Cloud software will be built in new ways. Pulumi CEO Joe Duffy thinks he has the right tool kit

The cloud engineering startup, which counts its namesake infrastructure-as-a-code tool as its flagship technology, has plans to build a whole set of tools for developers who want to work on the cloud.

Photograph of Pulumi CEO Joe Duffy

"[L]ong-term, we're a cloud engineering platform, and we're solving for so much more of the space of what these enterprises have to build internally," said Joe Duffy, Pulumi's co-founder and CEO.

Photo: Pulumi

Pulumi CEO and co-founder Joe Duffy’s vision for his open-source cloud engineering startup is to offer developers and infrastructure teams the tools they need to “make the most out of the cloud.”

With its universal infrastructure-as-code software tool as its flagship technology, the company – which marked its fifth year in March – is approaching 1,000 commercial customers and growing rapidly, according to Duffy, a Microsoft veteran who ran the cloud provider’s developer strategy and managed its programming languages teams.

“The cloud is really transforming everything about how we build software, enabling new capabilities,” Duffy said. “What we're really trying to do is break down the silos and enable developers, infrastructure teams and security experts to just collaborate and build cloud-powered software. Software is changing everything about modern business.”

Duffy talked to Protocol about Pulumi’s start and where it’s headed — including plans for an initial public offering — as well as its competition with HashiCorp’s Terraform and why the company uses AWS as its internal cloud provider.

The interview has been edited and condensed for clarity.

Pulumi has been in business for five-plus years now. How’s it going and can you give any metrics to support that?

In short, it's going really well. We just hit our five-year anniversary in March this year. We came from a developer heritage, and our bet was the future is really all about empowering developers and bringing software engineering to infrastructure teams. What we found was, frankly, what folks are using in this space is not very good. People thought about giving care and love to developers in a fundamentally different way than infrastructure teams.

So we sort of made the big bet, and it took a while to build the initial platform. It took about a year to build the first version. We open-sourced it. We didn't even launch the commercial edition for another year after that, so really we've been in market commercially for three years. Within the last year, things have really just picked up steam — really, the last six months even. I think the market has really changed in sort of the way that we've predicted. Honestly, COVID actually accelerated this. You see a lot more people accelerating their cloud efforts. The idea that developers should be in the driver's seat has picked up steam as well. They're the people building business value, and the more you can empower them with guardrails — hence, security is important — the faster the business can go, and we see that's part of the dialogue for every enterprise we work with.

We're open source first, and so we always think about the open-source community. In terms of metrics … [we’re in the] ballpark [of] 100,000 community members and coming up on almost cracking the 1,000-commercial-customer mark. That's growing very rapidly. I think we're kind of where HashiCorp was three, four years ago, but growing much faster than they are these days, so I think we'll catch up pretty soon. I feel very fortunate, especially in this current macroeconomic climate, that things are going so well.

You compete against HashiCorp’s Terraform. What's your argument for going with Pulumi over Terraform?

There are two things we find. One is really just the level of productivity is much greater with Pulumi. Atlassian is a customer of ours, and they said, “Hey, we can get twice as much done now with Pulumi than we could before.” Mercedes-Benz, Snowflake, they moved from Terraform to Pulumi and found similar results. Snowflake's story was, on their road to IPO they had to ship their data cloud platform, and I think they had some intense deadlines set by the board. Based on their past experience in Terraform, they said, “Hey, we just can't get it done in time with Terraform. We're going to pick Pulumi, and by picking Pulumi, we can empower our entire team.”

Often we find that Terraform silos are formed. There's “Oh, those five people over there in the corner know Terraform, but nobody else does.” Pulumi allows you to use your favorite language — any great programming language like JavaScript or Python or Go, Java. It meets people where they are rather than you having to learn a proprietary language like with Terraform. So that's the first: It's productivity, it's familiarity.

The second is scalability. We often find with increasingly complex cloud architectures, there's a lot more moving pieces. That's exactly the sort of problem that we invented these great programming languages to solve — it's just in a different domain. Over the last 30 years, we built these great programming languages and tools and ecosystems around them to solve these problems for application development. What we're finding is now those same challenges are emerging in infrastructure management, and so we were able to apply those same techniques. And again, because Terraform [has] a proprietary language that doesn't handle a lot of these things, it's sort of a siloed ecosystem, and it doesn't scale. Those are the two things we hear the most from customers.

Do you see a lot of customers making that switch from Terraform, or do you have more customers that just start with Pulumi?

