Virtual machines_
A machine with root access, a public IPv4 address and your SSH keys from the start. You choose the plan and the operating system; everything inside is yours to run.
Create a machine
You need an SSH key on the account. Only account owners can create billed resources, and you may be asked to confirm your password and authenticator code if you signed in more than 15 minutes ago.
Recorded from the console and regenerated when the console changes. Sample data.
- Open Machines and choose Create VM. Give the machine a hostname: lowercase letters, numbers and hyphens, up to 63 characters. It names the machine in your console and inside the guest.
- Pick an operating system, then its version. Each shows the user it signs in as, for example ubuntu or debian, and boots with your SSH keys installed. (Bring your own ISO, the last card, is for installing something else yourself.)
- Choose a plan. Each card shows its monthly maximum, hourly rate and resources; the summary on the right follows your choices.
- Tick at least one SSH key. It is installed before the machine first boots.
- Leave Public IPv4 address on so you can reach the machine from the internet. An address is reserved from Fresh's pool; you cannot choose a specific one. Private network adds a second interface on your account's private network, where your databases live.
- Continue to review. Check hostname, image, plan, price, access and networking. Anything missing is listed under Finish setup to continue with a link to fix it; Edit configuration goes back with everything kept.
- Create VM. Without a saved card the button reads Add payment method, which takes you to Stripe to save one and then builds the machine automatically.
Follow the order
After you submit, the Setting up hostname page shows three stages: Payment method → Provision VM → Ready to use. It refreshes by itself; reloading never creates a duplicate.
| What the page says | What it means |
|---|---|
| Finish setting up your VM | The order is saved but no card is on file. Use Add payment method, or Cancel order. |
| Payment method confirmed | Fresh is preparing to build the machine. |
| Provisioning your VM | The machine is being built. Billing has started. |
| Your VM is ready | Done. The page opens the machine automatically. |
| Provisioning could not complete | The build failed. Fresh removes the machine and you are not billed. Start a new order. |
| Order ended | The order was cancelled or expired before anything was built. |
Connect
The machine's Overview tab shows four health signals and your connection details:
- Power: Building, Running, Stopped, Error or Unknown. "As requested" means it matches what you asked for.
- Guest network and SSH access: Fresh checks whether the machine's address answers and whether port 22 accepts connections. Wait for SSH access: Ready before connecting. These checks never log in.
- Last operation: the most recent task (Create VM, Stop VM, …) and whether it succeeded.
- Access: a ready-made SSH command with a Copy button, the public IPv4, and the fingerprints of the keys on the machine.
ssh <user>@<public-ipv4>Use the private key that matches one of the listed fingerprints. If your SSH client warns about an unexpected host key on first connect, don't accept it blindly: contact support.
Browser console. The Console tab gives keyboard-and-screen access without SSH, useful if you have locked yourself out of the network. Enable access for 30 minutes to 6 hours (confirming your password and code), then Connect. One person can view a console at a time; taking over disconnects the other. There are Send Ctrl-Alt-Del, Full screen, Extend access and Disable access.
Plans and images
| Plan | vCPUs | Memory | Storage | Monthly maximum | Hourly |
|---|---|---|---|---|---|
| Fresh 4 | 2 | 4 GiB | 40 GiB | £8 | £0.0119 |
| Fresh 8 | 4 | 8 GiB | 80 GiB | £16 | £0.0238 |
| Fresh 16 | 8 | 16 GiB | 160 GiB | £30 | £0.0446 |
Prices include VAT. Every plan includes one public IPv4 address and 100 Mbit/s each way, and can burst to 1 Gbit/s: up to 1 GiB at a time above 100 Mbit/s, refilled whenever the machine runs below it. Machines created before 17 October 2026 keep a flat 100 Mbit/s. Transfer is metered and shown, but not billed, and there is no allowance to exceed. There is no resize yet: to change plan, create a new machine and move your data.
Images come from a curated catalogue: Ubuntu, Debian, Fedora, Rocky Linux, AlmaLinux, openSUSE and FreeBSD, in the versions listed on the Images page. Each shows its architecture, minimum disk and the user it signs in as. Managed images are customer-managed: you own updates and backups inside the machine.
Start, stop, reboot
Power controls sit at the top of the Overview tab and change with the machine's state: Start when stopped, Stop and Reboot when running. Stop and reboot ask the operating system to shut down cleanly and wait up to a minute; if the machine is still running after that, it is powered off. Each action asks for confirmation and queues a task you can follow under Last operation or on the Activity tab.
