NulNetDev sandbox and self-hosted CI on a VPS
Docker, Forgejo and throwaway runners on a no-ID KVM: nested virt, custom ISO, live in about a minute, billed in coins. Delete when done.
El artículo largo está en inglés. Cabecera, catálogo y caja están traducidos.
What people actually run
The standard lab is Docker docs plus Forgejo — or GitHub-compatible runners against any forge — with the sandbox rebuilt from a compose file whenever it drifts. Nested virtualization is enabled, so kind, k3s or a test VM under the CI job all work. Billing in USDT keeps CI spend boring and dollar-shaped; a token-only signup keeps an inbox off the throwaway account entirely.
VPS from $3* (fund $50+), storage 1–5 TB NVMe from $24/mo annual-eff, dedicated with IPMI from $30.80/mo. Crypto invoice, no KYC.
Launch nowPlaybook
- Sentry for a toy. Ranger / Warden for runners. Dedicated if steal shows up.
- Install from Docker docs and Forgejo.
- Amsterdam if the team is EU. Delete the VM when finished.
Sizing the fleet
Runners are RAM-and-IO tenants: Sentry ($7.50 list, $6.00 annual-eff) serves a single job queue, Ranger ($12.50 / $10.00) parallelizes two or three, and Warden ($19.00 / $15.20) absorbs a small team's merge train. When a self-hosted runner fleet outgrows shared slices, dedicated metal from $30.80/mo annual-eff ends the steal question permanently. Artifacts and caches belong off-box — the NVMe storage ladder keeps them from fattening every new sandbox. Custom ISOs mount fine, so exotic build environments are a template problem, not a ticket.
Limits
Two rules bound the sandbox: do not mine on shared KVM as a business, and do not scan the internet from a box that traces to your own account. CI belongs to build pipelines; anything else reads differently in an abuse queue.
Can I mount a custom ISO?
Yes. Custom ISO mounts are standard on the KVM line, which covers exotic build agents and recovery boots without a support ticket.
KYC for CI boxes?
No. A token or an email plus a 12-character password opens the account; the crypto invoice finishes it. No documents, no card, no phone.
How fast is a throwaway VM ready?
Roughly a minute after the invoice confirms — fast enough to model ephemeral runners that exist for one pipeline and are deleted with it.
What happens to the disk after deletion?
The VM and its storage leave the account with it; the host does not retain the disk. Anything worth keeping should be exported to the storage line or your own offsite first.
Ready to launch?
Build the box — VPS, storage or bare metal — create the password, pay the invoice that follows.