Best self-hosted CI for a 200-user shop on a tight budget

The perennial debate around CI/CD tooling often centers on the false dichotomy of "managed versus self-hosted," but this overlooks the critical dimension of architectural debt. For a 200-user engineering organization operating under genuine budget constraints, the correct choice is not merely the cheapest runner software, but a platform you can own, scale predictably, and integrate into a multi-cloud-ready control plane. Managed services, while operationally simple, create a form of vendor-locked infrastructure that becomes prohibitively expensive at scale and limits your ability to enforce consistent network security policies across hybrid environments.

Given your user count, I will operate under the assumption of moderate-to-high concurrent workload demands, perhaps 50-100 simultaneous builds during peak periods, with a mix of containerized and legacy application pipelines. The primary cost drivers will be:
* **Compute infrastructure:** The persistent or elastic nodes executing jobs.
* **Control plane resilience:** High availability for the CI server itself.
* **Storage artifact lifecycle:** Managing logs, dependencies, and output binaries.
* **Network egress:** Particularly if pulling dependencies from public registries or deploying across clouds.

For the core software, I advocate for **Jenkins** or **GitLab Runner (self-managed)**, but with severe, non-negotiable caveats regarding their architecture.

**Jenkins** remains the quintessential workhorse, but its out-of-the-box configuration is a fiscal and operational trap. You must immediately implement:
* The Jenkins Configuration-as-Code (JCasC) plugin to treat your master node as ephemeral.
* A cloud-native architecture using the Kubernetes plugin, where build agents are dynamically provisioned as pods in a dedicated cluster namespace. This eliminates idle runner costs.

```yaml
# Example JCasC snippet defining a Kubernetes cloud for dynamic agents
jenkins:
clouds:
- kubernetes:
name: "build-k8s"
serverUrl: "https://kubernetes.default.svc.cluster.local"
namespace: "jenkins-agents"
templates:
- name: "maven-builder"
label: "maven"
containers:
- name: "jdk"
image: "maven:3.8.6-openjdk-11"
resourceRequestCpu: "500m"
resourceLimitCpu: "2000m"
```

**GitLab Runner** offers a more modern agent model but ties you to GitLab's ecosystem. Its autoscaling with Docker Machine (on AWS, GCP) or the Kubernetes executor is mature. The cost advantage emerges from its lightweight coordination; the GitLab server is primarily a web UI and coordinator, pushing all workload execution to the runners.

The pivotal, often overlooked, component is the **underlying infrastructure**. To minimize cost:
1. Use **spot/preemptible instances** for stateless build agents, with a fallback to on-demand for guaranteed capacity. This requires your pipeline to be idempotent.
2. Deploy the control plane (Jenkins master or GitLab server) on a small, resilient Kubernetes cluster (3 nodes, t3a.medium for example) using Terraform, not manually.
3. Implement a **shared artifact repository** like Nexus or Object Storage (AWS S3, GCP Cloud Storage) with strict lifecycle policies to avoid unbounded storage growth.
4. Employ a **service mesh** (like Istio) or explicit network policy to segment build traffic, reducing the attack surface and allowing you to meter egress by namespace.

The total cost of ownership for this model will be dominated by your compute choices, not the CI software license (which is $0). A well-architected Jenkins-on-Kubernetes setup with spot instances can operate at 30-40% of the cost of a comparable volume of billed minutes from a managed cloud CI provider, but it demands dedicated platform engineering effort. The question is whether your "tight budget" is constrained on capital (where self-hosted wins) or on operational headcount (where a managed service might be justified).