It's a mix. Terraform had a multiyear head start on us, and so there's definitely a lot of Terraform in the market. In some sense, those folks have already felt the pain of those two things that I just mentioned, and so it's a lot easier for them to see “Oh, infrastructure as code is important to me, and yet this thing I'm using didn't satisfy my needs.” Pulumi clearly solves that, so it's an easier path for them. I'd say it's about half and half: Fifty percent are coming from Terraform or another [infrastructure-as-code] tool.

But one thing has changed since we started: We now hear infrastructure as code is “table stakes.” We hear from people, “Oh, I'm going to cloud, so I need infrastructure as code.” What that means is literally anybody who's doing anything in the cloud is a potential customer, and so there's a lot of greenfield opportunity as well.

"[L]ong-term, we're a cloud engineering platform, and we're solving for so much more of the space of what these enterprises have to build internally."

Within larger enterprises, I think our biggest competitor is actually homegrown. A lot of folks, especially on the journey to multicloud, have had to build a lot of custom internal tools and platforms — not because they wanted to, but because they had to. And so really long-term, Pulumi's not really competing with Terraform; long-term, we're a cloud engineering platform, and we're solving for so much more of the space of what these enterprises have to build internally. It just so happens infrastructure as code is our flagship technology. It's where we started, it's where we are today. But over time, we'll grow into more of a management suite for the entire enterprise, and that's where homegrown actually becomes much more of the challenge. But today, purely on infrastructure as code, definitely Terraform is the current market standard.

Can you expand on where you want to go in the future?

I can use sort of an analogy: GitLab … started with source control management, but to compete against GitHub, they really expanded into being a DevOps platform, and source control management is one piece of that. It's a very similar thing with Pulumi.

We started with infrastructure as code, but when it comes time to adopt cloud engineering in an organization, it goes well beyond infrastructure as code. You think of policy as code, you think of “How do I empower my developers with self-serve portals.” You think of observability, you think of all the management tasks — so compliance and auditing and security, enforcing best practices. How do we enable the cloud engineering team — that's developers, infrastructure teams and security experts — to just collaborate in the most seamless way?

What we're really trying to do is break down the silos and enable developers, infrastructure teams and security experts to just collaborate and build cloud-powered software. And that's the vision, that's the future. Infrastructure as code is sort of the first entrée toward that.

You mentioned moving upmarket customerwise. Who are your customers today?

We have offerings all the way from free … to what we call our business-critical tier. We have an enterprise product, and we have a team edition. On the high end, the typical story is we … work with a platform team. A lot of these enterprises are starting to create these platform teams. They basically are responsible for leading the charge for adopting the cloud within the organization. They sort of sit between the infrastructure and operations team and the developers. And their goal is “Hey, figure out how to adopt AWS, Azure, Kubernetes — make the choices on the platforms.”

That includes something like Pulumi. That includes CI/CD systems. They're trying to turn around and empower developers to be in control of their own destinies, but they want to do that with guardrails in place, so developers don't do the wrong thing accidentally. Then they turn around and give patterns and practices to the infrastructure team, so things are repeatable.

Our biggest customer – not one I can name unfortunately, but it's a super exciting partnership – is using us within over 100 teams within the company and close to 10,000 engineers on a daily basis. And really at that scale, what they're trying to do is tame the chaos of adopting the public cloud. Pulumi can scale to very large-scale complexity in a way that most other kinds of technologies can't, and so that is a very common story with larger companies like Snowflake, Univision and Mercedes-Benz … DocuSign — folks like that.

We have a strong contingency in the mid-market as well, which is folks who recently IPO-ed or are about to IPO and people for which the cloud is a competitive advantage in a fundamental way.

You mentioned in your blog that when you were exploring starting Pulumi in 2016, the capabilities of the cloud were incredible but far too difficult to use, which held true in 2018, when the company launched. Is that still the case?

I think we've definitely made a huge dent in making it easier. My customers were developers when I was at Microsoft, and they really weren't excited about the cloud. They didn't want to touch it. They would write their code like the cloud didn't exist, and they’d throw it over the wall to the infrastructure team, and it was very inefficient.

I thought, why is that? One reason is because I don't want to go learn some weird, proprietary language; I want to use what's comfortable to me. I want to use my favorite editor. I want to use all the practices that I know already. So we solved that problem. We've really brought the cloud a lot closer to developers and brought great software engineering tools to infrastructure teams, but there's so much more we can do. The shift to the cloud is really a shift to building distributed applications, and the most innovative companies out there are the ones that have figured this out and have figured out how to do it. What we want to do is bring that to everybody, and we've got a great foundation to start from, but so much more to go from here.

