01
Daemonless container cells
Your code runs as a plain Linux process under cgroups v2 with an ext4 rootfs. There's no heavy Docker daemon sitting between you and the kernel.
hubcell runtime
Platform overview
Every infrastructure layer,in one platform.
Deployments, isolated networking, persistent storage, image registries, team access control, and billing aren't separate tools stitched together. They operate seamlessly inside a single project boundary.
Project workflow01 / 03
01
SourceProject network
02
ControlRuntime control
03
ReleaseRelease path
Hubfly space projectNetwork · volumes · domains · team access
One project model
01
9
Integrated components
Dashboard, runtime, CLI, builder, proxy, scheduler, files, SDKs, dev kit
02
5
Deployment sources
Git, OCI image, template, Dockerfile, CLI upload
03
2 min
Metering granularity
Usage buckets across compute, memory, storage, and GPU
04
7
Linux namespaces per cell
PID, mount, net, UTS, IPC, user, and cgroup isolation
Compute
Containers that sleep when idle and wake on demand.
Compute engineered for efficiency — automatic scale-to-zero, live resource resizing, and supervised process restarts without an underlying daemon.
02
Scale to zero
Containers pause when traffic stops, dropping CPU and RAM usage to zero. When a new request arrives, our edge holds it briefly while the cell wakes right back up.
Default 15 min idle
03
Live vertical autoscaling
Bump memory limits on the fly via cgroup v2 without restarting, and let your rootfs grow seamlessly in place with resize2fs while the cell is live.
No redeploy
04
Services and jobs
Keep long-running services alive with supervised automatic restarts. For database migrations or batch scripts, run them as one-off jobs that clean up when done.
05
Interactive shell and exec
Jump into a real PTY terminal inside your live container over WebSocket, trigger quick one-line commands, or stream stdout and stderr live to your console.
hubfly ssh · logs -f
06
Encrypted secrets
Secret variables are encrypted with AES-256-GCM using unique nonces and versioned keys. They stay encrypted until decrypted in-memory right at boot.
Networking
Private by default, exposed only when you say so.
Containers within a project communicate over an isolated network. Public access, custom domains, TLS certificates, and load balancing are explicit choices.
01
Private by default
Containers inside a project talk securely over an isolated internal network. Nothing touches the public internet until you explicitly open a port.
02
Custom domains with automatic TLS
Verify your domain with a quick DNS record or HTTP check. We handle issuing Let's Encrypt certificates and auto-renewing them 30 days before they expire.
Wildcards via ACME DNS-01
03
Layer-7 load balancing
Distribute incoming traffic using round-robin, least-connections, or IP-hash routing, complete with weighted target distribution for seamless canary deploys.
04
Active health checks
Set custom probe paths and test intervals. If a container stops responding healthily, it gets pulled from the load balancer pool automatically.
05
Raw TCP and UDP
Reserve dedicated public host ports for non-HTTP workloads like Postgres, Redis, gRPC endpoints, or multiplayer game servers.
06
Local-to-cloud tunnels
Connect directly to private containers from your local machine over an encrypted WebSocket tunnel handling up to 64 multiplexed streams — no public port needed.
hubfly tunnel
Edge
Smart edge proxying in every region.
Caching, firewall protection, rate limiting, and request tracing run right at the regional edge ingress so protection is built-in.
01
Stale-while-revalidate caching
Our edge proxy serves instant cached responses to users while silently revalidating in the background. Instant cache purges work across site, path, or domain.
02
Edge firewall
Protect your apps with IP allow/deny lists, request rate limits, bot filtering, and circuit breakers that cleanly throw 503s before failures cascade.
03
Request tracing headers
Every single response includes a unique request ID and Server-Timing metadata, giving you total visibility into backend latency and proxy overhead.
X-HubProxy-Request-Id
Storage and registry
Data and container images that outlive deployments.
Managed persistent volumes for stateful applications paired with an isolated per-project image registry that scans code on push.
01
Persistent volumes
Attach high-speed block storage anywhere in your container's filesystem. Volumes easily survive restarts, updates, and reattaching across containers.
02
Performance tiers
Pick between standard, balanced, or high-performance IOPS options to match whether you're serving static assets or handling heavy DB writes.
03
Scheduled S3 backups
Backup your persistent data automatically by piping encrypted volume snapshots directly to your own S3-compatible storage on a set schedule.
04
Private image registry
Every project gets its own private, isolated OCI registry namespace. Version-tag and store images generated from our builder or your custom CI pipeline.
05
Vulnerability scanning on push
Trivy and Govulncheck inspect every image push automatically, flagging affected packages, installed versions, and exact patch releases.
Critical → Low severity
06
Scoped registry tokens
Generate pull-only, push-only, or full-access API tokens for external CI/CD systems, along with short-lived pre-signed download links.
Developer tools
A terminal-first developer experience.
Deploy apps, establish local tunnels, run remote commands, and stream live logs directly from your command line or code using our SDKs.
01
Interactive CLI
Manage workloads right from your terminal with a clean Go CLI. Explore projects, track live container stats, launch SSH shells, and manage active tunnels.
hubfly projects
02
Zero-config builds
Our build system auto-detects Node, Bun, Go, Python, Java, PHP, and static projects straight from manifest files — or defaults to your custom Dockerfile.
03
Compose orchestration
Spin up multi-container applications using standard `docker-compose.yml` files, respecting start dependencies and health check conditions.
depends_on conditions
04
Deploy webhooks
Trigger automated deployments from external systems using secret webhook URLs protected with HMAC-SHA256 signatures and IP filtering.
05
Official SDKs
Programmatically deploy apps, inspect project states, configure custom domain routing, and manage active tunnels using native TypeScript and Go SDKs.
06
Web file explorer
Browse, edit, upload, download, and compress files directly inside your persistent volumes from the dashboard using scoped sharing sessions.
Teams and governance
Multi-tenant control built for real organizations.
Granular role-based access, scoped API tokens, detailed audit trails, spending caps, and kernel-level tenant isolation for growing teams.
01
Six organization roles
Assign clear permissions — Owner, Admin, Developer, Operator, Billing, or Viewer — ensuring team members only access what they need.
02
Audit logging
Track sensitive org operations with rich audit trails recording the user, target resource, IP address, user agent, and API request ID.
03
Project-pinned access tokens
Issue granular access tokens scoped strictly to specific project IDs so a leaked CI key can never touch other workloads.
04
Built-in LMS
Manage computer science courses, term semesters, lab assignments, student cohorts, and join codes with direct instructor access to student projects.
05
Budget caps
Set strict monthly, term-based, or one-time spending limits that halt workloads when reached, keeping department or client budgets safe.
06
Kernel-level isolation
Isolate workloads using seven distinct Linux namespaces, unprivileged root UID remapping, dropped kernel capabilities, and 33+ blocked syscalls.
One product
Stop juggling multiple cloud services.
Projects, deployments, persistent storage, team permissions, and networking combined in a single coherent model — with pricing you can easily calculate in advance.