Skip to main content
InfraGap.com Logo
Home
Getting Started
Core Concept What is a CDE? How It Works Benefits CDE Assessment Getting Started Guide Inner Loop vs Outer Loop Environment Drift Local vs Cloud CDEs for Startups
AI & Automation
AI Coding Assistants Agentic AI AI-Native IDEs Agentic Engineering AI Agent Orchestration AI Governance AI-Assisted Architecture Shift-Left AI LLMOps Autonomous Development AI/ML Workloads CDEs for Data Science GPU Computing
Agent Infrastructure
Agent Experience (AX) Agent Egress Control Computer Use Agents Agent Evals Agent Runbooks Agent Client Protocol AGENTS.md MCP Servers Git Worktrees Kubernetes Agent Sandbox Agent Fleets Agent Identity Prompt Injection Defense Agent Observability Context Engineering AI Code Review Bottleneck Headless Agents in CI Spec-Driven Development Agent Readiness Code Provenance
Implementation
Architecture Patterns DevContainers Advanced DevContainers Language Quickstarts IDE Integration CI/CD Integration Platform Engineering Developer Portals Container Registry Multi-CDE Strategies Remote Dev Protocols Nix Environments Hermetic Builds OpenTofu for CDEs Kubernetes Development
Operations
Performance Optimization High Availability & DR Disaster Recovery Monitoring Capacity Planning Multi-Cluster Development Troubleshooting Runbooks Ephemeral Environments Sandbox Environments Workspace Snapshots Database Branching
Security
Security Deep Dive Zero Trust Architecture Secrets Management Vulnerability Management Network Security IAM Guide Supply Chain Security Air-Gapped Environments AI Agent Security MicroVM Isolation Compliance Guide EU AI Act Cyber Resilience Act Data Residency Governance
Planning
Pilot Program Design Stakeholder Communication Risk Management Migration Guide Cost Analysis FinOps GreenOps Vendor Evaluation Training Resources Developer Onboarding Team Structure Platform Maturity Model Open Source CDEs AI Productivity Paradox Build vs Buy DevEx Metrics Productivity Engineering Industry Guides CDEs for Healthcare CDEs for Financial Services CDEs for Government Edge Development WebAssembly in CDEs
Resources
Tools Comparison State of CDEs 2026 Isolation Decision Tool Template Library
Learning Paths
All Paths Platform Engineer Security and Compliance Engineering Manager
Vendor Reviews
GitHub Codespaces Coder Ona Google Workstations Microsoft Dev Box Okteto Eclipse Che DevPod Daytona E2B
Head to Head
Coder vs Codespaces Coder vs Ona Ona vs Codespaces Coder vs Okteto Self-Hosted vs Managed E2B vs Daytona CDE Market Guide CDE vs Alternatives Case Studies Lessons Learned Glossary FAQ Sources & Citations

Google Cloud Workstations

A managed development environment for teams already committed to Google Cloud. Three charges stack, one of them runs whether anyone is working or not, and the security integration is the reason to accept that.

What It Is

Managed developer VMs inside your own Google Cloud project, governed by the controls you already run

Cloud Workstations is Google's managed cloud development environment. You define a workstation configuration - machine type, container image, disk, timeouts - and developers get workstations provisioned from it, reachable through a browser IDE, local VS Code, or a JetBrains IDE. The workstations run on Compute Engine instances with Persistent Disks attached, inside your own project, which is the architectural detail that drives everything else about the product.

That placement is the pitch. Because workstations are ordinary Google Cloud resources, they inherit the governance you have already built: IAM for who can create and reach what, VPC Service Controls for keeping data inside a perimeter, private clusters for removing public endpoints, organization policy, Cloud Audit Logs, and CMEK for disk encryption. For a security team that has spent two years building a Google Cloud perimeter, a development environment that sits inside it rather than beside it is a materially easier approval than any external SaaS.

The counterpart is equally clear. This is a Google Cloud service, available in Google Cloud regions, administered with Google Cloud tooling, and it is not self-hostable in any form. If your organization is not already on Google Cloud, adopting Cloud Workstations means adopting Google Cloud, which is a far larger decision than choosing a development environment.

Perimeter-native

VPC Service Controls and private clusters are documented, first-class configurations rather than enterprise add-ons bolted on later.

Custom images

Workstations run container images you control, so a hardened, pre-provisioned base image is the normal path rather than an escape hatch.

