Single-VPS Edition · Free & Open Core · Debian 12 / 13 & Ubuntu 22.04 / 24.04

The Linux VPS control panel engineered for zero bloat.

A single compiled Go binary using ~90 MB RAM. Manage Nginx, multi-PHP, Docker, MariaDB, mail, nftables with 60s lockout rollback, native systemd cgroup v2 isolation, and off-host age-encrypted backups—without hijacking your Linux config files.

root@vps-debian13:~#

$ curl -fsSL https://get.cloudbx.top/install.sh | sudo bash

Ed25519 signed release SHA256: 9f2c7a41…b03de41a x86_64 & ARM64

Idle Memory Footprint

90 MBRSS

Single compiled Go binary + SQLite WAL

Tenant Isolation

cgroup v2native

Hard MemoryMax & CPUQuota per site

Firewall & Lockout Guard

60sauto-rollback

nftables atomic apply + OWASP WAF

Disaster Recovery

age + v2signed

Off-host encryption key + automated drills

Config Ownership

100%native Linux

Clean drop-ins; zero proprietary lock-in

Complete Single-VPS Stack

Everything a production Linux server needs. Nothing it doesn't.

Most panels either force every app into heavy Docker wrappers or pollute your OS with brittle Python/PHP scripts. CloudBox orchestrates native Debian/Ubuntu packages with strict privilege separation.

systemd cgroup v2

Per-Site Cgroup v2 Resource Isolation

Every website and PHP-FPM pool runs inside its own dedicated systemd slice with enforced MemoryMax, MemoryHigh, and CPUQuota. A traffic spike or memory leak on one site is contained immediately without starving MariaDB or SSH.

site-shop.slice184M / 512M (CPU 24%)

age + Ed25519

Zero-Trust Off-Host Disaster Recovery

Backups are encrypted to an age public recipient whose private key never touches the server, signed with Ed25519 v2 manifests, and shipped to S3, Backblaze B2, or SFTP via root-owned rclone remotes. Automated restore drills verify archives on scratch disk.

Recipient: age1qz8w…h3r7k4m Drill Passed

nftables + WAF

Lockout-Safe Firewall & OWASP WAF

CloudBox manages its own table inet cloudbox in nftables. Any rule change affecting SSH or the panel port arms a 60-second dead-man timer that automatically rolls back if you don't confirm. Includes Fail2ban jails and Nginx OWASP ModSecurity CRS.

nft -c syntax validated 60s auto-revert armed

Nginx + Multi-Runtime

High-Density Web Server & Runtimes

Run WordPress/PHP sites (isolated PHP 8.1, 8.2, 8.3, 8.4 FPM pools per user), Node.js, Python, Go binaries, and static sites side-by-side. Automatic Let's Encrypt HTTP-01 & DNS-01 wildcard SSL certificates with HTTP/3 QUIC support.

Nginx 1.27 PHP 8.1–8.4 Node 22/24 Python 3.13 TLS 1.3

Docker + Compose v2

First-Class Docker & Compose Console

Inspect containers, live cgroup CPU/RAM gauges, overlay2 image layers, volumes, networks, and /opt/stacks/*/compose.yaml projects. Surfaces Docker-published ports that bypass host INPUT firewall rules.

/var/run/docker.sock /opt/stacks GHCR / Hub Auth

Mail + DNS + DB

Mail Server, BIND9 DNS & Databases

Full inbound/outbound mail stack (Postfix, Dovecot, Rspamd, automatic DKIM, SPF & DMARC records), authoritative BIND9 DNS server, and MariaDB 11.4 / PostgreSQL 17 / Redis 7.4 management with pre-restore rollback dumps.

Postfix + Dovecot Rspamd BIND9 MariaDB 11.4

System Architecture & Privilege Separation zero-dependency Go + HTMX + SQLite

Security by Design

The web UI never runs as root.

Legacy panels run their entire web server as root or grant NOPASSWD: ALL sudo rules to a web user. CloudBox splits the unprivileged control plane from a strict, schema-validated host agent over a Unix domain socket.

Unprivileged Web Control Plane vpspanel.service

Runs as dedicated low-privilege user _cloudbox with NoNewPrivileges=yes and ProtectSystem=strict. Serves server-rendered Go templ + HTMX views and stores state in panel.db (SQLite WAL).

Privileged Host Agent & Job Queue vpspanel-agent.socket

Accepts typed RPC commands over /run/vpspanel/agent.sock. Renders candidate configs, validates syntax (nginx -t, nft -c, sshd -t, named-checkzone), applies atomically, and records an immutable audit trail.

Standard Linux Drop-In Files No Lock-In

Writes clean, human-readable files in /etc/nginx/sites-available/, /etc/nftables.d/cloudbox.nft, and /etc/ssh/sshd_config.d/00-cloudbox.conf. If you ever stop CloudBox, every website and service continues running untouched.

