Your hardware, our control plane. A home PC, a NAS, a spare box or a VPS becomes a managed node without any of the networking work.

What you need

A machine with Docker
An outbound internet connection

That is the list. No static IP, no port forwarding, no router configuration, no dynamic DNS.

Works on Linux, and on Windows through Docker Desktop.

Before you start

Your store account and your panel account have to be joined, or nothing you buy raises a limit. See Connecting your account; it takes about thirty seconds and you do it once.

How it works

In the panel, add a node. You get a deploy snippet - a small compose file with the values for this one machine already filled in.
Run it on your machine.
The node opens an encrypted tunnel outward, proves who it is, and appears in the panel.
Create servers on it like any other node.

Nothing listens for an inbound connection on your side, at any point.

What your machine is given, and what it is not

This matters if you are the sort of person who reads before running someone else's compose file.

Your node receives a single-use enrolment token and a certificate fingerprint. It does not receive, and never holds:

the cluster secret
the panel's signing key
the database password
any credential belonging to another node

Its identity is assigned by the server and is not your hostname, so it cannot be guessed. Every reconnect proves possession of a per-node secret without sending it. Its access to the coordination bus is scoped to its own keys: a node cannot read or write anything belonging to a neighbour.

If the machine is lost, its credentials are worth nothing anywhere else.

Joining is gated before authentication

Admission is checked before any credential is looked at: an address allowlist and a join toggle. A machine that is not supposed to join is turned away before the question of whether it has a valid token even arises.

The join window can be one-shot, so it consumes itself after a single successful enrolment and closes behind you.

Files

Nodes that join this way use Beam and cannot fall back to SFTP - there is no address for an SFTP client to connect to. If your desktop is on the same network as the node, Beam finds the direct path and transfers run at local speed.

Suspension

If an account lapses, there is a grace period, and then the tunnel is cut, not just the panel login. Your data stays where it is - on your machine - and the node reconnects on its own once the account is active again.

Cost

You supply the compute, which is the expensive part, so this is cheaper than renting a server from anyone. You pay for the address and the traffic that runs through it. See the pricing page.

Bring your own node