Product
Multi-tenant cloud console software for FileVPS, CKS, Docker, storage, networking, WAF, IAM, and billing - built to license and sell.
Partners and root clients operate on enrolled Linux workers over mTLS. Placement uses live CPU, RAM, and disk capacity with no RAM overcommit.
Fast create, low idle RAM, high density - guests share the host kernel (not KVM/QEMU VMs).
Important capabilities for companies, MSPs, and partners who sell cloud seats.
Library Quick Apps and Jobs & Functions ship apps without creating a FileVPS.
Install catalog software into a running FileVPS when you need a full guest.
Deploy from Docker templates on the worker engine - separate from Library sandboxes.
Create in tens of milliseconds. Guests are typically ready in about two seconds.
Idle guests cost a few MB of host RAM, not hundreds - more seats per worker.
New VPS start with read-only root so attackers cannot write the system tree.
OWASP CRS edge bindings for FileVPS and Docker - HTTP attack protection.
Partner → client hierarchy with IAM scopes, Users page, and per-client billing.
Due bill meters by the minute. Stopped VPS or database bills storage only.
Compute, storage, DNS, load balancers, CKS, and invoices in one login.
Workers place work from live free CPU, RAM, and disk capacity.
Roles that buy and operate CloFix Cloud.
Run your own multi-tenant cloud console on Linux workers.
Resell seats; manage client accounts and billing under one license.
Full account control: compute, storage, networking, IAM, invoices.
Scoped access to instances, Kubernetes, databases, and more.
Everything in the CloFix Cloud console, grouped by layer.
FileVPS, Library, Jobs & Functions, Docker, CKS
Volumes, EFS, S3, backups, managed databases
VPC, DNS, ALB/NLB, health checks, firewall
Protection Mode, Security Modes, WAF, Quarantine
Users, IAM, partner / client hierarchy
Dashboard, workers, billing, pricing, license
Read-only guest root - block system writes by default
Deploy without VPS, on FileVPS, or via Docker templates
Run app code without creating a VPS
EKS-style clusters on dedicated workers
MySQL, PostgreSQL, MongoDB, Redis projects
What each product area includes when you license CloFix Cloud.
OS-level Linux guests on enrolled workers. Shared Ubuntu 24.04 base with OverlayFS writable layer. CPU, RAM, swap, and PIDs enforced with cgroup v2.
10.231.0.0/16; published SSH / HTTP / HTTPS portsCloFix Cloud gives three app-deploy paths. Pick the right one for each customer seat.
| Path | Where it runs | Best for |
|---|---|---|
| Library Quick Apps | Managed sandbox - no FileVPS, no SSH box | Ship HTML, PHP, Node, Next.js, WordPress, Adminer, Jenkins fast |
| VPS software | Install into a running FileVPS | Full guest with catalog packages (Protection Mode Off while installing) |
| Docker Quick Apps | Worker-host Docker Engine templates | Container apps separate from Library native sandboxes |
Deploy and run Python, Go, Node, PHP, Java, Ruby, Bun, or Deno without creating a FileVPS. Each run gets a fresh overlay, unprivileged UID, limits, and a private network.
Containers on the worker-host Docker Engine (admin opt-in). Tenants never receive docker.sock.
EKS-style Kubernetes on dedicated CKS workers - not kubelet inside FileVPS.
| Product | Use when | Attach |
|---|---|---|
| Volume | One VPS needs durable disk | Same worker, 1:1 |
| EFS | Shared web root across VPS / LB | Any worker, many VPS |
| S3 | Objects and s3fs mounts | CloFix pool or external gateway |
| VPS backup | Clone / recover writable layer | New FileVPS, same worker |
MySQL, PostgreSQL, MongoDB, and Redis as isolated projects - not packages inside FileVPS.
10.231.0.0/16clofix.internal) with auto records; BIND export
Protection Mode is a per-FileVPS switch. When it is On, the guest root filesystem is mounted
read-only. An attacker who lands in the VPS cannot write system files, drop malware into
/etc or /usr, or persist changes on the OS layer.
| State | What happens |
|---|---|
| On (default for new VPS) |
Persistent guest root is read-only. Attackers and scripts cannot write the system tree.
Temporary paths (/run, /tmp, /var/log, APT cache) stay writable
and clear on restart. apt update can refresh indexes. Processes and network keep running.
|
| Off | Root becomes writable so you can install packages or change system files. Turn Off only for that maintenance window, then turn On again for production. Toggling restarts a running VPS. |
Two separate layers. Sell both: filesystem lock and HTTP inspection.
| VPS Protection Mode | WAF (OWASP CRS) | |
|---|---|---|
| What | Read-only guest root filesystem | Worker-shared HTTP/HTTPS edge engine |
| Default | On for new FileVPS | Off until you bind a target |
| Stops | Writing or changing the OS / system files | SQLi, XSS, RCE-style HTTP payloads |
| Does not | Inspect HTTP bodies | Cover SSH or raw TCP |
| Console | VPS Details → Security | /waf bindings and rule groups |
Deploy the controller and workers for your company, MSP, or partner channel. Sell FileVPS seats, CKS, storage, and databases from one console.
