CHROOT.DEV BLOG2026-10-12CHROOT.DEV BLOG

OpenBSD -current VMs, one ssh command away

OpenBSD -current VMs, created and reached over ssh. Beta by invitation, with a 14-day trial.

$ ssh chroot.dev new -n hello -w
hello ░░░░░░░░░░ ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
ssh in 1141 ms
$ ssh vm+hello@chroot.run uname -a
OpenBSD hello 8.0 CHROOT#1 amd64

One ssh command and, in about a second, an OpenBSD -current is running with port 22 accepting connections; the next command already runs inside it. That is chroot.dev: OpenBSD VMs created and reached over ssh.

new, httpd, share set-public, cp of a running VM, rm

We wanted OpenBSD -current one command away, not an afternoon of installing, for people who just want to try it and for people who write software for it and need a CI that brings up a clean machine without waiting.

If you want a long-lived OpenBSD server, openbsd.amsterdam already does that well. chroot.dev is for VMs you create, change and destroy from a script or a terminal.

  • OpenBSD 8.0-current, with root through doas(1).
  • pkg_add(1) straight from the official CDN.
  • An image we maintain that follows -current.
  • HTTPS at https://NAME.chroot.run, with no certificate to set up.
  • A public IPv6 address per VM, reachable straight from the internet.
  • An optional script on the first boot (new -s).
  • A disk that survives stop, start and host reboots.
  • Everything over ssh: no web dashboard, no client to install.

The guest is OpenBSD -current with a CHROOT kernel patched for Firecracker. Firecracker does not go through /boot: the kernel comes from the host. So sysupgrade(8) does not work inside the VM, and the system is upgraded from outside, with ssh chroot.dev upgrade NAME (upgrade(1)), keeping packages and /home.

The host runs Linux, because Firecracker needs KVM. Each VM runs in its own Firecracker 1.17.0 process, under the jailer: its own chroot, uid and cgroup. A VM cannot see the others on the network.

Each VM has its own public IPv6 address, open on every port: filtering is up to pf.conf(5) inside the VM. The address stays with the VM until rm. Outbound traffic to private networks and to ports 25, 465 and 587 is blocked.

chroot.dev is a side project: one person builds and runs it, outside a day job, and pays for it out of pocket. Everything runs on one server, so if it goes down, every VM goes down with it, and answers to email and IRC may take a while. If you want to contribute hardware or help keep the current server running, costs(7) shows every bill, and the paid plans in billing(1) go to them first; talk to us through the contact page.

During the beta, sign-up is by invitation, because capacity is that of one machine: ask at invite@chroot.dev and a one-time code arrives by email. The account starts with a free 14-day trial, no card needed:

  • 1 VM
  • 1 cpu
  • 512 MiB of memory
  • 5 GiB of disk
  • 10 GiB of traffic

An email comes three days before the trial ends. When it ends, the VMs stop and the data is kept until you subscribe to a plan. Plans start at US$ 5 a month, paid through Stripe: billing(1) has the table, and ssh chroot.dev billing subscribe p1 prints the checkout link. The revenue pays the costs first, open in costs(7); from what is left, we plan to donate part to the OpenBSD Foundation.

It is a beta: things will change and some will break. Tell us what is missing or wrong through the contact page, by email or on IRC.

Ask for an invitation at invite@chroot.dev. Then the quickstart shows the whole life of a VM, from new to rm, and the manual covers each command; it also answers at curl https://chroot.dev/man/NAME.

If you run OpenBSD somewhere, we want to know what you would run here.

chroot.devOctober 12, 2026CHROOT.DEV BLOG