Are cloud providers improving on their side?

They are. It's in their best interest to make it as easy to use as possible. For many large enterprises, they're still doing multicloud, and I think that's one thing that really sets us apart even if the cloud providers continue to improve their offerings. We work with folks who still have on-prem, virtual-machine data centers, and Pulumi gives them a consistent model they can standardize on across the team, even for private cloud and hybrid cloud. That's really special for especially large enterprises.

"The shift to the cloud is really a shift to building distributed applications, and the most innovative companies out there are the ones that have figured this out and have figured out how to do it."

I understand Pulumi uses mostly AWS internally. You’re a Microsoft veteran. Why AWS?

We're customers of all the clouds, but most of our service runs on AWS. If you go to Pulumi.com, that is hosted in AWS. My CTO [Luke Hoban] came from Amazon. He was on the EC2 team prior to coming to Pulumi. Amazon's philosophy resonates with us, which is they give you these powerful building blocks, all these services. It's up to you to stitch them together. That's the hard part. But Microsoft — and Google to some extent — try to give you more of a platform-as-a-service-like approach, where they're more monolithic and chunkier building blocks. We found that, especially with the way Pulumi allows you to program the cloud and stitch things together and compose things, the AWS model really just works perfectly.

What’s next for Pulumi?

There are really three main areas of focus for us. One is just being the market leader for infrastructure as code. We know we're growing faster than Terraform … but we still know they have a lot more market share. Priority No. 1 is really just infrastructure as code and being the market leader.

The second is doing better with developers. We figured out over time, as we were trying to find the product-market fit that “Oh wow, there's some really gnarly issues for people that we can solve in the infrastructure management space.” But really we're still far away from empowering every developer to tap into the cloud — not just infrastructure experts, not just developers who want to do infrastructure as code, but all developers, really allowing them to really embrace these new kinds of distributed cloud architectures. There's a huge opportunity that's going to totally reshape the way that developers write code.

The third is really that cloud engineering platform vision … going from infrastructure as code to a complete product suite that solves for this entire space.

You mentioned the economic climate. How is that from a startup's point of view? Do you have enough funding right now, and is that drying up at all?

It's changed the dynamics a bit. We don't worry too much about it. I don't say that to sound arrogant or anything, but we've always focused on business fundamentals. We wanted to build for the long-term. Our dream is to IPO and build a sustainable business that can eventually become profitable. That's very important to us. But unfortunately, I think a number of folks out there were raising well beyond where they were and maybe not as focused on business fundamentals. We feel good about where we're at right now. We raised a Series B [funding round] led by NEA about a year and a half ago … and that was a preemptive round. We raised about a year before we thought we'd need to, so we're still in a very strong position cashwise.

Is there a time frame envisioned for an IPO?

It's hard to predict the future, but I would say in the three- to five-year ballpark would be sort of where we're at as a company. You look at other comparable businesses like HashiCorp, GitLab, Datadog, and I think we're right around where they were three to four, sometimes five years before the IPO. A lot of it depends on the market and how it evolves, but given current growth rates, the opportunity is huge, and we're still very early in our growth curve within the market.


Binance’s co-founder could remake its crypto deal-making

Yi He is overseeing a $7.5 billion portfolio, with more investments to come, making her one of the most powerful investors in the industry.

Binance co-founder Yi He will oversee $7.5 billion in assets.

Photo: Binance

Binance co-founder Yi He isn’t as well known as the crypto giant’s colorful and controversial CEO, Changpeng “CZ” Zhao.

That could soon change. The 35-year-old executive is taking on a new, higher-profile role at the world’s largest crypto exchange as head of Binance Labs, the company’s venture capital arm. With $7.5 billion in assets to oversee, that instantly makes her one of the most powerful VC investors in crypto.

Keep Reading Show less
Benjamin Pimentel

Benjamin Pimentel ( @benpimentel) covers crypto and fintech from San Francisco. He has reported on many of the biggest tech stories over the past 20 years for the San Francisco Chronicle, Dow Jones MarketWatch and Business Insider, from the dot-com crash, the rise of cloud computing, social networking and AI to the impact of the Great Recession and the COVID crisis on Silicon Valley and beyond. He can be reached at bpimentel@protocol.com or via Google Voice at (925) 307-9342.