Host Filesystem Layout & Memory Footprint Zero Proprietary Daemons

# Process & Cgroup Footprint on Debian 13 (Trixie)
$ systemctl status vpspanel.service vpspanel-agent.service
● vpspanel.service - CloudBox Panel Web UI (unprivileged)
     Active: active (running) · User: _cloudbox
     Memory: 64.2M (max: 256.0M) · CPU: 142ms
     Binary: /usr/local/bin/vpspanel (18.2 MB static Go binary)

● vpspanel-agent.service - CloudBox Privileged Host Agent
     Active: active (running) · Socket: /run/vpspanel/agent.sock
     Memory: 25.6M · Tasks: 6

# Clean, Auditable Host Configuration Paths
/etc/vpspanel/
 ├── config.yaml                 # Panel port, TLS, age public recipient
 ├── rclone.conf                 # Root-owned off-host storage remotes
 └── backup-signing.pub          # Ed25519 manifest verification key
/etc/nftables.d/cloudbox.nft     # Isolated 'table inet cloudbox'
/etc/ssh/sshd_config.d/00-cloudbox.conf
/etc/systemd/system/cbx-site-*.slice

98 Automated Release Gates

Every release is stress-tested against cgroup OOM kills, firewall lockouts, and atomic restore rollbacks in QEMU/KVM.

Deploy on your VPS →

Interactive Installer Generator

Customize your installation command

Select your target OS and optional stack components below to generate a tailored, idempotent setup command.

Fresh VPS Recommended Est. time: ~90s

1. Select Stack Components & Flags

Target Linux Distribution

Optional Stack Modules (Core Web + Nginx + Firewall + Backups always included)

PHP 8.4 FPM Runtime

--with-php=8.4

MariaDB 11.4 + Redis 7.4

--with-mariadb

Mail Server (Postfix/Dovecot/Rspamd)

--with-mail

BIND9 Authoritative DNS

--with-dns

Docker Engine + Compose v2

--with-docker

OWASP ModSecurity WAF

--with-waf

Panel HTTPS Port

Panel Hostname (Optional)

2. Run as root on your server

System Requirements & What Happens Next

Supported OSDebian 12/13 · Ubuntu 22.04/24.04

Architecturesx86_64 (amd64) · ARM64 (aarch64)

Minimum RAM512 MB RAM (1 GB+ with Mail/DB)

Minimum Disk10 GB SSD / NVMe

Kernel RequirementLinux 5.15+ (cgroup v2 + nftables)

Post-Install First-Boot Flow

One-time bootstrap URL is printed in your SSH terminal with a pinned TLS fingerprint.

Create admin account & enroll TOTP 2FA within 15 minutes before the bootstrap token expires.

Escrow your age backup keypair on your workstation so off-host disaster recovery is immediately armed.

Want to verify inside a local VM first? Works on QEMU/KVM & Hetzner/OVH

Technical FAQ

Questions sysadmins ask before running install.sh

Does CloudBox compile custom Nginx/PHP binaries or overwrite my manual Linux configs?

Never. CloudBox uses official Debian/Ubuntu apt packages (and Ondřej Surý's signed repository for multi-PHP when requested). It writes isolated drop-in files such as /etc/nftables.d/cloudbox.nft and /etc/ssh/sshd_config.d/00-cloudbox.conf, and actively detects configuration drift if you edit files by hand over SSH.

Why is the backup decryption private key kept off the server?

If an attacker compromises a server or its storage credentials, any backup key stored on that same server allows them to decrypt or tamper with your historical backups. CloudBox encrypts every archive to your public age1… recipient and signs the manifest with Ed25519. You keep the private key in your password manager—only needed when rebuilding on a clean host.

How does the 60-second firewall & SSH lockout rollback work?

Whenever you apply a firewall rule or sshd change that touches the panel port (:8443) or SSH (:22), the host agent schedules an in-memory revert timer before loading the new ruleset. If you can still reach the panel and click "Keep changes" within 60 seconds, the revision is committed to boot persistence; if you get locked out, you do nothing and the previous working ruleset restores itself automatically.

Can I run native Nginx/PHP websites and Docker Compose stacks on the same VPS?

Yes. Native sites run directly on the host with zero container overhead, while Docker containers and /opt/stacks/*/compose.yaml projects run alongside them. CloudBox's Exposure scanner even inspects both input and Docker forward chains so you never accidentally expose a container port like Redis (:6379) to the public internet.

Ready in 90 seconds

Take back control of your Linux VPS.

Deploy on any fresh Debian 12/13 or Ubuntu 22.04/24.04 server. Free Single-VPS Edition with no artificial site limits, no telemetry phone-home, and no subscription Nag screens.