What the server needs

One server or VM does it: Ubuntu Server 26.04, 4 cores, 17 GiB of RAM, an empty second disk and no inbound ports. The install checks every line on this page before it changes anything, and prints the fix for each line that fails. Install the node shows how to run those checks alone, days before you install.

The server

• A server for the node alone. detachbox-node-host runs as root and carries out commands the detachbox server signs, so the node takes all of it. Nothing of the same kind runs beside it: no Docker, no LXD, no Incus or cloudflared of your own, no other ZFS pool. The check lists anything it finds with the command that removes it.
• Ubuntu Server 26.04 LTS on x86_64 (amd64), booted with systemd and cgroup v2, its root filesystem on ext4 or xfs, not ZFS. A VM in your hypervisor or your cloud account does as well as hardware.
• 4 CPU cores or more. Two stay with the system; every other core runs your terminals.
• 17 GiB of RAM at the very least; 64 GiB and more is where the node pays off. 8 GiB stay with the system and the base image build. The ZFS cache takes a sixteenth of the RAM, rounded down to a power of two, between 1 and 16 GiB. Your terminals get the rest, and the check prints the split for your server.
• Secure Boot off, or the DKMS key enrolled. Ubuntu 26.04 ships ZFS 2.4.1, which loses blocks written with deduplication, so the installer builds OpenZFS 2.4.4 and its kernel module on the server. The headers of the running kernel must be in apt.
• A synchronised clock (NTP, UDP 123). The node accepts the server's requests only within 60 seconds of its own clock.

The disk

The node's ZFS pool needs a second, whole, empty disk of 100 GiB or more. 70 % of the pool becomes your account disk. The rest holds each terminal's system disk, the base images and the free space ZFS needs to stay fast. The pool runs lz4 compression, deduplication and autotrim.

The installer refuses a disk with a partition table, a filesystem, an LVM, RAID or ZFS label, or anything mounted. It never destroys data and has no force flag. If what is on the disk does not matter, wipe it yourself first:

sudo wipefs -a /dev/sdb            # the disk you give the pool
sudo zpool destroy <pool>          # first, if the disk belongs to a ZFS pool

The network

The node needs no inbound port. Every connection it makes goes out:

The node rebuilds its base image every 6 hours, so these hosts stay in use after the install.

Give the terminals the same outbound internet a developer's laptop gets: agents call their model providers, and builds pull from package registries.

Let these hosts through without TLS inspection. node-host and cloudflared accept only certificates of public authorities, and when something in between re-signs the traffic, the check names the authority it got.

Your engineers' browsers reach the dashboard at my.detachbox.com and api.detachbox.com, and the node's own addresses under detachbox.dev, which What terminals reach lists.

The token

The install takes an enrollment token from your detachbox contact. It works for one server and one install. A server has 7 days to enroll with it, and after enrolling the token takes reruns of that install for 7 more days. A new token replaces the old one.