underrunner
Underrunner works out who owns each resource, proves what's unused, asks the people who'd know, and removes only what they confirm.
The demo is a private copy of a made-up company. No sign-up.
Biggest likely savings first, in the demo company
Waste survives because nobody owns the question. Underrunner finds who does, and asks them, with proof, one email at a time.
Where the money sits, what to do first, and what's already gone. These are the real charts, showing the made-up demo company. Point at anything.
Every resource moves through the same stages. Software does the digging. People make the three decisions that matter.
Reads inventory, usage and spend, then ranks everything by savings times how likely it's unneeded.
Asks the owner what it is and whether it's still needed. Wrong person? They say who, and it learns.
A person answersThe head of that org sees what's confirmed, by whom, and what it saves, and approves it.
A head of org approvesEveryone gets notice and a way to stop it. It can be switched off first, so anyone relying on it notices.
Anyone can stop itRe-checks scope, tags and usage on the day, keeps a backup where it can, and confirms it's really gone.
Scans again on your schedule, reports what's new, checks the bill went down, and flags anything that came back from infrastructure code.
The fastest way to get a tool like this muted is to email everyone about everything. So it doesn't.
Why you: Tag owner=oskar.berg@halden.example.
Answer in 30 secondsOne email per person, weekly by default, however many things they own. One click to answer, with no login.
A hundred forgotten snapshots look unused, about $640/mo. They're one question, not a hundred.
A direct message with a button, if you prefer. Anyone not in Slack gets the email.
- resource "aws_db_instance" "ml_feature_store_v1" {
- instance_class = "db.r6g.2xlarge"
# Removal approved by Noor Haddad
What Terraform owns is removed with a diff for a person to merge, since deleting it by hand only lasts until the next apply.
Engineers don't delete things on a hunch, and they shouldn't have to take a tool's word for it. Each item shows the measurements, where they came from, and the command to check them.
-20 Looks like production
+10 A page calls it retired: Feature store v2 migration
+8 Only referenced from archived repositories
Machine Learning, with 97% certainty
Tag omd:team=machine-learning · CODEOWNERS on terraform/rds.tf · Created by clara.jensen, who has left, so it goes to their manageraws cloudwatch get-metric-statistics --namespace AWS/RDS \ --metric-name DatabaseConnections \ --dimensions Name=DBInstanceIdentifier,Value=ml-feature-store-v1 \ --statistics Maximum --period 86400 ...
Define a scope: a team, an org, or the whole tech organization. Underrunner works out which resources belong to it from tags (including OMD tags), code owners, creators, your docs and your org chart. Then it stays inside that line.
Clearly owned by a team you chose. Can be asked about and, once confirmed, removed.
ml-feature-store-v1routing-sim-gpu-1TRANSFORM_XL_WHNobody's clearly responsible. It's never emailed about or removed until someone is.
old-jenkins-2Another org's. It can look just as idle, and it's left completely alone.
halden-siem-archivesec-forensics-workerA tool that can delete production is a serious thing to connect. These are the defaults, not settings you have to find.
Connect AWS, Databricks, Snowflake, Google Cloud or Azure with an identity that trusts only your workspace. There's no key to store or leak, and it can't change anything.
Approved removals are rehearsed until you choose otherwise. Or stay on runbook: people run the commands, and we verify.
Live removal needs a second credential you add on purpose, and can remove again at any time.
Still in scope, still unused since approval, not newly tagged, no new DNS name pointing at it, still confirmed. If not, the removal stops and whoever said yes hears why.
Automatic removal in production is off unless you turn it on. Backups and final snapshots are taken wherever the platform allows.
A removal that people carry out can open a Jira ticket with the steps and the proof, and close it once a scan confirms it's gone.
Daily caps on removals, and every answer, approval and removal in a tamper-evident log. Credentials are encrypted at rest.
Starting with where the big bills are, and what actually tells you who owns things.
Available now Planned
The demo runs the real product on a made-up freight company, with its clouds, docs, code, org chart and inboxes. Answer an email. Approve a removal. Break something.