Storage and registry

State that outlivesthe container.

Managed block volumes for databases, uploads, and caches — and a private image registry that checks what you push before it ever runs in production.

Get Started See pricing

Project workflow01 / 03

SourceLive resizing

ControlScanned on push

ReleaseBacked by S3

Hubfly space projectNetwork · volumes · domains · team access

One project model

Persistent volumes

Storage that survives the redeploy.

Containers are disposable; your data should not be. Volumes are backed by host ext4 filesystems and stay put across restarts, rebuilds, and version changes.

Mounted where you need it

Attach a volume to any path inside a container — /var/lib/postgresql/data, an uploads directory, a cache — read-write or read-only.

Resize without downtime

Grow capacity on a running cell. The ext4 filesystem expands in place, so there is no unmount, no migration, and no restart.

Scheduled S3 backups

Set a snapshot schedule and encrypted backups upload to external S3-compatible object storage on their own.

Detach and reattach

Move a volume from one container to another inside the same project and region — useful when replacing a service rather than its data.

Named volumes in compose

Declare volumes in a docker-compose.yml and share them across services in the stack exactly as you would locally.

Read-only mounts

Mount shared asset directories read-only so a compromised or misbehaving service cannot write to them.

Performance tiers

Match IOPS to the workload.

A logs directory and a write-heavy Postgres do not need the same disk. The tier multiplies the base storage rate, so you only pay for the profile you pick.

Tier	Multiplier	Per GB / hour	Typical use
Standard	1.0×	$0.00001536	Ideal for application logs, static files, backups, and low-traffic sites.
Balanced	1.5×	$0.00002304	Great for general-purpose databases and read-heavy workloads.
High Performance	2.0×	$0.00003072	Built for transactional Postgres and MySQL under heavy write operations.

Standard

Multiplier: 1.0×
Per GB / hour: $0.00001536
Typical use: Ideal for application logs, static files, backups, and low-traffic sites.

Balanced

Multiplier: 1.5×
Per GB / hour: $0.00002304
Typical use: Great for general-purpose databases and read-heavy workloads.

High Performance

Multiplier: 2.0×
Per GB / hour: $0.00003072
Typical use: Built for transactional Postgres and MySQL under heavy write operations.

Cost is estimated before you create a volume, so there is no surprise on the first invoice.

One volume, many consumers

Managed volume

Persistent block storage · survives redeploys

Postgres

Uploads

App state

Volumes attach to single containers or to services inside a compose stack, and can be detached and moved between them.

Private registry

An OCI registry scoped to the project.

Every project gets its own registry namespace on the regional node. Images from the build engine and from your external pipelines live in the same place, with the same scanning applied.

One namespace per project

Images built by the platform or pushed from your own CI are version-tagged inside an isolated registry namespace scoped to the project.

Scanned on push

Trivy and Govulncheck run as images arrive, reporting severity, the affected package, the installed version, and the version that fixes it.

Critical · High · Medium · Low

Scoped access tokens

Issue pull-only tokens for external servers, push-only tokens for CI, full access where needed, or time-limited pre-signed URLs.

Retention and auto-cleanup

Keep the last N tags and purge builds older than a threshold, so historical layers do not quietly become the biggest line on your bill.

Registry webhooks

Fire a webhook on image push, tag creation, or scan completion to drive downstream jobs and notifications.

Encrypted external credentials

Credentials for pulling from private third-party registries are stored encrypted, not as plaintext environment variables.

Tokens narrow enough to hand out.

A CI pipeline should be able to push an image and nothing else. Each token carries an explicit permission so credentials leaking from a build log cannot be used to pull your whole registry.

Scope	Permission	Typical holder
pull	Read-only image pulls	External servers and Kubernetes clusters
push	Push-only, cannot read	CI pipelines like GitHub Actions and GitLab CI
push_pull	Full read and write	Trusted internal automation
signed_url	Time-limited download URL	Sharing a single artifact without a token

pull

Permission: Read-only image pulls
Typical holder: External servers and Kubernetes clusters

push

Permission: Push-only, cannot read
Typical holder: CI pipelines like GitHub Actions and GitLab CI

push_pull

Permission: Full read and write
Typical holder: Trusted internal automation

signed_url

Permission: Time-limited download URL
Typical holder: Sharing a single artifact without a token

Findings arrive with the fix.

A scan that only tells you something is wrong creates work. Reports name the package, the version you have, and the version that resolves it — so the next step is obvious.

ci · docker push

# push from your own CI

$ docker login registry.hubfly.space -u project-token

$ docker push registry.hubfly.space/edge-api/web:2026.7.1

Scanning image with Trivy and Govulncheck

CRITICAL 0 HIGH 1 MEDIUM 4 LOW 12

HIGH openssl 3.0.11 -> fixed in 3.0.13

Webhook dispatched · scan.completed

Web file explorer

Look inside a volume without a shell.

Sometimes you just need to check whether a file landed. The embedded file browser opens volumes in the browser with an editor, previews, and archive tools.

Browse and edit

Upload, download, rename, delete, and edit text with syntax highlighting.

Remote protocols

Browse local filesystems as well as SMB network shares and FTP servers.

Scoped share sessions

Generate time-limited tokens with read-only, upload, edit, or delete rights.

Storage

Give your data somewhere to live.

One GB of persistent storage is included on the free tier, and volumes grow live when the workload does.