The Private Serverless Pattern: Cutting Cloud Costs and Complying with Schrems II

Let’s address the elephant in the server room: "Serverless" is a misnomer that usually translates to "Someone Else's Computer, with an unpredictable bill attached." While the developer experience of pushing code without managing OS updates is seductive, the reality for European CTOs in late 2021 is far more complex.

Between the fallout of the Schrems II ruling invalidating the Privacy Shield and the aggressive enforcement we are seeing from Datatilsynet here in Norway, relying entirely on US-based hyperscalers for event-driven architecture is becoming a legal liability. Furthermore, the cost per millisecond of compute on platforms like AWS Lambda or Azure Functions is significantly higher than raw metal performance, especially when you factor in cold starts and API Gateway fees.

But the architectural pattern of Serverless—event-driven, ephemeral containers that scale to zero—is sound. The solution isn't to abandon the pattern, but to repatriate the infrastructure. We call this the Private Serverless architecture.

The Architecture: FaaS on Bare Metal KVM

In this guide, we will implement a Function-as-a-Service (FaaS) platform using OpenFaaS running on a lightweight Kubernetes distribution (K3s). This gives you the "git push" developer experience without the data sovereignty headaches.

Why run this on a VPS? Because functions are I/O sensitive. A "cold start" (spinning up a container to handle a request) is almost entirely bound by disk read speeds and CPU interrupt handling. Shared hosting environments with noisy neighbors will kill your latency. We use CoolVDS NVMe instances for this reference architecture because the high random Read/Write IOPS are mandatory for sub-second container spawns.

Step 1: The Foundation (OS & K3s)

We assume you are running a fresh instance of Ubuntu 20.04 LTS. First, we need to prepare the system for high-throughput container networking. The default Linux networking stack is often tuned for long-lived connections, not the bursty traffic of serverless functions.

Update your sysctl configs to allow for rapid socket recycling:

# /etc/sysctl.d/99-k8s-networking.conf
net.bridge.bridge-nf-call-iptables  = 1
net.ipv4.ip_forward                 = 1
net.ipv4.tcp_tw_reuse               = 1
net.ipv4.tcp_keepalive_time         = 60
net.ipv4.tcp_keepalive_intvl        = 10
net.ipv4.tcp_keepalive_probes       = 6

Apply these with sysctl --system. Next, we install K3s. We choose K3s over full K8s because it strips out legacy cloud provider binaries, saving RAM for your actual functions. In a VPS environment with 4GB or 8GB RAM, every megabyte counts.

curl -sfL https://get.k3s.io | sh -

# Verify the node is ready (takes about 30 seconds)
sudo k3s kubectl get node

Step 2: Deploying the FaaS Layer

OpenFaaS (Functions as a Service) acts as the gateway and watchdog. It routes traffic and scales deployments based on Prometheus metrics. We will use `arkade`, a CLI tool that simplifies installing apps to Kubernetes.

# Install arkade
curl -sLS https://get.arkade.dev | sudo sh

# Install OpenFaaS into the K3s cluster
arkade install openfaas

Pro Tip: By default, OpenFaaS might expose its gateway publicly. In a production environment in Norway, you should strictly firewall port 8080 and only expose it via an Ingress Controller with Let's Encrypt TLS. For internal microservices, keep it on the private network interface.

Step 3: The Cold Start Problem & NVMe

Here is where hardware matters. When a function scales from 0 to 1 replica, the system must: 1. Schedule the pod. 2. Pull the Docker image (if not cached). 3. Extract layers to the filesystem. 4. Start the runtime (Node, Python, Go).

On a standard HDD or SATA SSD VPS, step 3 is a bottleneck. We ran benchmarks comparing standard SSDs vs. the NVMe storage used in CoolVDS. The results for a standard Python 3.9 function cold start were telling:

For a user waiting for a checkout page to load, that second matters.

Step 4: Creating a GDPR-Compliant Function

Let's deploy a simple function that processes user data. Because this runs on your server in Oslo, the data never leaves the jurisdiction. We'll use the faas-cli.

# Install CLI
curl -sL https://cli.openfaas.com | sudo sh

# Login to your gateway
export PASSWORD=$(sudo k3s kubectl get secret -n openfaas basic-auth -o jsonpath="{.data.basic-auth-password}" | base64 --decode)
echo -n $PASSWORD | faas-cli login --username admin --password-stdin

# Create a new function
faas-cli new --lang node14 user-processor --prefix my-registry

Edit the user-processor/handler.js file. Notice how we handle the data locally:

'use strict'

module.exports = async (event, context) => {
  const payload = event.body;
  
  // LOGIC: Sanitize PII before any external logging
  // This ensures logs comply with privacy standards
  const safeLog = {
      id: payload.userId,
      timestamp: new Date().toISOString(),
      action: "processed_locally"
  };

  return context
    .status(200)
    .headers({ "Content-Type": "application/json" })
    .succeed(safeLog);
}

Deploy it with faas-cli up. Your function is now live, scalable, and running entirely on your own terms.

Scaling and Reliability

The beauty of this pattern is cost predictability. A CoolVDS instance with 4 vCPUs costs a flat monthly rate. You can pound it with millions of requests, and your bill won't change. If the load exceeds the single node, K3s allows you to easily join a second CoolVDS node to the cluster:

curl -sfL https://get.k3s.io | K3S_URL=https://:6443 K3S_TOKEN= sh -

This provides horizontal scalability previously reserved for the cloud giants, but retains the low latency to NIX (Norwegian Internet Exchange) that ensures your local users get snappy responses.

Conclusion

Serverless is powerful, but "Cloud" isn't the only place to run it. By leveraging OpenFaaS on high-performance infrastructure, you satisfy the Legal department's data residency requirements and the Finance department's need for fixed costs. You simply need a VPS provider that doesn't throttle your I/O when your functions need it most.

Ready to build your private cloud? Deploy a high-performance NVMe KVM instance on CoolVDS today and regain control of your infrastructure.