Enforced lifecycle

Idle and maximum running timeouts are configuration, not developer habit. The default running timeout exists so security updates actually get applied.

Who It Suits, and Who It Does Not

A narrow but genuinely strong fit, and a clear disqualifier outside it

A good fit

  • Organizations whose production, data, and identity already live in Google Cloud, where this is an extension rather than a new vendor.
  • Regulated environments that need VPC Service Controls, private endpoints, CMEK, and audit logging on developer workloads.
  • Teams working close to Google Cloud data services, where keeping the development environment adjacent to the data avoids egress and latency.
  • Larger teams. The fixed control plane charge amortizes across many developers and is punishing across few.
  • Anyone with existing committed-use discounts, which apply to the underlying Compute Engine consumption.

A poor fit

  • Anyone not on Google Cloud. The integration advantages are the entire value, and without them there are simpler products.
  • Small teams and pilots. A per-cluster hourly charge that runs continuously is a poor shape for five developers.
  • Multi-cloud or cloud-agnostic strategies that specifically want the development platform to be the portable layer.
  • Anyone needing self-hosting, on-premises deployment, or an air-gapped install. None exist.
  • Teams wanting to trial a CDE for free before committing. There is no free tier on the pricing page.

The blunt version

This product is not competing for general CDE buyers and does not appear to be trying to. It is competing for the subset of Google Cloud customers who want developer machines governed by the same controls as everything else they run, and for that subset it is a strong answer that few competitors can match. If you are shopping across clouds on features and price, Cloud Workstations will look expensive and constrained, because the thing it is charging you for is integration you are not planning to use.

Deployment Model

Google runs the control plane; the workstations are resources in your project

The hierarchy is worth learning before reading the price list, because the billing follows it exactly. A workstation cluster is the control plane, associated with a region and a VPC network. Inside it, workstation configurations define machine type, container image, disk, and timeout policy. From a configuration you create workstations, which are the per-developer instances that start and stop.

ConcernYou operateGoogle operates
Control planeYou create and pay for the cluster; you do not run software for itProvisioning, scheduling, availability, upgrades
ImagesBuilding, hardening, scanning, and updating your container imagesBase images and the runtime that executes yours
Network and accessVPC design, VPC Service Controls perimeter, private cluster choice, IAM bindingsEnforcement, and the connectivity path to the IDE
Lifecycle policyIdle timeout, running timeout, machine sizing, quotaEnforcement of the timeouts you set
Cost managementAll of it. Cluster count, machine sizes, disk sizes, and whether workstations get stopped.Metering

Note that "managed" here does not mean "someone else worries about the bill". Google removes the burden of running the platform, and leaves you every decision that determines what it costs. The cluster count in particular is a design choice with a standing monthly consequence, covered in the next section.

License and Open Source Reality

Short section: it is proprietary, and there is no version you can run

Closed, and only available from Google

Cloud Workstations is a proprietary Google Cloud service. There is no source code, no community edition, no on-premises distribution, and no bring-your-own-cloud arrangement. If Google withdrew the service, nothing about your setup would continue to function.

The portable part is your image

What you own is the container image definition and whatever provisioning you wrapped around it. That is real portability: the same image can back a self-hosted platform or a different managed one. The IAM bindings, perimeter configuration, and Google-specific tooling are not portable, and on a security-driven adoption they are most of the work.

Keep environment definitions in a portable format such as a dev container or a standard Dockerfile rather than something bespoke to this service, and infrastructure in declarative configuration. That is a cheap hedge and the only meaningful one available here. If open source or self-hosting is a hard requirement, open source CDEs is the right page and this one is not.

Pricing

Fully published and itemized, which is a genuine advantage. Three charges stack, and one never stops.

ChargeRate, as of July 2026When it accrues
Control plane fee$0.20 per cluster, per hourContinuously, regardless of whether any workstation in the cluster is in use
Workstation management fee$0.05 per vCPU, per hourFrom when a workstation starts until it is stopped
Compute EngineStandard VM rates for the machine type, plus GPU rates where applicableWhile the workstation is running
Persistent DiskStandard Persistent Disk rates for the provisioned sizeWhile the disk exists, including while the workstation is stopped

All rates above are from Google's own pricing page as of July 2026: cloud.google.com/workstations/pricing. Note that the figures on that page render client-side, so a simple page fetch will not show them. No free tier is offered for this service.

