A Plain VM is a bare Linux machine you SSH into directly. No Docker image, no code-server, no managed IDE. You pick the tier, region, and OS image; we provision a Hetzner Cloud server with the public key from your Vault and hand you the IP.
Add a public key to your Vault
Open /dashboard/vault and click Add key. The Vault stores OpenSSH public keys per account. v1 holds public keys only — no private keys, no other secret types.
Paste a single-line OpenSSH public key:
cat ~/.ssh/id_ed25519.pub
The Vault accepts ssh-rsa, ssh-ed25519, ecdsa-sha2-nistp256/384/521, and the hardware-key types sk-ssh-ed25519@openssh.com and sk-ecdsa-sha2-nistp256@openssh.com. It rejects malformed keys at submit and shows you the fingerprint so you can compare against your local ssh-keygen -lf.
Give the key a label like laptop-2026 and click Save. The key is now available to any Plain VM you create on this account.
Create a Plain VM
Click Plain VMs in the sidebar, then Create VM.
Fill the form:
- Name — lowercase letters, digits, hyphens (example
box-1). This is also the VM's hostname. - Tier — small, medium, or large. See the Plain VMs reference for vCPU, RAM, and disk per tier per region.
- Region — US (Hetzner US data center) or EU (Helsinki).
- OS image — Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Debian 13, Debian 12, Fedora 43, Rocky Linux 10, or AlmaLinux 10. Default is Ubuntu 24.04 LTS.
- Access method — select one or more SSH keys from your Vault, and/or enable a generated one-time password. At least one is required.
- Billing — pay-as-you-go (metered by hours, running and stopped both bill) or subscribe-and-save (one flat monthly rate per cell).
Click Create plain VM. The card shows status provisioning. Provisioning takes about a minute. Once the card flips to running, the IP column shows your public IPv4.
Connect via SSH
Open a terminal and run:
ssh {default-user}@{public-ipv4}
The default user depends on the OS image — Ubuntu uses ubuntu, Debian uses debian, Fedora / Rocky / Alma use root. The create-success view shows the exact user so you do not have to guess. The Vault key you attached is authorized for that user; no password is needed unless you enabled the one-time password option.
Run a smoke test:
uname -a
df -h /
ip addr show eth0
You now have a bare Linux box. Install whatever you want — apt, dnf, custom builds. Stopped time still bills the same as running because Hetzner charges either way; if you do not need it, open the VM's settings page and destroy it.
Open one firewall port
By default the per-VM firewall allows inbound SSH on port 22 and nothing else. To open port 80 for an HTTP server you are testing, open the VM detail page and click Add rule:
- Protocol — tcp
- Port — 80
- Source IPs —
0.0.0.0/0(anywhere) or restrict to your IP
Click Save. The rule is live within a few seconds.
What is next
Read the Plain VMs reference for the full list of tiers, OS images, and per-VM limits. To open or close additional ports, follow Add a firewall rule. To understand the isolation model and what is logged, read Isolation and logging.