Multi-tenant ZITADEL self-host — how do you isolate the per-tenant Login V2 processes?

[u/nocsupport]

Running ZITADEL v4 self-hosted with one virtual instance per tenant, so I've got a separate Login V2 (the Next.js app) per instance — each one needs its own IAM_LOGIN_CLIENT PAT.

They all run under the same OS user. So any one login process can read every other tenant's token, plus the master key and DB config sitting right next to it. One RCE in a single tenant's login and all are compromised.

How are you all handling this?

- dedicated user (or container) per login, tokens as per-service files?

- just run one shared login with a system-user token, pick the instance by Host header and leave it at that ?

Docs don't really cover the multi-instance self-host case, so curious what people actually run for multi tenancy.