🤖 AI-first ☸️ Kubernetes & microVMs 📍 Praha, Brno, Ostrava (hybrid)

PLATFORM ENGINEER

MicroVMs, Kubernetes and distributed storage for AI agents

AI agents get interesting when they have a real computer to work on. They need a shell, a filesystem, packages, long-running processes and data that survives a restart. They also need a hard boundary, because the code they run is written by a model, and our users are lawyers, accountants and public institutions handling sensitive documents.

We built that computer ourselves. Our platform gives each agent its own Firecracker microVM with a fast API and durable shared storage.

I'm interested

MORE ABOUT THE ROLE

PROJECTS

It's already running in production, and it's the platform for the agents behind three products.

CODEXIS AI

A legal AI assistant built on Czech legislation, case law and commentaries.

👥 40,000 active users

🔑 8,000 licences

💰 CZK 200M revenue

DATIFY

A digital office with AI agents, data registers and document extraction.

🚀 Launched in September 2024

📝 190k stored records

ONEPOST

Central management of Czech data boxes and their messages, with AI features.

📈 33,000 managed data boxes

📩 5.6M processed messages

💰 CZK 50M+ revenue

What you'll work on

Control plane

Java 25, Spring Boot, PostgreSQL, Redis

A Kubernetes operator and API for the VM lifecycle. It has durable commands, per-VM locks, informer-driven reconciliation and run identity checks that reject stale work. Its replicated failure scenarios are tested against real VMs.

VM runtime

Go

cdx-vm-runner is PID 1 in every VM Pod. It handles the jailer, Firecracker, TAP networking, overlay disks and readiness. Our own kernel, initramfs and rootfs ship as OCI images, and we tune boot down to details like individual systemd generators and RCU settings.

Guest data plane

Rust

cdx-remote-exec runs inside each VM and exposes streaming exec, file APIs, directory change streams and stdio bridges. It also provides isolated environments inside the VM, using namespaces, seccomp, per-environment network policy and cgroups, so an out-of-memory command is killed alone.

Distributed storage

C, NFSv4

We run our own forks of NFS-Ganesha, libnfs and fuse-nfs:

  • Mutual TLS, terminated at HAProxy
  • Per-user authorization of every operation, with revocation in about a second
  • MAC-protected file handles
  • JuiceFS underneath
  • Failover that clients ride through without remounting, resending any writes the server lost before COMMIT

Where a fix belongs upstream, we send it upstream, and some of our fuse-nfs patches have already been merged.

Infrastructure and tooling

Talos Linux clusters managed with Omni, Envoy Gateway with per-VM routes, Vault, Harbor, and Jenkins and GitLab pipelines. We also build vmsctl (Rust) and a Java SDK, so product teams can use the platform without knowing how it works. There's even a small Bash fork, because agents needed the shell to report its final working directory.

kubernetes go rust c java spring postgresql redis linux envoy vault jenkins gitlab

Your first months

  • Roll out NFS volumes at production scale, including failure testing and observability
  • Improve how we operate the fleet: multi-replica behaviour, drain and upgrade procedures, capacity and placement
  • Make VMs start faster and pack more densely on each node
  • Stress the isolation model and close whatever gaps you find
  • Work with the three product teams and turn what they need into platform features

TOMÁŠ – CTO

It's not enough to build technology. You also need to know how to deploy it so that it truly helps the company.

We have to be ready to react quickly to changing requirements and new technologies, because AI moves fast. Adaptability and good collaboration are key to connecting technical skills with business needs, so that we deliver results that really matter to the company.

What we're looking for

No one knows this whole stack on arrival, and we don't expect you to.

We're looking for:

  • Solid Linux internals: processes, namespaces, cgroups, networking, filesystems
  • Strong production experience in at least one of Go, Rust, Java or C, and willingness to work in the others
  • Real experience running Kubernetes, ideally including how its controllers work
  • Clear thinking about distributed failure: retries, stale writes, crashes between two steps, what “committed” actually means
  • The habit of reading upstream source when the docs run out
  • Good written communication in English; Czech is a plus, not a requirement

Bonus points

KVM or Firecracker · the NFS protocol · FUSE · kernel builds · Talos · sandboxing and security hardening · open source contributions

Why it's worth your time

Behind us stands a successful group – CODEXIS, ONEPOST, DATIFY = ATLAS GROUP.

It has been around since 1992 and describes itself as a traditional company with the soul of a start-up.

  • Top-notch tech setup. A dockerized environment (K8S) and support for your professional growth.
  • Team spirit and the AGRP.DEV culture. Find out more in our GROW section or on our Instagram.
  • Real influence on WHAT gets built. Your ideas reach tens of thousands of users.
  • Work-life balance. Up to 6 weeks off, events with colleagues, foosball, a bistro and home office.
  • AI-native development. Coding agents are part of our daily workflow, so you'll build infrastructure for agents using agents.

Apply

Sounds like something for you? Send us your contact and let’s talk. 🔥

LOOKING FORWARD TO HEARING FROM YOU 💚 TEAM AGRP[DEV]