- Buttons are hidden while another operation is running. Wait for it rather than repeating the action.
- A running machine is not necessarily reachable: check Guest network and SSH access.
- Stopping does not stop billing. A stopped machine keeps its CPU, memory, disk and address reserved, so it is billed at the same rate. Delete it to stop charges.
Owners, admins and members can start, stop, reboot and delete machines. People with the Billing or Read-only role see them but can’t change them.
Networking and public IPs
- The Network tab shows the public IPv4, MAC address, pool and gateway. A machine can only send traffic from its own address and MAC; anything else is dropped.
- Networking in the top navigation lists every public address attached to your machines. An address stays with its machine until the machine is deleted.
- Private network: machines created with it, and every managed database, share a private network that only your account can reach. Private traffic is free and outside the plan's speed limit.
- Reverse DNS for an address is set on the DNS page; see DNS and domains.
Removing a key from Settings → SSH keys stops it being offered for new machines but does not remove it from existing ones; do that inside the guest.
Firewall
Every machine has a firewall, off until you turn it on. While it is off, every port on the machine's public address accepts connections, so anything you run is reachable from the internet. The firewall runs on Fresh's host, outside your machine: nothing inside the machine, including root, can change it. You can still run your own firewall (ufw, firewalld, nftables) inside as well.
- Open the machine → Firewall tab → Turn on. The first time, it starts with two rules, SSH (TCP port 22) and Ping (ICMP) from anywhere, so you can't lock yourself out.
- Add a rule for each service you want reachable: choose TCP, UDP or ICMP, enter a port (443) or range (8000-8100), or leave it blank for all ports. Under Sources, list IPv4 addresses or ranges (203.0.113.7, 198.51.100.0/24), separated by commas, or leave it blank for anywhere. The SSH, HTTP, HTTPS and Ping buttons add the common ones from anywhere in one click.
- To restrict SSH to your office, add a TCP 22 rule from your address, then remove the one from anywhere.
- Changes apply to the running machine within a few seconds, without a restart. The tab shows Applying… until the host has them.
- While the firewall is on, new inbound connections are dropped unless a rule allows them. Replies to connections the machine makes, and all outgoing traffic, are always allowed.
- Removing a rule refuses new connections at once; connections already open stay up.
- It covers the public address only. Your private network only ever carries your own machines' traffic and isn't affected.
- Up to 50 rules per machine and 20 sources per rule. Turning the firewall off keeps your rules for next time. Fresh's host can always check port 22 for the SSH access signal on the Overview tab; nothing else gets in.
- If you lock yourself out, use the browser Console tab, or fix the rules here.
Owners, admins and members can change the firewall. Every change is recorded on the Activity page.
Usage and activity
The Usage tab charts network throughput, CPU and disk activity, and shows this month's transfer. These are for information: transfer is not billed. The top-level Usage page covers everything in your account (machines, apps and databases): transfer by day, the busiest outbound throughput over 24 hours against the 100 Mbit/s guarantee and the 1 Gbit/s burst ceiling, disk used, and CPU and memory at the 95th percentile, for a month, the last 7 days or 24 hours, with a CSV export. Traffic on your private network is counted separately and is free.
The Activity tab, and the account-wide Activity page, list what happened to the machine and who did it: created, started, stopped, deleted, failures. The account-wide page can be filtered by person, resource, type and date.
Bring your own ISO
Choose Bring your own ISO, the last card under Operating system, to install an operating system that is not in the catalogue. On the review step you provide an HTTP(S) URL to a bootable ISO of up to 16 GiB, an optional SHA-256 checksum, and the firmware (UEFI, recommended, or legacy BIOS). The link must stay valid until the download finishes; it is not kept afterwards.
SSH keys cannot be injected into an arbitrary installer, so open the Console tab once the machine is ready, enable access, connect and run the installer. When it finishes, choose Finish installation to detach the ISO and reboot from disk.
Delete a machine
Deletion is permanent and only account owners can do it. There are no backups or restore: copy off anything you need first.
- Open the machine → Settings tab → Danger zone → Delete VM.
- Type the hostname exactly and confirm.
Deleting removes the machine and its disk, ends console access, releases its public address once clean-up finishes, and stops billing immediately. Usage up to that moment appears on your next invoice. Activity and billing records are kept.