Dedicated Containers & DBs per Tenant: Extreme Isolation or Infra Overkill?

When building QeakFlow (a privacy-first, GDPR-compliant email marketing SaaS), we made a radical architecture choice: no shared database with tenant_id columns.

Instead, every workspace runs in its own isolated container with its own dedicated database.

Here’s why we built it this way, how it works under the hood, and the massive trade-offs we deal with daily.
Why Hard Isolation?

Zero Data Leak Risk (GDPR): In a multi-tenant DB, a single missing WHERE tenant_id = x in a complex JOIN leaks PII. With separate DBs, cross-contamination is physically impossible. Deleting a user’s data is literally DROP DATABASE.
No "Noisy Neighbors": Heavy email imports/dispatches hit isolated CPU/RAM limits without slowing down other users.
Isolated Blast Radius: Users connect their own SMTP credentials (BYO-SMTP). If a external SMTP socket hangs, it only affects that single tenant's worker container.

The Tech Stack
We run a lean setup on Ubuntu 24.04:

• Docker + cgroups: Hard limit per container (e.g., 256MB RAM / 0.5 CPU).
• Redis: The central orchestration backbone - tracks live container states, manages atomic distributed locks, and routes background jobs via Pub/Sub and light queues.
• Prometheus + cAdvisor: Monitors container health and resource spikes.

The Painful Trade-offs

• Memory Overhead: In our testing: 10 idle tenants = ~1.5GB RAM baseline.
  At 100 tenants that's 15GB+ before a single email is sent.
  On Hetzner CX52 (€60/mo) that gives us ~130 tenants
  before we need to scale up. Base memory footprints add up fast compared to one shared monolithic app instance.
• Database Migration Sprawl: Schema updates require running migrations across N databases sequentially or in parallel.
• Orchestration Overhead: Building custom dynamic lifecycle hooks (spin up, pause, health check, teardown).

Questions for the IH Community:

1. How are you handling data isolation in your SaaS? Did you stick to single-database multi-tenancy, or are you isolating workloads?
2. For those running dedicated containers per user/team: at what point did orchestration become too complex to handle solo?

Would love to hear how other founders balance privacy guarantees with infrastructure costs!