Source: https://crabglamp.com/docs/plain-vms/tutorial/get-started
Last updated: 2026-06-11
Type: tutorial

A Plain VM is a bare Linux machine you SSH into directly. No Docker image, no code-server, no managed IDE. You pick the tier, region, and OS image; we provision a Hetzner Cloud server with the public key from your Vault and hand you the IP.

## Add a public key to your Vault

Open `/dashboard/vault` and click **Add key**. The Vault stores OpenSSH public keys per account. v1 holds public keys only — no private keys, no other secret types.

Paste a single-line OpenSSH public key:

```sh
cat ~/.ssh/id_ed25519.pub
```

The Vault accepts `ssh-rsa`, `ssh-ed25519`, `ecdsa-sha2-nistp256/384/521`, and the hardware-key types `sk-ssh-ed25519@openssh.com` and `sk-ecdsa-sha2-nistp256@openssh.com`. It rejects malformed keys at submit and shows you the fingerprint so you can compare against your local `ssh-keygen -lf`.

Give the key a label like `laptop-2026` and click Save. The key is now available to any Plain VM you create on this account.

## Create a Plain VM

Click **Plain VMs** in the sidebar, then **Create VM**.

Fill the form:

- **Name** — lowercase letters, digits, hyphens (example `box-1`). This is also the VM's hostname.
- **Tier** — small, medium, or large. See [the Plain VMs reference](/docs/plain-vms/reference) for vCPU, RAM, and disk per tier per region.
- **Region** — US (Hetzner US data center) or EU (Helsinki).
- **OS image** — Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, Debian 13, Debian 12, Fedora 43, Rocky Linux 10, or AlmaLinux 10. Default is Ubuntu 24.04 LTS.
- **Access method** — select one or more SSH keys from your Vault, and/or enable a **generated one-time password**. At least one is required.
- **Billing** — pay-as-you-go (metered by hours, running and stopped both bill) or subscribe-and-save (one flat monthly rate per cell).

Click **Create plain VM**. The card shows status `provisioning`. Provisioning takes about a minute. Once the card flips to `running`, the **IP** column shows your public IPv4.

## Connect via SSH

Open a terminal and run:

```sh
ssh {default-user}@{public-ipv4}
```

The default user depends on the OS image — Ubuntu uses `ubuntu`, Debian uses `debian`, Fedora / Rocky / Alma use `root`. The create-success view shows the exact user so you do not have to guess. The Vault key you attached is authorized for that user; no password is needed unless you enabled the one-time password option.

Run a smoke test:

```sh
uname -a
df -h /
ip addr show eth0
```

You now have a bare Linux box. Install whatever you want — apt, dnf, custom builds. Stopped time still bills the same as running because Hetzner charges either way; if you do not need it, open the VM's settings page and **destroy** it.

## Open one firewall port

By default the per-VM firewall allows inbound SSH on port 22 and nothing else. To open port 80 for an HTTP server you are testing, open the VM detail page and click **Add rule**:

- **Protocol** — tcp
- **Port** — 80
- **Source IPs** — `0.0.0.0/0` (anywhere) or restrict to your IP

Click Save. The rule is live within a few seconds.

## What is next

Read [the Plain VMs reference](/docs/plain-vms/reference) for the full list of tiers, OS images, and per-VM limits. To open or close additional ports, follow [Add a firewall rule](/docs/plain-vms/how-to/add-a-firewall-rule). To understand the isolation model and what is logged, read [Isolation and logging](/docs/plain-vms/explanation/isolation-and-logging).