Push to deploy through a managed HostPack → Docker → Traefik pipeline, run managed databases with automated restore-drills, and capture the whole box — brain, every database, volumes, config — into one encrypted image you can restore, clone, or relocate to a fresh VPS (new IP) in one click. Your data, your bucket, your exit — always.
The same control plane runs our managed hosting and licenses onto any VPS you already own. Both deploy your apps, protect your data, and keep it portable — never trapped.
Buy a managed VPS from us and the whole stack is baked in: push-to-deploy, managed databases, backup, clone and one-click relocate. Portability on by default — the no-lock-in differentiator.
Install the agent on Hostinger, Hetzner, DigitalOcean, Vultr, AWS or bare metal. License-gated, fleet aware, and tied to no provider — you get the deploy pipeline, restore-drills and painless DR anywhere.
Most panels stop at a SQL dump. Provider snapshots give you a disk image on a new IP — which the panel promptly breaks. There's no first-party way to move a whole box. That's the gap HostSSH fills.
A managed HostPack → Docker → Traefik path takes your repo to a live, TLS-terminated URL — no Nix, no Dockerfile required, no hand-wired reverse proxy.
HostPack inspects your repo, picks the runtime and produces a lean, reproducible OCI image — Node, Python, Go, Rust, static and more. No Dockerfile to maintain, no Nix to learn.
The image runs as a supervised Docker container with health checks, sealed-secret injection, resource caps, persistent volumes and rollback-on-failure so a bad build never takes you down.
Traefikbinds your domain, issues and renews Let's Encrypt TLS (HTTP-01 or DNS-01 for zero-downtime cutovers and wildcards), and load-balances traffic. Routes are declarative, so a relocated box re-binds automatically.
From the first deploy to a 3am disaster recovery — capture, restore, relocate, provision and prove it, all from one control plane or one Go binary.
HostPack builds it, Docker runs it, Traefik routes it. Push to ship, with health checks, secrets and one-click rollback.
Provision Postgres, MySQL or Redis in a click — with connection strings, scheduled backups and point-in-time-style restore wired in.
The whole box — platform brain & master key, every database, Docker volume data, system config & sidecars — not just a SQL dump.
We restore your backups into a throwaway sandbox on a schedule and verify them to the row — so you know recovery works before you need it.
A deterministic pass flips every public reference; internal services ride a stable WireGuard overlay — so a moved box just works.
Spin up targets across Hostinger, Hetzner, DigitalOcean, Vultr or AWS from one queue — or bring your own machine and get every feature.
Images sealed before they leave the host. R2, S3, MinIO, B2, Wasabi, SFTP or local — you own the storage, zero-egress restores.
ed25519 license tokens unlock features per tier; the control plane keeps every agent and server in one fleet view — even across providers.
One Go binary drives everything; an MCP server lets your AI agents deploy, back up, clone & migrate just by asking.
Pack apps onto a box with hard CPU/memory/PID caps in four sizes — a real isolation unit you can meter, place, and move between machines.
Default-deny firewall, hardened containers, brute-force protection and a live security score — with an armed auto-revert so you can't lock yourself out.
Auto uptime monitors on every routed domain, plus disk, backup and cert watches — that page you on Slack, PagerDuty, webhook or email, not just draw a red dot.
Keyless, recorded, audited root access from the browser through an mTLS relay — the box stays locked down and still easy to get into when you need it.
A real capture → restore round-trip across a live fleet: a whole data box cloned onto a fresh server, every database verified to the row — the same drill we now run for you on a schedule.
Built by Sevak Girard at Girard Media and dogfooded on our own production fleet — the deploy, backup, and relocate paths run our real servers before they run yours.
You pay for the software; storage stays on your own R2/S3/B2. No surprise egress, no data hostage — emergency restores work even on an expired license.
One command installs the agent, prompts for your license key, and unlocks the deploy pipeline, managed databases, backup, clone, relocate & Web-SSH — on any provider.
$ curl -fsSL https://get.hostssh.com | shHostSSH is in private build, dogfooded on a real production fleet. Get on the early-access list and we'll bring you in.