Excalidraw on GKE Autopilot

Excalidraw is an open-source (MIT) virtual whiteboard for sketching hand-drawn-style diagrams, wireframes, and quick collaborative drawings. The self-hosted distribution is a static single-page application served by nginx — there is no backend, database, or user accounts, and drawings are stored in the visitor's own browser. This module deploys that static frontend on GKE Autopilot on top of the App_GKE foundation, which provisions and manages the shared Google Cloud and Kubernetes infrastructure.

This guide focuses on the cloud services Excalidraw uses and how to explore and operate them from the Google Cloud Console and the command line. For the mechanics common to every GKE application — Workload Identity, ingress, autoscaling, CI/CD, Cloud Armor, IAP, Binary Authorization, VPC Service Controls, and the deployment lifecycle — refer to the App_GKE foundation guide rather than repeating them here.

What Excalidraw costs on RAD, and how that compares

In a Google Cloud project you own, Excalidraw on RAD's GKE Autopilot module costs about US$24 a month, plus US$4 once per deployment and no per-user licence. For the lowest cost, the Cloud Run module runs the same Excalidraw for about US$17 a month. Excalidraw is a static, open-source whiteboard for hand-drawn-style diagrams, with no database, Redis or persistent storage of its own. Figures are as at 8 October 2026; sources are listed at the end of this section.

If this runs in a project RAD manages for you, it can be deleted and restored within 30 days for a few credits instead of sitting there running — so an occasional-use deployment costs a few dollars a month, not US$24. See Pause it for free, below.

What you pay on RAD

	In a Google Cloud project you own	In a project RAD manages for you
Module fee, once per deployment	40 credits (US$4 at the top-up price)	36 credits (10% lower)
Build time	A few credits per build	The same
Google Cloud running cost	Billed by Google to your own billing account, about US$24 a month for the default configuration (table below)	Metered hourly in credits; RAD publishes 55 credits a day, about 1,650 a month (about US$165 at the top-up price)
Who owns what	You own the project and its billing; RAD deploys and updates it	RAD owns the project, with guardrails, quotas and budget alerts; you get console access, and a minimum purchased balance is held in reserve

10 credits cost US$1 on a one-off top-up, and less on a monthly plan. In a project RAD manages, the database, file server and network are shared by every application in the project, so a second application does not add a second database.

Default running cost in your own project (us-central1, Google list prices):

Resource (module default)	Per month
GKE Autopilot pod, 0.5 vCPU / 0.5 GiB, running all the time	US$18
Cloud NAT gateway and IP address	US$5
Cloud Storage for backups	US$1
Total	about US$24

GKE's free tier covers the management fee of one Autopilot or zonal cluster per billing account, so the total above assumes this is that cluster; otherwise add about US$73 a month.

How it compares

We could not find a commercial managed/SaaS plan specifically for Excalidraw itself as at 8 October 2026, so the honest comparison is against running it yourself:

Option	Per month	Who runs it
Hetzner CPX22 (2 vCPU/4GB)	~US$24	You: OS, updates, backups, security patches
DigitalOcean 2 vCPU/4GB Droplet	US$24	You: OS, updates, backups, security patches
GCP Compute Engine e2-standard-2 (2 vCPU/8GB)	~US$49	You: OS, updates, backups, security patches
RAD, GKE Autopilot, your own project	US$24, plus US$4 once	RAD's automation, in your project
RAD, Cloud Run	about US$17; see the Cloud Run guide	RAD

Excalidraw's own footprint here (0.5 vCPU / 0.5 GiB) is lighter than that reference box, so a smaller, cheaper tier from the same providers would comfortably run it too.

RAD is usually not cheaper in cash than a bare VPS — the difference is what is managed for you. A VPS price does not include the admin's own time for backups, security patches and OS upgrades; RAD's managed Cloud SQL (where this app uses a database), Secret Manager and monitoring cover that instead.
Excalidraw is a static, open-source whiteboard for hand-drawn-style diagrams, with no database, Redis or persistent storage of its own. That shapes which column matters: predictable, hands-off operation is worth more to most teams running this kind of tool than shaving a few dollars off the monthly bill.

Pause it for free: delete a RAD-managed project, restore it when you need it

If Excalidraw runs in a project RAD manages for you, you have an option beyond scaling down: delete the whole project, and restore it within 30 days for close to nothing. This suits a deployment you only need occasionally — studying for a certification, a demo, a seasonal need — far better than running it continuously.

