A multi-tenant worker pool is the obvious shape until users bring their own code. Once a customer can install an MCP server, "shared pool" stops meaning "efficient" and starts meaning "your blast radius is everyone."
We moved to per-user Fly machines for any run that touches user-supplied tools. Cold start is 800ms p50, which we hide behind the planning phase. The accounting got simpler too: a machine's lifetime is the run, so there's no garbage-collecting pods that almost-but-not-quite finished.