kstack

Yes — Debian stable nodes with cgroup v2. A node takes a role (`web`, `database`, `mail`, `dns`, `backup` or `analytics`) and the agent converges it. You do not hand us the hardware.

Nodes keep serving. They hold their manifest, and the sites on them do not depend on the control plane being up — which is the whole point of the agent **pulling** rather than the panel pushing.

Never. The control plane writes desired state to PostgreSQL and returns. Agents fetch a versioned manifest, observe what is actually on the box, plan the difference, validate it against a staging render, apply it and report back. There is no remote command channel to compromise.

The next reconcile cycle puts it back, and the change appears in the report. Configs are never edited in place — a new one is rendered beside the old, validated, then swapped, with the previous version kept for rollback.

The panel is a client of the public API and uses **no private endpoints**, so anything it can do is available to you. That is a design rule rather than a roadmap item.

kstack implements no billing at all, so you need something. Zephyr is built to its provisioning contract and needs no integration work. Anything else means writing against the provisioning API yourself, which is public and documented.

The **website** is the isolation unit, not the account: one unprivileged, id-mapped system container per site. A customer with five sites has five boundaries, so a compromise of one does not reach the other four. Databases are deliberately not per-customer containers — they are shared instances with a per-customer database, user and grants, because a container each would hold the same engine in memory once per customer.

Shipping it means a PHP application with one of the longest CVE histories in hosting, on your own domain, holding database credentials, as a second authentication surface beside the panel. kstack has its own database manager that runs every query **as the tenant**, so the engine’s privileges are the boundary and there is no second surface.

Through the same signed release edge as the other products — licence-gated, Ed25519-signed, and verified against a pinned key before anything is swapped in. Anything unverified is refused and the box stays on the release that works.