Everything a tenant needs to know, on one page.
ssh shell@ssh.shellac.sh
Always the user shell. The gateway looks up your SSH key, starts your microVM if it is not
running, and drops you into it as yourself. The first login after a while takes a few seconds while the
machine boots. Register more keys from inside: ~/.ssh/authorized_keys is not consulted; use
the console link the gateway prints, or ask.
Debian (trixie, minimal) with the usual tools: bash and zsh, tmux, vim and nano, git, python3, a C
toolchain, curl and jq, ssh, nmap and the DNS tools. Install nothing system-wide: there is no root and the
root filesystem is thrown away at every boot. Build into ~/.local; language toolchains that
install into your home work as they do anywhere.
| New account | Tenured (30 days in good standing) | |
|---|---|---|
| CPU | 1 | 2 |
| Memory | 512 MiB | 2 GiB |
| Home | 1 GiB | 10 GiB |
| Outbound HTTPS | 1 GiB / day | 20 GiB / day |
Your home is a ZFS volume on mirrored disks, snapshotted and backed up nightly, encrypted, off the machine. The machine stops when you log out and nothing is running; long-running jobs need a tmux session, and idle machines are stopped after a while.
Outbound only, to an allowlist: HTTPS to Debian mirrors, GitHub, Codeberg and sourcehut; git over SSH to the same hosts; IRC to Libera and OFTC. Nothing else leaves, and no port on your machine is reachable from outside. Port scanning is detected by pattern and cuts your network for an hour; doing it again costs standing. Outbound mail does not exist here and will not.
Whatever you put in ~/public_html is served at https://you.shellac.sh/: static
files only, from a read-only snapshot refreshed every five minutes, with a modest speed and connection cap
per site. The server reads your files as another user, so the directory and the files must be world-readable
(chmod o+rx ~/public_html; chmod -R o+rX ~/public_html); a file that is not gets a 403 that says
so. No server-side code, no custom domains for now. Delete your account and the site is gone with it.
The rules are short. Most problems are caught by software and answered in proportion: a throttle first, then a freeze a person decides on, then a suspension with 30 days to appeal, and deletion only for the things nobody argues about. Complaints reach a human within 48 hours.
What is stored about you is in the privacy policy: your sign-in identity, your keys, login times and addresses for 90 days, and the standing record that decides your limits. You can delete your account from the console; the home volume and its backups follow within the retention period.
Every piece of this service is code in one repository, applied to the machines by a reconciler that refuses anything a human has not signed. The hosts are reimaged, never patched in place; the images are built and signed by CI; the rules above are files anyone with access to the repository can read. A transparency report is published for each period.