Why We Run Every AI Pipeline in Its Own Process
The runtime boundary behind RocketRide's crash isolation, task lifecycle, and Cloud operations. By Krish Garg and Mithilesh Gaurihar At 9 a.m., with ten thousand users mid-session, a node in an AI pipeline dereferences a bad pointer. The process running it is gone before Python can raise a useful exception. That is an unpleasant failure, but it is not the question we care about most. The question is what happens next. Does that crash take unrelated pipelines with it? Does the server need a restart? Does the on-call engineer walk into a system-wide incident, or into one failed task and a useful record of why it failed? In RocketRide, a failed task is meant to be contained and recorded. The server sees the child process exit, updates the task's state and exit code, releases the task's ports and connections, and sends status updates to subscribed monitors. The run stops. Its history does not vanish. Other task processes are not sharing its memory, interpreter, or worker threads. That behavior comes from a decision we made early: every pipeline run gets its own isolated process. It is not the cheapest or fastest possible architecture. Starting a process has a cost, and keeping one around has a cost too. We accepted those costs because the alternative makes failures much harder to reason about once Python code, native libraries, model runtimes, and user-defined nodes are all running in the same service. One Process, One Blast Radius An AI pipeline does not fail like a typical request handler. A normal exception is one thing. A segfault in a C extension, a crash in a media decoder, or a broken native inference library is another. Once a process has corrupted memory, application-level error handling is no longer a reliable line of defense. So each RocketRide task starts as a fresh child process with its own embedded Python interpreter. It loads one pipeline, initializes that pipeline's nodes, and owns the work for that run. The parent runtime keeps the task registry, alloc