Guide

GCP and SkyPilot from a swarm

Agents can run gcloud and SkyPilot in your Google Cloud project: start GPU clusters, run jobs on them and bring results back into the patch. The project and its bill are yours. Steps 1–4 take about five minutes, once.

1. Make a project for the demo

On your own machine, signed in to gcloud as an owner. A project of its own keeps the swarm away from everything else you run. Then set a budget alert on it.

PROJECT=acyclic-demo-$RANDOM
gcloud projects create $PROJECT
gcloud billing projects link $PROJECT --billing-account=<BILLING_ACCOUNT_ID>
gcloud services enable compute.googleapis.com iam.googleapis.com \
  cloudresourcemanager.googleapis.com iap.googleapis.com --project $PROJECT

2. Let IAP reach the VMs

Agents reach SkyPilot's VMs over SSH through Google's Identity-Aware Proxy, so port 22 must be open to Google's IAP range.

gcloud compute firewall-rules create allow-iap-ssh --project $PROJECT \
  --network default --direction INGRESS --allow tcp:22 --source-ranges 35.235.240.0/20

3. Create the service accounts

is the account SkyPilot's VMs run as. Creating it now means the swarm's own account, , never needs to change the project's permissions.

SA=acyclic-swarm@$PROJECT.iam.gserviceaccount.com
VM=skypilot-v1@$PROJECT.iam.gserviceaccount.com
gcloud iam service-accounts create skypilot-v1 --project $PROJECT
gcloud iam service-accounts create acyclic-swarm --project $PROJECT
for role in storage.admin compute.admin iam.serviceAccountUser iam.roleViewer; do
  gcloud projects add-iam-policy-binding $PROJECT --member serviceAccount:$VM \
    --role roles/$role --condition None --quiet > /dev/null
done
for role in editor iap.tunnelResourceAccessor; do
  gcloud projects add-iam-policy-binding $PROJECT --member serviceAccount:$SA \
    --role roles/$role --condition None --quiet > /dev/null
done

4. Make a key

Run it in the folder you will start the swarm from, then check that the key is in the upload list. If your organization blocks key creation, an admin can lift for this project.
```
gcloud iam service-accounts keys create gcp-sa.key --iam-account $SA
acyclic swarm run --dir . --include gcp-sa.key --dry-run
```

5. Start the swarm

Put these three lines at the top of the task. Every agent runs the setup in its own box: about a minute the first time, seconds after that. deletes a cluster after 15 idle minutes, even if the agent that launched it has stopped.

acyclic swarm run --dir . --include gcp-sa.key --watch --task "Before any gcloud or sky command, run: acyclic-gcp-setup --key gcp-sa.key
Launch clusters with: sky launch -y -i 15 --down ...
Before you finish, run: sky down -a -y

Then: <your demo, e.g. fine-tune the model on one L4 and report the eval loss>"

6. Clean up

Check that nothing is still running, then delete the key, or the whole project once the demo is over.

gcloud compute instances list --project $PROJECT
gcloud iam service-accounts keys list --iam-account $SA
gcloud projects delete $PROJECT

Notes

Every agent in the swarm can read the key and do anything it allows. Use it only for this project, and delete it after the demo.
New projects have no GPU quota. Request it under IAM & Admin → Quotas, and start with a CPU cluster () to check everything works.
Agents reach Google's APIs over HTTPS and VMs only through SkyPilot (, , ). They cannot open a VM's IP directly, so use SSH, not a VM's public web port.
The tools are , , and (SkyPilot 0.14.1, Google Cloud CLI 589.0.0), installed per box under the agent's home.