Your own machines

How it works

You install one container, the HostStack agent, on the machine. It dials out to HostStack and everything rides that connection: deploys, logs, metrics, the terminal and your visitors' requests. Nothing on the machine listens on the network for us, so there's no port to forward, no fixed IP to have and no firewall to change.

Requests arrive at HostStack's edge, get their HTTPS certificate there and are carried down to your machine. That's why a dev box on a laptop still has a working dev URL, and a custom domain on a service running at home still works. Bind your app to 0.0.0.0, not localhost, or nothing outside its container can reach it.

Your machine only ever runs your team's workloads. It is never a placement target for anyone else's.

Working on the same computer

When your browser runs on the same computer as the dev box, its terminals and Browser tab connect straight to the agent over this computer's loopback address instead of going through HostStack. Keystrokes don't travel to a data centre and back, and the browser view's video doesn't use your internet connection. Starting, stopping and permissions still go through HostStack; only the session's bytes take the short path.

The box's header shows Direct when this is happening and Relayed when it isn't. From a phone or another computer everything is relayed, the same as before.

• Chrome and Edge ask once before a page may reach apps on your device. Click Connect directly in the header, then allow it. After that it connects by itself.
• Firefox connects by itself; newer versions may ask once, the same way.
• Safari doesn't let a web page reach apps on your computer, so it always uses the relay.

Turn it off for one browser from the header's Direct / Relayed menu, or for the whole machine by starting the agent with HOSTSTACK_DIRECT_PORT=0. A Windows machine enrolled before this existed gets it with its next agent update.

Using the whole machine

A dev box on your own machine isn't held to a cloud plan. It can use two things a HostStack box never could, with no extra charge for either:

• All of the machine's memory. The box gets the machine's RAM minus a reserve for the system and the agent (15%, between 1.5 and 4 GB), instead of its plan's size. Boxes on the same machine share it. It applies to a running box straight away.
• The graphics card. Chrome, the dashboard's Browser tab, Playwright and Puppeteer draw on the card instead of the CPU, so canvas and WebGL pages, e2e tests and screen recordings run at full speed. On NVIDIA cards CUDA works too. Turning it on or off restarts the box once, because a card is attached when the box starts. Your files stay put and agent tabs reopen on their own.

A new box on a machine gets both whenever the machine has them. Switch either one per box under Settings → General → Your machine's hardware, or with hoststack dev hardware <box> --gpu on. The Machines page shows which graphics card each machine has, or what it's missing. Inside the box, dev-gpu check renders a page in Chrome and tells you whether the card or the CPU drew it.

What the graphics card needs

On Windows, the memory a box can use is what WSL is given, which is half your RAM by default. To give boxes more, raise memory= under [wsl2] in %UserProfile%\.wslconfig and restart WSL.

If the card can't be attached when the box starts (say, a driver update is halfway through), the box starts without it rather than not at all, and the deploy log says why.

Requirements

• Linux on x86-64 with cgroup v2. Docker is installed for you if the machine does not have it — except inside WSL2, where the installer asks you to turn on Docker Desktop’s WSL integration instead.
• Windows has its own installer: a PowerShell line that drives Docker Desktop in Linux-container mode directly, with no WSL distro to set up.
• On macOS you run the Linux one inside a Linux VM — the Machines dialog hands you the multipass commands that create it.
• Apple Silicon and ARM boards (a Raspberry Pi, for instance) are not supported: the agent image is amd64 only.
• On Linux: root (the command runs under sudo), curl and about 5 GB free under /var/lib. The agent itself is capped at 2 GB of memory.
• A team can enrol up to 10 machines.

Enrol a machine

1. Add it in the dashboard

   Go to Machines in the sidebar and click Add a machine. Give it a name. You need to be a team owner or admin, with a verified email address.

2. Copy the command for your platform

   The dialog shows a one-line command with a single-use pairing token in it. The token expires after 15 minutes; pick Re-pair on the machine's row for a fresh one.

3. Run it on the machine

   The installer checks the machine, installs what's missing, starts the agent and prints what it changed. The machine shows as online on the Machines page once the agent has connected.

curl -fsSL https://hoststack.dev/api/agents/install.sh | sudo HOSTSTACK_PAIRING_TOKEN=... bash

# In an Administrator PowerShell, with Docker Desktop in Linux-containers mode
$env:HOSTSTACK_PAIRING_TOKEN="..."; iwr -useb https://hoststack.dev/api/agents/install.ps1 | iex

brew install --cask multipass
multipass launch --name hoststack --cpus 4 --memory 8G --disk 80G
multipass exec hoststack -- bash -c 'curl -fsSL https://get.docker.com | sudo sh'
multipass exec hoststack -- bash -c 'curl -fsSL https://hoststack.dev/api/agents/install.sh | sudo HOSTSTACK_PAIRING_TOKEN=... bash'

hoststack machines add office-desktop   # prints the Linux and Windows commands
hoststack machines list

Once it's online, pick the machine under Where it runs when you create a dev box, a service or a database — or pass --machine <name|id> to the CLI. A service or database stays on the machine it was created on; a dev box can be moved between HostStack and your machines later, from its Settings → General → Where it runs.