Answers about CloFix Cloud features, Protection Mode, WAF, CKS, Docker, billing, storage, and licensing.
CloFix Cloud is multi-tenant cloud console software. One login covers FileVPS, CKS, Docker, Library apps, storage, networking, Protection Mode, OWASP CRS WAF, IAM, partners, and billing.
FileVPS are OS-level Linux guests on enrolled workers. They share the host kernel with OverlayFS and cgroup v2 limits. Create is typically tens of milliseconds; guests are ready in about two seconds. FileVPS is not a KVM/QEMU hardware VM.
Guests share the host kernel, so idle cost stays low. Create median is about 38 ms and ready about 1.7 s. Idle host RAM per VPS is about 1.6 MB. A networked pack can run 100 SSH-ready VPS on one worker. Placement uses live free CPU, RAM, and disk with no RAM overcommit.
Yes. Library Quick Apps deploy managed sandboxes with no FileVPS and no SSH box (HTML, PHP, Node, Next.js, WordPress, Adminer, Jenkins). Jobs & Functions also run code without creating a VPS. For containers, use Docker Quick App templates on the worker Docker Engine. For a full guest, install VPS software into a running FileVPS.
Jobs & Functions run Python, Go, Node, PHP, Java, Ruby, Bun, or Deno without creating a FileVPS. Each run gets a fresh overlay, unprivileged UID, limits, and a private network - useful for scripts, automation, and scheduled work. Workers advertise which runtimes they support.
No. Containers run on the worker-host Docker Engine (admin opt-in). Tenants never receive docker.sock. Use Docker Quick App templates, image wizard, Compose, and Git build without giving tenants host Docker control.
When On (default for new VPS), the guest root filesystem is read-only. Attackers cannot write system files under the protected root. Temporary paths such as /run, /tmp, and /var/log stay writable and clear on restart. Attached Volume / EFS / S3 paths stay writable for app data. Turn Off only to install packages, then turn On again. Toggling restarts a running VPS.
Protection Mode locks the guest filesystem. WAF is a worker-shared OWASP CRS edge engine for HTTP/HTTPS payloads such as SQLi and XSS. Bind FileVPS or Docker targets in /waf. WAF does not cover SSH or raw TCP.
Besides Protection Mode and WAF: SSH Login Block, SSH Key-Only, Delete Protection, Security Modes (Standard / Hardened / Lockdown / Maintenance / Web Block), Network Quarantine for incidents, and Security Center with score, findings, audit trail, and fleet apply.
Yes. CKS (CloFix Kubernetes Service) provides EKS-style clusters, node pools, workloads, Helm, and kubeconfig on dedicated CKS workers. FileVPS guests cannot run kubelet. The Kubernetes API stays on the worker - port 6443 is not published publicly.
Volumes (1:1 durable disk), EFS (shared web root), S3 object storage and mounts, VPS writable-layer backups, plus managed MySQL, PostgreSQL, MongoDB, and Redis projects.
Volume - durable disk attached 1:1 to one VPS on the same worker. EFS - shared web root across VPS or load balancers. S3 - object storage and s3fs mounts. VPS backup - clone or recover the writable layer onto a new FileVPS on the same worker.
VPC on 10.231.0.0/16, controller DNS zone with auto records and BIND export, ALB and NLB load balancers, health checks (HTTP / TCP / ICMP), and firewall rules for FileVPS, apps, and database TLS ports.
FileVPS supports SSH key, PAM password, or both. PEM download is available once at create. Guests use a private bridge on 10.231.0.0/16 with published SSH, HTTP, and HTTPS ports.
Partners and root clients operate on enrolled Linux workers over mTLS. The console places work from live free CPU, RAM, and disk capacity on those workers - no RAM overcommit.
Due bill meters by the minute. Stopped VPS or database instances bill storage only. Resource Pricing supports Standard and Low-cost monthly and hourly rates. The platform also covers invoices, wallets, subscriptions, credits, and license quotas for VPS, CKS, Docker, load balancers, DNS, and backups.
Companies that run their own multi-tenant console on Linux workers; MSPs and partners who resell seats; root clients with full account control; and IAM users with scoped permissions for instances, Kubernetes, databases, and more.
Yes. Partners manage client accounts and billing. Root clients control their full account. IAM users receive scoped permissions for instances, Kubernetes, databases, and more.
Contact CloFix sales to license the controller and workers for your company, MSP, or partner channel. Become a partner if you want to resell seats.