# Self-hosted bare-metal sandbox fleet (hardware floor)

Official pricing: https://www.hetzner.com/dedicated-rootserver/ax42/  
Category: self-host · Isolation: firecracker

## Pricing regimes (raw)

- **Hetzner AX42 / 50% occupancy** (resource): $0.017220898683078554/vCPU-h, $0.005535288862418106/GiB-h:  [alt]
- **Hetzner AX42 / 70% occupancy** (resource): $0.012300641916484683/vCPU-h, $0.003953777758870076/GiB-h:  [alt]
- **Hetzner AX42 / 90% occupancy** (resource): $0.00956716593504364/vCPU-h, $0.0030751604791211693/GiB-h:  [alt]
- **Hetzner EX44 / 70% occupancy** (resource): $0.0055092316855271/vCPU-h, $0.0017708244703479963/GiB-h:  [alt]
- **Hetzner AX102 / 70% occupancy** (resource): $0.013461102129952638/vCPU-h, $0.004326782827484776/GiB-h:  [alt]
- **Hetzner AX162 / 70% occupancy** (resource): $0.01603668566890723/vCPU-h, $0.005154648965005894/GiB-h:  [alt]
- **OVHcloud RISE-1 US / 70% occupancy** (resource): $0.011291443319436174/vCPU-h, $0.0036293924955330555/GiB-h:  [alt]
- **Latitude c3.small monthly / 70% occupancy** (resource): $0.028290649195949976/vCPU-h, $0.009093422955841061/GiB-h:  [alt]

## Features

Yes: snapshots, memory snapshots, fork/clone, pause/resume, persistent disk, volumes, ≥24 h sessions, custom image (Docker or snapshot), start from your own snapshot, full VM (own kernel), Docker inside, root, systemd, SSH, custom domains, raw TCP inbound, egress allowlist, open internet, static egress IP, private networking, self-hosting, BYOC, open source, arm64, memory fork, EU data residency, gVisor or VM (no shared kernel), inbound access rules, firewall inside (nftables), extra volumes, shared volumes

No: idle auto-stop, your own Docker/OCI image, nested virtualization, browser, desktop GUI, computer-use API, code interpreter, browser + desktop control, anti-bot stealth, CAPTCHA solving, residential IPs, preinstalled agents, public IPv4, HTTPS preview URLs, SOC 2, HIPAA, SSO, GPU, Windows, macOS, Python, Node.js, GPU desktop, HTTP method/path egress rules, wake on request, live resize, live fork (no pause), MCP server, automatic snapshots, snapshots on demand, agent harness API, hosted agent API (their own agent), secret proxy, secret proxy for any API

Unknown: everything else. Evidence (source + quote) per feature: https://battleships.dev/data/providers/self-host-baremetal.json → feature_evidence

## Caveats

- OPS LABOUR EXCLUDED. Hardware-only theoretical floor, not a managed-product offer or full operating budget.
- Packing50/70/90% is temporal paid-slot occupancy AFTER host reserves and integer4/8/50GB packing. The synchronized daytime workload alone reaches only about24% occupancy; higher percentages require backfill.
- Rates allocate ONE host cost between CPU andRAM using CPUshare0.2016/0.3312; they are not independently purchasable CPU/RAM prices. Other guest sizes require repacking.
- Setup amortized over12months; first-month cash larger. Reserve2 hardwarethreads,10%RAM,10%disk per host; these are scenario assumptions, not measurements.
- No separate control plane, N+1 standby, multi-region, durable snapshot storage or network overage in headline rates. Co-locating control plane requires enough host reserve.
- 50GiB snapshots are not automatically free: local leftover disk is non-durable on host loss; optional1TB StorageBox4USD/month can hold the example off-host. AWS EBS snapshots0.05USD/GB-month are an external storage scenario, not a Firecracker-managed product.
- Primary hostIPv4 included once in hardware model, NOT oneIP per sandbox. Guests need NAT/proxy/IPv6 or paidIP allocations.
- Hetzner1Gbps traffic unlimited policy; OVH regional plan and Latitude20TB allowances differ; AWS egress billed after account allowance. Provider-global network fields intentionally null to avoid cross-mode false free egress.
- OnlyLinuxKVM-capable hardware assumed. gVisor is userspace-kernel isolation, not a full guest VM; Kata/CloudHypervisor have different overhead profiles. Firecracker guest nested virtualization not offered by this model.
- No performance benchmark equivalence: SMT threads, hybridEcores, Arm cores and dedicated physicalcores differ. CPUovercommit2x table is optimistic and may hurt tail latency.
- Hetzner primary IPv4 is a separate add-on (live_data ipPrice $1.90/month per server); the card's derived Hetzner host costs (AX42 $119 + $59/12 = $123.92) do not add it. If the headline price excludes it, add $1.90/host/month (+1.5% AX42, +2.6% EX44). Product pages still list '1 Dedicated IPv4 address' under basic features, so inclusion is ambiguous.