Sponsored Content

How cybercrime is going small time

Blockbuster hacks are no longer the norm – causing problems for companies trying to track down small-scale crime

Cybercrime is often thought of on a relatively large scale. Massive breaches lead to painful financial losses, bankrupting companies and causing untold embarrassment, splashed across the front pages of news websites worldwide. That’s unsurprising: cyber events typically cost businesses around $200,000, according to cybersecurity firm the Cyentia Institute. One in 10 of those victims suffer losses of more than $20 million, with some reaching $100 million or more.

That’s big money – but there’s plenty of loot out there for cybercriminals willing to aim lower. In 2021, the Internet Crime Complaint Center (IC3) received 847,376 complaints – reports by cybercrime victims – totaling losses of $6.9 billion. Averaged out, each victim lost $8,143.

Keep Reading Show less
Chris Stokel-Walker

Chris Stokel-Walker is a freelance technology and culture journalist and author of "YouTubers: How YouTube Shook Up TV and Created a New Generation of Stars." His work has been published in The New York Times, The Guardian and Wired.


Trump ordered social media visa screening. Biden's defending it.

The Knight First Amendment Institute just lost a battle to force the Biden administration to provide a report on the collection of social media handles from millions of visa applicants every year.

Visa applicants have to give up any of their social media handles from the past five years.

Photo: belterz/Getty Images

Would you feel comfortable if a U.S. immigration official reviewed all that you post on Facebook, Reddit, Snapchat, Twitter or even YouTube? Would it change what you decide to post or whom you talk to online? Perhaps you’ve said something critical of the U.S. government. Perhaps you’ve jokingly threatened to whack someone.

If you’ve applied for a U.S. visa, there’s a chance your online missives have been subjected to this kind of scrutiny, all in the name of keeping America safe. But three years after the Trump administration ordered enhanced vetting of visa applications, the Biden White House has not only continued the program, but is defending it — despite refusing to say if it’s had any impact.

Keep Reading Show less
Anna Kramer

Anna Kramer is a reporter at Protocol (Twitter: @ anna_c_kramer, email: akramer@protocol.com), where she writes about labor and workplace issues. Prior to joining the team, she covered tech and small business for the San Francisco Chronicle and privacy for Bloomberg Law. She is a recent graduate of Brown University, where she studied International Relations and Arabic and wrote her senior thesis about surveillance tools and technological development in the Middle East.


The US plans to block sales of older chipmaking tech to China

The Biden administration will attempt to roll back China’s chipmaking abilities by blocking tools that make a widely used type of transistor other chipmakers have employed for years.

By using a specific, fundamental building block of chip design as the basis for the overall policy, the White House hopes to both tighten existing controls and avoid the pitfalls around trying to block a generation of manufacturing technology.

Illustration: Christopher T. Fong/Protocol

The Biden administration has for several months been working to tighten its grip on U.S. exports of technology that China needs to make advanced chips, with the goals of both hurting China’s current manufacturing ability and also blocking its future access to next-generation capabilities.

According to two people familiar with the administration’s plans, President Joe Biden’s approach is based around choking off access to the tools, software and support mechanisms necessary to manufacture a specific type of technology that is one of the fundamental building blocks of modern microchips: the transistor.

Keep Reading Show less
Max A. Cherney

Max A. Cherney is a senior reporter at Protocol covering the semiconductor industry. He has worked for Barron's magazine as a Technology Reporter, and its sister site MarketWatch. He is based in San Francisco.


Netflix Games had its best month yet. Here's what's next.

A closer look at the company’s nascent gaming initiative suggests big plans that could involve cloud gaming and more.

Netflix’s acquisitions in the gaming space, and clues found in a number of job listings, suggest it has big plans.

Illustration: Christopher T. Fong/Protocol

Netflix’s foray into gaming is dead on arrival — at least according to the latest headlines about the company’s first few mobile games.

“Less than 1 percent of Netflix’s subscribers are playing its games,” declared Engadget recently. The article was referencing data from app analytics company Apptopia, which estimated that on any given day, only around 1.7 million people were playing Netflix’s mobile games on average.

Keep Reading Show less
Janko Roettgers

Janko Roettgers (@jank0) is a senior reporter at Protocol, reporting on the shifting power dynamics between tech, media, and entertainment, including the impact of new technologies. Previously, Janko was Variety's first-ever technology writer in San Francisco, where he covered big tech and emerging technologies. He has reported for Gigaom, Frankfurter Rundschau, Berliner Zeitung, and ORF, among others. He has written three books on consumer cord-cutting and online music and co-edited an anthology on internet subcultures. He lives with his family in Oakland.

Latest Stories