Container Engineer

ABOUT SUPABASE Supabase is the Postgres development platform, built by developers for developers. We provide a complete backend solution including Database, Auth, Storage, Edge Functions, Realtime, and Vector Search. All services are deeply integrated and designed for growth. More than 9 million developers and 250,000+ customers now build on Supabase, and the majority of new databases on the platform are created by AI app builders — so the systems underneath have to stay reliable while they grow fast. ABOUT THE ROLE Container Engineering (ConEng) owns the internal container platform that runs Supabase's multi-tenant, multi-region services — the managed Kubernetes platform that other engineering teams build and deploy on top of. We own cluster lifecycle and cluster classes, multi-cluster and multi-region topology, capacity, scheduling, isolation and runtime safety, the higher-level platform APIs, the Kubernetes deployment contract and Argo semantics, rollout primitives, and runtime configuration and secret injection. Your job is to make the platform itself trustworthy, observable, and cheap to operate at scale — and to raise the reliability bar for everyone who depends on it. This is not a gatekeeper role. You'll make the reliable path the easy path: building the automation and platform APIs that let product teams run safely by default, instrumenting what we operate, and making sure that when something breaks we detect it and recover fast. The work spans three strength areas: Tooling & ecosystem — deep knowledge of the container and orchestration landscape (Kubernetes, containerd/OCI, the CNCF ecosystem) and a clear point of view on how to compose it. Software engineering — designing and building the platform's automation, controllers, and internal tooling as production code, including solutions that don't come pre-shaped by an existing tool. Operational / SRE practice — the discipline (SLOs, error budgets, incident response, ORRs) that runs the platform at scale as a predictable one. We expect you to be genuinely deep in at least one of these, and many of our strongest candidates are deep in two (usually leaning toward one). Bringing real strength across all three is rare and exceptional — and even then, no one is equally strong in all three at once, so you'd focus where you're most needed at any given time. Different profiles are welcome here; tell us which of these is your center of gravity. WHAT YOU'LL BE RESPONSIBLE FOR Regardless of the skill set, all team members carry a share of the team's on-call rota, responding to platform incidents and driving them to resolution and follow-up. Platform reliability & operations - Define SLIs/SLOs and error budgets for the container platform itself, and build error-budget policies that actually gate platform changes. - Own the Operational Readiness Review (ORR) process for new platform capabilities and major changes. - Design and track metrics for platform uptime, and increase observability into the platform by capturing the right metrics, logs, and traces across the platform layers. - Drive the incident-to-improvement pipeline: facilitate blameless postmortems, connect findings to readiness gaps, spot repeat failure patterns, and push through systemic fixes. Software engineering - Build and maintain the platform's automation, controllers, operators, and internal tooling — writing production code and shipping it, not just wiring together existing tools. - Design and implement the platform-side CI/CD and rollout primitives that speed up platform deployments while working within proper change and release management. - Implement and maintain security automation for the platform: intrusion detection, automated remediation, and patch management. - Identify and quantify operational toil, and build the automation that removes it rather than just documenting it. - Contribute to the platform's continual testing automation — the test suites and pipelines that validate platform releases are fit for purpose before they reach tenants. Tooling, ecosystem & architecture - Act as a platform reliability and architecture expert — contribute to failure-mode analysis, dependency mapping, and resilience design for multi-tenant container workloads. - Evaluate and evolve the platform's tooling ecosystem (orchestration, runtime, networking, isolation, and observability stack) with a clear, opinionated view on trade-offs. - Improve system architecture to reduce infrastructure cost while balancing security, reliability, and performance across tenants. - Guide teams building on the platform to design sustainable on-call practices for their own services: alert quality, escalation paths, runbook coverage, and noise reduction. YOU MIGHT BE A GOOD FIT IF YOU - Have 5+ years in platform engineering, container/Kubernetes platform operations, SRE, or production infrastructure, and have operated production systems at scale and carried on-call for them. - Are genuinely deep in at least one — ideally two — of the three strength areas below (and tell us which is your center of gravity): - Tooling & ecosystem — know the container/orchestration landscape well: Kubernetes, containerd and the OCI/CRI standards, and the surrounding CNCF ecosystem (e.g. Argo CD/Argo Rollouts for GitOps and progressive delivery; Cilium/eBPF networking and the Gateway API; Karpenter/KEDA-style autoscaling; and workload-isolation runtimes such as gVisor or Kata Containers). You reason about trade-offs rather than reaching for defaults. - Software engineering — write real production code (Go and/or a comparable systems language) and can build controllers, operators, and platform APIs — stepping back to the underlying problem and building the right solution when no off-the-shelf tool fits. - Operational / SRE practice — are fluent in SLOs, error budgets, and operational KPIs; have led incident response and blameless postmortems; and have driven down MTTD/MTTR for systems you operated. - Have worked with large-scale multi-tenant systems and understand isolation as a spectrum — from namespaces, RBAC, network policies, and resource quotas through to stronger primitives such as virtual clusters (e.g. vCluster) or VM-class runtimes. - Operate confidently on AWS (multiple accounts, IAM, VPC) and are comfortable with infrastructure-as-code (Pulumi preferred; Terraform/CDK also fine) and Kubernetes. - Script and automate to eliminate toil rather than absorb it. - Communicate clearly with both infrastructure specialists and product engineers, and thrive in async, globally distributed teams. - Are comfortable navigating ambiguity and iterating toward better systems over time. Nice to Have - Experience building and operating a multi-tenant Kubernetes platform that internal teams deploy onto. - Familiarity with policy engines (Kyverno, or OPA/Gatekeeper) and cost-attribution tooling (OpenCost/Kubecost) for per-tenant chargeback/showback. - Experience with managed database platforms or Postgres. - Familiarity with OpenTelemetry, Prometheus/VictoriaMetrics, Grafana, or similar observability tooling. WHAT WE OFFER - Fully Remote We hire globally. We believe you can do your best work from anywhere. There are no Supabase offices, but we provide a WeWork membership or co-working allowance you can use anywhere in the world. - ESOP Every team member receives ESOP (equity ownership) in the company. We want everyone to share in the upside of what we’re building together. - Tech Allowance Use this budget to set up your ideal work environment—laptop, monitor, headphones, or whatever helps you do your best work. - Health Benefits Supabase covers 100% of health insurance for employees and 80% for dependents, wherever you are. Your wellbeing and your family’s health are important to us. - Annual Off-Sites Once a year, the entire company gathers in a new city for a week of connection, collaboration, and fun. It’s a highlight of our year. - Flexible Work We operate asynchronously and trust you to ma