Platform
Applies to every guest, not one stack.
Pro and Business upgrades bill through Stripe
- Paid plans go through Checkout. Hobby stays free for a day on a generated URL.
Business domains must point here first
- Verify only after a CNAME to the platform target (or an address we published).
- Opening the check file on a pending host does not attach the domain.
Hobby time ends on the next visit
- When the clock runs out, the next request stops the app. You do not wait for a later sweep.
Fleet signals for every guest
- The host samples CPU, memory, disk, and process counts for each live app.
- Overview shows per-app usage. /ops/ lists every guest on the node plus a JSON brief for review.
Site detail shows live usage
- Each app’s manage page lists CPU, memory, storage, time left, stack, and the upload address.
- Container apps are sampled from the host. Static HTML is in-process, so CPU and memory are not per-site.
Guest apps are isolated
- Each guest has no outbound internet.
- Visitors reach the site through the platform URL, not a raw host port.
- CPU, memory, process, and disk caps apply to every guest.
Upload gate tightened
- Archives are checked for zip-slip, zip bombs, symlinks, and oversized trees.
- Native binaries and installer files are rejected before extract.
Build scripts locked down
- npm / yarn / pnpm install without lifecycle scripts.
- Composer install without scripts or plugins.
Folder drops pack in the browser
- Loose folders are zipped before upload so large trees no longer fail as thousands of form fields.
- .venv, node_modules, and similar junk are skipped while packing.
Health checks no longer hang on app errors
- A site that answers HTTP is marked live even if the first page is an application error.
Static hosting
- In-process file serve. `index.html` or first HTML file.
Composer scripts disabled
- Composer install no longer runs scripts or plugins.
PHP + Apache
- `index.php` or `composer.json`. `public/` becomes the docroot.
Same Composer lockdown as PHP
- Artisan hooks do not run during `composer install`.
Laravel detection
- `artisan` + Composer. Apache document root `public/`.
Theme-only install finishes
- Core install now completes instead of stopping on the setup wizard.
- The database is used only after it accepts connections.
- Admin email is a valid address so install is not rejected.
- Must-use plugins attach after tables exist.
No outbound internet
- Theme and plugin directory installs from wordpress.org fail. Ship plugins in the upload.
Theme-only packs
- `style.css` Theme Name provisions a fresh site, activates the theme, logs admin credentials.
mu-plugins and WXR
- Must-use plugins copied after core install. Demo XML imported when possible.
Core and SQL restore
- Full core, `wp-config` rewrite, optional `*.sql` import, siteurl rewrite.
Start script no longer crashes before boot
- A template bug aborted Django deploys before the app started.
- Drops now reach image build and Gunicorn.
Missing imports added to requirements
- Common packages imported in the project are added when they are absent from requirements.txt.
Isolated Gunicorn
- No runtime outbound internet. WhiteNoise still serves `/static/`.
Runtime overlay
- WhiteNoise, collectstatic, migrate on start, inferred pip extras from imports.
Django detection
- `manage.py` wins over Flask/FastAPI.
Isolated Gunicorn
- App object inferred; no outbound sockets.
Flask detection
- Requirements or `Flask(` in app/main/wsgi.
Isolated Uvicorn
- ASGI on 8080. No outbound internet.
FastAPI detection
- Requirements or `FastAPI(` in main/app.
Ignore npm lifecycle scripts
- npm / yarn / pnpm install without lifecycle scripts.
Node detection
- package.json, lockfiles, engines, start/build inference for Next/Nuxt/Nest/Express.
Build reaches npm run build
- A config-template bug aborted React/Vite deploys before the image built.
Install scripts off, read-only live site
- Build still runs `npm run build`. The live site filesystem is read-only.
SPA pipeline
- React / Vite detected, built, served with index.html fallback.
Build reaches npm run build
- Same frontend image fix as React and Angular.
Same frontend limits as React
- Install scripts off. The live site has no outbound internet.
Vue detection
- `vue` dependency, build to static files.
Build reaches npm run build
- Same frontend image fix as React and Angular.
Same frontend limits as React
Svelte detection
- `svelte` or SvelteKit in package.json.
Build reaches ng build
- A config-template bug aborted Angular deploys before the image built.
Same frontend limits as React
- `ng build` output served as static files.
Angular detection
Isolated rails server
- No outbound internet. A secret key is generated at start.
Rails detection
- Gemfile + rails / application.rb / config.ru.
Unprivileged read-only process
- Static binary, no CGO, no uploaded binaries, read-only filesystem.
Go detection
- `go.mod`, optional single `cmd/` package.