How it works. Deleting a RAD-managed project unlinks its billing first, then asks Google to delete the project. Google does not remove it immediately: it keeps it, recoverable, for 30 days, and because billing is already unlinked, nothing is charged while it waits. Unlike deleting one module, this does not tear down GKE Autopilot one by one — the whole project, and everything in it, simply stops.
Restoring costs a handful of credits, not a rebuild. Within 30 days, the project's owner can restore it. RAD asks Google to undelete the project and reattaches its billing account, then asks you to run Update on each deployment to confirm everything came back. Because nothing was individually destroyed, that Update finds the same resources already there — it is a check, not a rebuild, and an Update never charges the module fee again. That costs a handful of build-time credits in total (under US$1) for a typical 2–3-deployment chain.
So a month of occasional use can cost a few dollars, not US$24. Deploy Excalidraw, use it for a session, delete the project. Restore it next time you want it, confirm with Update, and delete it again when you're done. You pay only for the module fee once, the builds, and whatever hours it was actually live.
What this needs. You must own the project (not a bring-your-own one RAD only manages billing for), and you restore it yourself within the 30 days — after that, Google deletes it for good. Restoring is admitted like creating a new project: your purchased credit balance must still clear the tier's floor (100 credits for the sandbox tier most study/demo use fits). Google says most services are fully working again within 36 hours of a restore.

Pay only while you use it, the other way: delete and redeploy

GKE keeps at least one pod running, so Excalidraw never scales to zero on its own. The option above only applies to a RAD-managed project; in your own project, or once the 30-day window has passed, the way to stop paying is to delete the deployment and deploy it again when you need it.

What a redeploy costs. The module fee again plus the builds: about 45 credits (US$4.50). Deleting saves money if Excalidraw would otherwise sit unused for about 6 days or more in your own project (about US$0.80 a day), or about 1 day or more in a RAD-managed one (55 credits a day).
Note your settings. RAD does not recreate a deleted deployment for you; you enter the settings again when you deploy.

Lab sessions and Managed Environments

Lab sessions, for training. A trainer runs a session for a class. Each participant gets Excalidraw in their own Google Cloud project for 15 minutes to 24 hours, within an allowance the trainer sets. Either the trainer funds every place, or each participant pays for their own. Everything is deleted when the session ends and unused credits go back to the trainer.
Managed Environments, for consultancies. A partner runs the app for a client from a ring-fenced wallet it funds, and settles with the client directly. If the wallet runs low, billing pauses and the data is kept, so nobody receives an unexpected charge. At the end the partner hands the project over and the deployments become the client's own.

Credits can be bought in more than 20 currencies, including XAF, XOF, NGN, GHS, KES and ZAR, by card, bank transfer or mobile money.

Sources (8 October 2026): Google Cloud list prices from the Cloud Billing Catalog API; RAD's own fees and daily-credit estimate from radmodules.dev/pricing; Delete and restore projects for the pause/restore mechanism. Prices change; check each source before relying on a figure.

1. Overview

Excalidraw runs as a single stateless nginx web workload. Because the app has no backend, the deployment wires together only a minimal set of Google Cloud services:

Capability	Google Cloud service	Notes
Compute	GKE Autopilot	Static nginx pods on port 80, horizontally autoscaled; billed for requested CPU/memory
Container image	Artifact Registry	Thin custom build `FROM excalidraw/excalidraw`, mirrored into the project registry
Database	None	Excalidraw has no backend — no Cloud SQL instance is created
Object storage	None	No GCS bucket is provisioned; drawings live in the browser
Cache & queue	None	No Redis, no message queue
Secrets	None	No encryption keys, JWT secrets, or DB passwords — Secret Manager is unused
Ingress	Cloud Load Balancing	External LoadBalancer, optional custom domain + managed certificate

Sensible defaults worth knowing up front:

Fully stateless — no data is stored server-side. Drawings persist in each browser's local storage and are exported/imported as .excalidraw files. Pod rescheduling, redeploys, and scaling lose no server data because there is none.
Minimum 1 replica is maintained (GKE does not support scale-to-zero) to keep the whiteboard always reachable. The wrapper pins min_instance_count = 1.
Deployment workload, not StatefulSet. There is no per-pod persistent volume — every pod serves the same static bundle, so a plain Deployment is used and pods are fully interchangeable.
Fixed port 80. The nginx listener is baked into the image; container_port defaults to 80 and should not be changed.
No Cloud SQL, Secret Manager, Redis, NFS, or GCS. The corresponding foundation features are inert for this app — enabling them provisions unused infrastructure.
External LoadBalancer by default so the whiteboard is browser-reachable; a reserved static IP keeps the address stable across redeploys.
Legacy homeserver_url / homeserver_name inputs. Carried over from the Element template and still injected as HOMESERVER_URL / HOMESERVER_NAME, which the static SPA ignores. They are hidden from the deploy form.

2. Google Cloud Services & How to Explore Them

All commands assume you have run gcloud container clusters get-credentials <cluster> --region <region> --project <project> and that PROJECT, REGION, and NAMESPACE are set. The namespace and other identifiers are reported in the deployment Outputs.

A. GKE Autopilot — the Excalidraw workload

Excalidraw pods are scheduled on Autopilot, which bills for the CPU/memory the pods actually request. Horizontal Pod Autoscaling sizes the deployment between the minimum (1) and maximum replica counts. Because every pod is identical and stateless, scaling out is safe with no coordination.

Console: Kubernetes Engine → Workloads → select the Excalidraw workload for pods, revisions, and events. Kubernetes Engine → Services & Ingress shows the external IP.