The control plane fee is the one that surprises people

It is charged per workstation cluster, per hour, whether or not anything in that cluster is running. Google's own documentation works the arithmetic: $0.20 x 24 x 30 is $144 per month, per cluster, as a floor before a single developer starts a workstation.

Google notes that most cases need only one control plane, with additional clusters required for multi-region or multi-VPC deployments. Treat cluster count as a cost decision, not just a topology decision: a well-meant cluster per team or per environment multiplies that floor directly.

How the per-developer math works out

Arithmetic on the published rates: a 4-vCPU workstation accrues $0.20 per hour in management fee alone, before the VM rate. At 120 running hours a month that is $24 in management fee per developer, plus Compute Engine, plus the disk, plus a share of the $144 cluster floor.

The shape of that is what makes team size decisive. Split across 100 developers, the cluster floor is under $1.50 each and irrelevant. Split across five, it is nearly $29 each and dominates the comparison.

Discounts apply to the compute, not to the service fees

Committed-use and sustained-use discounts are Compute Engine mechanisms and reduce the VM portion of the bill. Comparing Google's published one-year and three-year workstation rates against the on-demand figures shows the $0.05 per vCPU-hour management fee riding through all three columns unchanged, so model the management and control plane fees at full price even under a commitment. Google does not state this in prose, so treat it as an observation from the published rate tables rather than a vendor statement, and confirm it against your own billing export.

The saving grace is that the timeout defaults are on your side. Workstations stop automatically after a default idle period of 20 minutes, and a default maximum running time of 12 hours forces a restart so security updates apply. Both are configurable, and both are worth tightening rather than loosening. See cost analysis and FinOps for development environments.

Architecture and Isolation

A container image on a dedicated VM, which is a stronger boundary than most of this category offers

Each workstation is a Compute Engine virtual machine with a Persistent Disk, running your container image. That is a meaningful difference from container-on-shared-host designs: the isolation boundary is a VM you are billed for, not a namespace on a multi-tenant node. It costs more per developer and it buys a boundary that is easier to defend in a security review.

Network boundary

Workstation clusters attach to a VPC network, and private cluster configuration removes public endpoints. VPC Service Controls can place developer workloads inside the same perimeter as the data they touch.

Identity boundary

Access is IAM, so the same bindings and audit trail that govern production govern workstations. There is no second directory to reconcile, which is a real operational saving.

Enforced restarts

The default 12-hour maximum running timeout exists so workstations pick up updated images rather than drifting for weeks. Disabling it to avoid interruptions quietly reintroduces the drift problem the platform was meant to solve.

Where the boundary is still not enough

A VM per developer is a good answer for trusted engineers. It is an expensive and slow answer for running large volumes of unreviewed, model-generated code, where you want sandboxes measured in milliseconds and cents rather than minutes and VM-hours. That is a different product category, covered in sandbox environments and microVM isolation.

Status and Durability

Generally available, actively shipping, and carrying the usual hyperscaler caveat

Cloud Workstations reached general availability with an SLA in May 2023 and continues to receive product updates, with release notes entries through July 2026. The service carries no deprecation or shutdown notice. What does get deprecated is individual base images - older JDK, Node, and Ubuntu images have been retired on the normal schedule - which is routine image lifecycle rather than a signal about the product.

That is a healthier picture than most of this category can claim. It deserves one honest qualification, though, and it is the same one that applies to every cloud provider service: AWS closed Cloud9 to new customers and then closed CodeCatalyst, both of which also looked healthy and generally available shortly before. Being run by a hyperscaler makes abandonment less likely than at a startup, not impossible, and developer tooling is not usually the strategic core of a cloud business.

What protects you here

The exit is unusually clean by the standards of this category, because the substance of the environment is a container image you built and infrastructure you declared. If the service ended, the image runs elsewhere. What you would rebuild is the IAM, perimeter, and access plumbing - significant, but not a rewrite of how your team works.

What deepens the dependency

Every Google-specific control you adopt to justify the product - VPC Service Controls perimeters, CMEK, private clusters, organization policy - is a control you would have to reproduce elsewhere. The security integration is simultaneously the reason to buy it and the thing that makes leaving costly. That is not a flaw, but it should be a conscious trade.

The proportionate approach is to keep the image and infrastructure definitions portable, avoid inventing Google-only workflows where a standard one exists, and revisit the pricing page each budgeting cycle since all three charges are published and can move. Vendor evaluation covers scoring this systematically, and the CDE market guide covers who else has entered and left the category.