# What Hive is

> Hive runs jobs — CI/CD pipelines, test suites, builds, ad-hoc work — as Kubernetes Jobs across a fleet of clusters. A **run** is a DAG of **tasks**; each task executes in a container on whichever runner the scheduler picks.

Source: https://hiveci.io/docs/what-hive-is
Language: en

Hive runs jobs — CI/CD pipelines, test suites, builds, ad-hoc work — as Kubernetes Jobs across a fleet of clusters. A **run** is a DAG of **tasks**; each task executes in a container on whichever runner the scheduler picks.
You define pipelines in **Starlark** (`.hive/main.star` in your repo), not YAML. Starlark is a real language with functions and conditionals, so a pipeline can compute its own shape — which is how changed-file-aware pruning works: the DAG for a docs-only commit is smaller than the DAG for a migration.
## What it is not
It is not a replacement for your coding agent. Hive runs *alongside* Claude Code, Cursor, Codex, and GitHub Actions — it is the thing that executes and gates the work, not the thing that writes it. Repositories commonly keep their existing Actions workflows while adopting Hive for the parts that need a real fleet.
## The pieces you will meet
| Thing | What it is |
|---|---|
| **Project** | One repository, registered with Hive |
| **Pipeline** | A named DAG defined in `.hive/main.star` — e.g. `ci` |
| **Run** | One execution of a pipeline, at one commit |
| **Task** | One step of a run, one container |
| **Tenant** | Your organisation. Everything above belongs to exactly one |
| **Runner / cluster** | Where tasks actually execute |
## Tenancy, briefly
Your tenant is the outermost boundary. Projects, runs, users, clusters, secrets and credentials all carry a tenant, and a token issued to your tenant sees only your tenant's rows — another tenant's run id answers `404`, not `403`, because the existence of their data is not yours to learn.
See `security-and-isolation` for what that guarantees in detail.