# Servers and regions

Your services run on servers that Alf runs for you. There's nothing to install and nothing to keep up to date: you choose where a service runs, or let Alf choose.

## Shared servers

Alf has servers in several regions. **Servers** in the sidebar lists them: the region, whether it's online, which of your services run there, and on how many servers each of them runs. See [The servers page](/docs/capacity).

Every organization's services run on them, each project in its own private network: your services can't be reached by anyone else's, on the same server or across servers. See [Private networking](/docs/networking) and [Security](/docs/security).

## Where a service runs

By default Alf places each service on as many online servers as its **instances** say, spreading them over regions and towards the servers with the fewest services. With several instances, visitors reach the nearest one that's awake. [Where services run](/docs/placement) has every rule and every case: what makes a service move, and what doesn't.

A busy server takes no new services until its load is down; new ones go to servers with room, and if none has any, creating the service is refused with a message saying so. See [When a server is full](/docs/capacity#when-a-server-is-full).

## Choosing regions

Alf groups its servers into regions, like **Europe** (servers in Falkenstein and Nuremberg, say) or **US**; the picker shows where each region's servers are. [Regions](/regions) lists the ones open today. **Regions**, when you create a service and in its **Scaling** settings, is where it runs: one instance in each region you pick, on a server of its own there. **Anywhere**, the default, is one instance where Alf picks. Changing them moves the service: it starts on a server in its new regions and leaves the old one, and its instances are spread over them again.

```diagram regions
web is kept to Europe and US, so it runs one instance in each, on a server of its own there; db is kept to Europe. A visitor in Berlin reaches web on a server in Falkenstein, which also runs db with its volume; a visitor in New York reaches web on a server in the US. If the Falkenstein server goes away, another server in Europe, like Nuremberg, takes web. Anywhere, the default, is one instance where Alf picks. Databases, computers and services with a volume run on one server, in one region, where their data is.
```

- **Databases and computers** run on one server: choose their region when you add them.
- **A service with a [volume](/docs/volumes)** stays on the server its data is on, so its regions can't leave that server's out. To move one, restore a [snapshot](/docs/backups) into a new service where you want it.
- **More than one in a region**: through the API or alf.toml, like two in Europe and one in the US. See [How many in each region](/docs/placement#how-many-in-each-region).
- **Not a particular server**: a service is kept to regions, and Alf picks the server there (one with room, near the project's other services), so a full or failing server is never yours to work around.
- **Coding agents** do the same with `regions` on `create_service`, `update_service`, `add_database` and `create_computer`.
- A project's services share a [private network](/docs/networking), so a region where none of its servers can join the project's network can't be chosen for it; the picker says so.

When a server goes offline, its services move to another server in the same region, and to another of their regions only when none there can take them. Those with a volume wait for it instead: their data is on that server. The room every server keeps free is there for exactly this. See [Where services run](/docs/placement#every-case).

All services of a project run on servers that can share its [private network](/docs/networking). Now and then that means a server on the list can't be chosen for a project that already runs elsewhere; the message says so.

## Private servers

If you want machines that run only your organization's services, Alf can set up **private servers** for you: write to [contact@runalf.com](mailto:contact@runalf.com).

Once your organization has a private server:

- your new services run there, and only your organization's services do;
- services you already had move over by themselves, except those with a volume (their data stays where it is until you [move them](/docs/placement#services-with-a-volume), which takes it along);
- the **Servers** page marks it **Only yours** and shows which of your services run on it.

Alf installs, updates and watches private servers the same way as the shared ones, including how much room they have: if yours fills up, it says "Full right now" and we'll be in touch about a bigger or another one.

## Updates

Servers update themselves: when a new version of the program that runs your containers is released, each server restarts into it at a quiet moment (no builds running, no requests open). Your containers keep running meanwhile.

Now and then a feature needs a version a server doesn't have yet. It's then refused for services on that server with a message saying so, and works a few minutes later.