What the installer changes

On Linux, the installer reports every problem it finds before changing anything, and then:

• Installs Docker with Docker's own installer from get.docker.com if the machine doesn't have it. Set HOSTSTACK_NO_DOCKER_INSTALL=1 to install it yourself instead. Inside WSL it doesn't install Docker; it points you at Docker Desktop's WSL integration or the Windows installer. If Docker is installed but stopped, it starts it and enables it at boot.
• Runs one container, hoststack-agent, set to restart with the machine.
• Writes one credential file, /var/lib/hoststack-agent/agent.env, readable by root only.

On Windows, the PowerShell installer installs Docker Desktop with winget if needed, runs the same container and keeps the credential under %ProgramData%\hoststack-agent. Dev-box disks live inside Docker Desktop's Linux VM, not on your C: drive.

Uninstall

Remove the machine on the Machines page first (see Remove a machine), then on the machine:

docker rm -f hoststack-agent
sudo rm -rf /var/lib/hoststack-agent /var/hoststack/agent-auth
docker volume rm hoststack-agent-backups

Security

The machine never holds a storage credential. When it uploads a backup, HostStack signs a URL for that one file and that one upload.

For direct connections the agent listens on 127.0.0.1:9102, on loopback only, so nothing else on your network can reach it. A web page can't use it either. Each session needs its own ticket, which HostStack hands only to the browser that opened the session; a ticket works once and expires after a minute. The agent also has to prove who it is before your browser sends it a ticket or a single keystroke.

When the machine is off

This is the trade, and it differs by workload:

A machine counts as offline once its agent has been silent for about two minutes. If it was running a live service or a database, you're told once — in the dashboard and on your notification channels — and told again when it's back. A machine with only dev boxes on it goes offline quietly: a laptop lid closing in the evening isn't an incident, and a nightly notice is how a channel gets muted.

HostStack's own on-call isn't paged for your machine. Your hardware being off isn't a HostStack outage, and paging on it would make the same alert worthless where it does mean something.

Databases on your machine

A managed database can run on your machine too — pick it under Where it runs when you create the database; the machine has to be online. Postgres, MySQL, MariaDB, MongoDB and Redis all work, with the same dashboard, logs, metrics, query console, user management, backups and restores as on HostStack compute.

• Backups still leave the building. The nightly dump is taken on your machine at 02:00 UTC and uploaded to HostStack's off-site storage, so it survives the machine — a copy on the disk you're protecting isn't a backup.
• Volumes are backed up too, unless you say otherwise. Every dev box and service volume on the machine is archived off-site each night. For a big dev box whose code lives in git, that can be hours of the machine's disk for little gain, so the machine's page has a switch for it (or hoststack machines backups <machine> off). It covers the volumes already there and new ones; a volume's own toggle still overrides it. Databases are backed up either way.
• A missed night is caught up. A machine that's off at 02:00 takes the backup shortly after it next connects, instead of skipping to the next night. The database's Backups page shows when the last one really ran, and you can take one on demand while the machine is up.
• Large dumps are uploaded in parts, up to 32 GB compressed.
• No external connections. Publishing a database means an address at HostStack's edge, and your hardware isn't behind it. Connect from the machine, or expose it yourself on your own network.
• No high availability. An HA cluster is three nodes that must not fail together, and one desktop can't be that. Databases here are single-node.

Agent updates

HostStack offers the agent each new build when it connects and every 15 minutes after. The agent swaps itself over when it's idle: no deploy, database backup or agent task in progress, and no terminal open. If terminals stay open, the update goes ahead after about two hours anyway — but it never interrupts a deploy, a database backup or restore, or an agent task. The Machines page shows each machine's build; click Update now to not wait. You shouldn't need to re-run the installer.

A swap is kept only if the new agent starts and passes its own health check. If it doesn't, the machine goes back to the build it had — nothing on it is stopped and no data is touched — and the Machines page shows the error the machine reported. Read that before re-running the installer on a hunch.

An agent built from a local source checkout is never replaced automatically, since that would throw away whatever is in the tree. It shows as Running from source.

What it costs

€3/month per environment — each dev box and each service on your machines — with your first one free. There's no size price, because the size pays for our CPU and memory and here you bring your own. Databases on your machines cost nothing. Without a payment method on file you can run one environment on your own hardware.

Bandwidth HostStack carries is metered at the edge, at the same rate and against the same free allowance as everywhere else. Traffic on your own network isn't counted. See Billing.

If the bill goes unpaid

Environments past the free allowance are dunned like anything else: a notice, then seven days, and only then does anything change. What changes is different, though.

Nothing on your machine is stopped. HostStack stops carrying your traffic and closes the terminal — the parts the fee pays for. The container keeps running, the data is untouched, and anything on your own network still reaches it. Visitors get a page saying the site isn't available rather than a broken connection. Add a payment method and it's served again as soon as the payment clears, with nothing to redeploy.

Remove a machine

Removing a machine is refused while anything still runs on it. Delete those first, or move dev boxes back to HostStack compute. You can delete a service, database or box while the machine is off — its containers are cleaned up the next time the machine connects. Moving a dev box, though, needs the machine it's on to be online, because its files are copied off that disk.

hoststack machines remove office-desktop

Next steps

• AI dev environmentsWhat a dev box is, and everything that runs inside one.
• Managed databasesEngines, backups and linking — on our hardware or yours.
• BillingHow environments, bandwidth and the free allowance show up on the invoice.
• CLIhoststack machines, and --machine on every create command.