CLI:

kubectl get pods,svc,hpa -n "$NAMESPACE"
kubectl logs -n "$NAMESPACE" deploy/<service-name> --tail=100      # nginx access/error logs
kubectl describe hpa -n "$NAMESPACE"                                # current vs target utilisation

See App_GKE for how Autopilot, scaling, and the workload type are managed.

B. Artifact Registry — the container image

The Excalidraw image is a thin custom build FROM excalidraw/excalidraw that Cloud Build produces and pushes into the project's Artifact Registry (enable_image_mirroring = true). App_GKE sets imagePullPolicy=Always for custom-built/mirrored images so a rebuilt tag is always re-pulled.

Console: Artifact Registry → Repositories.

CLI:

gcloud artifacts repositories list --project "$PROJECT" --location "$REGION"
gcloud artifacts docker images list <repo-path> --include-tags
gcloud builds list --project "$PROJECT" --region "$REGION" --limit 5
# Confirm the digest running in the cluster matches the freshly built image:
kubectl get pod -n "$NAMESPACE" -o jsonpath='{.items[0].status.containerStatuses[0].imageID}'

C. Database, Secret Manager, Cloud Storage, Redis — not used

Excalidraw provisions none of these. There is no Cloud SQL instance, no Secret Manager secret, no GCS bucket, and no Redis for this deployment. The following will return empty results for the app — that is expected:

gcloud sql instances list --project "$PROJECT" --filter="name~excalidraw"   # (none)
gcloud secrets list --project "$PROJECT" --filter="name~excalidraw"          # (none)
gcloud storage buckets list --project "$PROJECT" --filter="name~excalidraw"  # (none)

Live collaboration works, but through Excalidraw's own hosted room server (oss-collab.excalidraw.com, end-to-end encrypted), not a service in your project — see the defaults above. Hosting collaboration yourself would need a source build of the frontend and a separate excalidraw-room server, which this module does not deploy.

D. Networking & ingress

By default the workload is exposed through an external Cloud Load Balancing IP. A custom domain with a Google-managed certificate can be enabled, and a static IP can be reserved so the address survives redeploys. Cloud CDN is a good fit for the static assets.

Console: Network services → Load balancing; VPC network → IP addresses.

CLI:

kubectl get ingress,svc -n "$NAMESPACE"
gcloud compute addresses list --project "$PROJECT"

See App_GKE for custom domains, Cloud CDN, and static IP details.

E. Cloud Logging & Monitoring

Pod stdout/stderr (nginx logs) flow to Cloud Logging; GKE metrics flow to Cloud Monitoring. Optional uptime checks and alert policies are available; a public root-path uptime check is a natural health signal for the static frontend.

Console: Logging → Logs Explorer; Monitoring → Dashboards / Alerting.

CLI:

gcloud logging read 'resource.type="k8s_container" AND resource.labels.namespace_name="'"$NAMESPACE"'"' \
  --project "$PROJECT" --limit 50

3. Excalidraw Application Behaviour

No first-deploy setup. There is no database, no init job, and no migrations. A pod is Ready as soon as nginx starts serving the static bundle — usually within a second or two.
No accounts, no login, no server persistence. The self-hosted frontend has no authentication and stores nothing server-side. Each user's drawings live in their own browser's local storage; use Export (.excalidraw, PNG, or SVG) to save or share work.
Pods are interchangeable. Every replica serves the identical static bundle, so requests need no session affinity and scaling out requires no coordination — unlike the stateful application modules.
Some optional features use Excalidraw's own hosted services. The upstream bundle wires live collaboration (oss-collab.excalidraw.com and Firebase), "Export to link" (json.excalidraw.com), the AI text-to-diagram and diagram-to-code features (oss-ai.excalidraw.com) and the shape-library browser (libraries.excalidraw.com) to Excalidraw's servers, not to anything in your project. Nothing is contacted on a plain page load — only when a user invokes the feature — and collaboration is end-to-end encrypted, but that content does leave the project. The URLs are compiled into the frontend at build time, so this module cannot redirect them; self-hosting collaboration would need a source build plus an excalidraw-room server.
Health path. Startup and liveness probes target the root /, which nginx answers with 200 immediately. Verify from inside the cluster or via the LoadBalancer IP:
```
kubectl port-forward -n "$NAMESPACE" deploy/<service-name> 8080:80
curl -sI http://localhost:8080/ | head -1        # expect: HTTP/1.1 200 OK
```
Version upgrades are a rebuild + redeploy. Bumping application_version rebuilds the image from a new excalidraw/excalidraw tag and rolls out new pods; because there is no state, upgrades and rollbacks are trivial and non-destructive.
Vestigial env vars. HOMESERVER_URL / HOMESERVER_NAME are injected (Element carry-over) but ignored by the static SPA. Confirm/inspect env with:
```
kubectl exec -n "$NAMESPACE" deploy/<service-name> -- env | grep HOMESERVER
```

4. Configuration Variables

Variables are grouped exactly as they appear on the deployment platform. Only settings specific to or notable for Excalidraw are listed; every other input is inherited from App_GKE with its standard behaviour and defaults.