> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloud.vessl.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Managed software stack

> Which parts of the software stack VESSL Cloud manages, which parts you are responsible for, and how security patching works.

VESSL Cloud manages a layered software stack for Container Compute Services (workspaces and batch jobs). This page describes which components VESSL Cloud is responsible for, which components you are responsible for, and how security patching works.

## Components VESSL Cloud manages

| Layer             | Component                                                                       |
| ----------------- | ------------------------------------------------------------------------------- |
| Cluster           | Kubernetes control plane and worker nodes                                       |
| Node OS           | Cloud provider's GPU-optimized image (patched by the underlying cloud provider) |
| Container runtime | containerd, provided through the node OS                                        |
| GPU stack         | NVIDIA driver, CUDA libraries, and the NVIDIA GPU Operator                      |
| Platform          | VESSL Cloud control plane, agents, and monitoring components                    |

<Info>
  These components run in the region of the cluster you select when you launch a workload.
</Info>

## VESSL Cloud-provided base images

VESSL Cloud publishes prebuilt container images you can use as a starting point for your workspaces and batch jobs.

| Image family  | Description                                       | Example tag                                           |
| ------------- | ------------------------------------------------- | ----------------------------------------------------- |
| Python (CPU)  | Slim Python base for CPU workloads                | `quay.io/vessl-ai/python:3.13-slim`                   |
| CUDA + Python | CUDA toolkit and Python, no ML framework          | `quay.io/vessl-ai/cuda:13.0.1-py3.13-slim`            |
| PyTorch       | PyTorch on CUDA, ready for training and inference | `quay.io/vessl-ai/torch:2.9.1-cuda13.0.1-py3.13-slim` |

Each family ships in multiple CUDA and Python version combinations. The image selector shows the available variants when you create a Workspace or Job.

Updates to these images are announced in the [changelog](/changelog/overview/updates).

You can also bring your own container images. Responsibility for images you supply is governed by the [Container Compute service terms](/legal/container-compute).

## Security patching

VESSL Cloud applies security patches to the components it manages; you keep the images and code you bring up to date.

| Component                                                        | Patched by                                       |
| ---------------------------------------------------------------- | ------------------------------------------------ |
| Kubernetes control plane                                         | VESSL Cloud (with the underlying cloud provider) |
| Worker node OS                                                   | Cloud provider, applied by VESSL Cloud           |
| Container runtime (containerd)                                   | VESSL Cloud                                      |
| NVIDIA driver and CUDA libraries                                 | VESSL Cloud                                      |
| VESSL Cloud platform components                                  | VESSL Cloud                                      |
| Container images you supply                                      | **You**                                          |
| Application code, libraries, and dependencies inside your images | **You**                                          |
| Packages you install inside a running container                  | **You**                                          |

<Note>
  If your workload uses a container image you supplied, keeping that image up to date is your responsibility. VESSL Cloud does not modify your images.
</Note>

Severity-based response times, advance notice for disruptive patches, and notification procedures are defined in the [Service Level Agreement (SLA)](/legal/sla).

Notable stack updates, including new VESSL Cloud-provided base images, are announced in the [changelog](/changelog/overview/updates).

## Related

* [Resource limits](/guides/platform/resource-limits) — how the platform enforces resource limits and recovers workloads
* [Container Compute service terms](/legal/container-compute) — contractual basis for the managed software stack
* [Service Level Agreement](/legal/sla) — patching response times and notification commitments