stored securely in encrypted form. Key material is never exposed to customers, and Exoscale manages its lifecycle.

For information about customer-managed key lifecycle operations, see the KMS documentation.

Rollout

• New workloads are always encrypted. Every new Compute instance boots from an encrypted root volume, and every new Block Storage volume is encrypted when created.
• Existing instances remain unencrypted for now. Exoscale will communicate a supported migration path before this changes.