Introduction: Caliber Node

calibernode

Hello LES Community,

First, I'd like to introduce myself. My name is Robert, though some of you may know me as Winter. When I'm not tinkering with servers, I work full-time as an arcade route technician. One day I'm deploying containers, the next I'm accidentally shocking myself on 12V coin mech wiring. If anyone ever wants to talk arcade machines, I'm always happy to.

The Story Behind Caliber Node

During COVID, I was laid off and decided I needed another source of income. Like many people, I thought, "How hard can it be to turn a $5/year VPS into a million dollar company?"

As it turns out... much harder than I thought.

So I opened eBay and bought about 15 refurbished Dell E5 servers loaded with RAM. A few days later, FedEx showed up with a mountain of hardware, and I was convinced I was ready for the the $5/year VPS market.

Fast forward about a year, and those same Dell servers were collecting dust.

I figured it was time to get started. I opened a fresh Google Spreadsheet, filed for an LLC with the State of NC, and suddenly I was a CEO... or at least that's what I thought at the time.

Choosing a Colocation Provider

Living in North Carolina, colocation options are limited. I did what any normal person would do I opened Google and eventually landed on Cogent, which had opened a "new" facility in Raleigh.

Without even touring the building, I signed a one-year contract.

I mean... it's Cogent. How bad could it be?

Let's just say if you've ever been inside that old Sprint building in Raleigh... don't turn on the lights.

The Website

Like most startups, we launched with a template, WHMCS, and just enough customization to make it look presentable.

After all, I was selling $5/year VPS plans.

What more could I possibly need?

Reality Sets In

The following year was rough.

We made virtually no reputable sales and spent more time dealing with spammers and abuse than actual customers. Between abuse reports and colocation costs, it simply wasn't sustainable.

Eventually, we shut everything down.

Ironically, to this day, I still haven't sold a single $5/year VPS.

Back to the Drawing Board

Rather than give up, we started over.

We built our own control panel from the ground up and ditched WHMCS entirely. This time we asked ourselves a different question:

How can we embrace the low-end hosting spirit while building something that's actually useful?

The answer was simple.

Instead of selling another VPS, we built a platform for hosting open-source applications using Docker. By sharing infrastructure efficiently, we could dramatically reduce costs while giving customers an easy way to deploy and manage self-hosted software.

Today

Today, Caliber Node hosts more than 140 managed open-source applications.

They're not virtual servers and they're not trying to be. They're designed for people who want to run great software without spending hours configuring Docker, reverse proxies, databases, and SSL certificates.

We've also come a long way from those old Dell servers. Today our infrastructure runs in professional datacenters with redundant power, real networking, and enterprise hardware through providers such as OVH and GTHost, with our primary focus on the eastern United States.

It's been a long road with plenty of mistakes, but every failure taught us something that helped shape the platform we have today.

Thanks for taking the time to read my story. I'd be happy to answer any questions.

Website: https://calibernode.com/

Cloud Apps Catalog: https://calibernode.com/cloud-apps

Thank you for allowing me into the community.

rpqu

Sounds like fun. Does calibernode got virtual ufocatcher machine?

calibernode

@rpqu said:
Sounds like fun. Does calibernode got virtual ufocatcher machine?

If it's a docker container we might 🤣

rpqu

@calibernode said:

@rpqu said:
Sounds like fun. Does calibernode got virtual ufocatcher machine?

If it's a docker container we might 🤣

LOL
I mean, some hosts got wheels-of-fortune, marbles to give gimmicks/swags. I think it will be great if calibernode got remote-controllable ufocatcher... So the customer spend more to get more token

calibernode

@rpqu said:

@calibernode said:

@rpqu said:
Sounds like fun. Does calibernode got virtual ufocatcher machine?

If it's a docker container we might 🤣

LOL
I mean, some hosts got wheels-of-fortune, marbles to give gimmicks/swags. I think it will be great if calibernode got remote-controllable ufocatcher... So the customer spend more to get more token

You might be onto something! I'd say our $5 signup credit needs some more bling!

WSS

Given the number of user page CVEs recently, I hope your docker instances are still on a dedicated KVM for each instance.

poei

Can you name a (current or retro) stand up arcade video game you wouldn't want your 14 year old kid to play today?

yucchun

@WSS said:
Given the number of user page CVEs recently, I hope your docker instances are still on a dedicated KVM for each instance.

I can only imagine the overhead on this

AnthonySmith

I have not actually had a chance to update the rules yet so thanks for following the existing ones but a few days before the new host tag system came out, as you have 8 upvotes I will just go ahead and add the tag manually, good reminder to update the rules after all the changes.

calibernode

@WSS said:
Given the number of user page CVEs recently, I hope your docker instances are still on a dedicated KVM for each instance.

Good question, and I'd rather give you a straight answer than let an assumption stand.

Cloud Apps run as containers on shared hosts not a separate VM per app. But it's a long way from plain Docker, and the hardening is aimed at the escape bugs you're thinking of.

Root inside the container isn't root on the server. It maps to an unprivileged account with no rights at all. This is the big one, and most Docker setups don't bother.

Containers start with no privileges beyond the handful needed to boot, and we don't run anything in privileged mode.

Nothing gets access to the Docker socket that's why we don't offer tools like Portainer or Watchtower. On a shared host, socket access is a way into other clients containers.

The kernel blocks the risky paths. As a concrete example, the recent Copy Fail bug needs a specific type of socket to exploit our containers can't open one. I checked rather than assumed.

Your app gets its own storage, its own network and its own disk limit and if it has a database, that database isn't reachable from the internet at all.

Containers share the host's kernel, so a kernel level escape is a risk that per VM hosting doesn't have your right. Everything above is chosen to make that hard to reach and we patch quickly but I'm not going to tell you it's the same threat model, because it isn't.

calibernode

@yucchun said:

@WSS said:
Given the number of user page CVEs recently, I hope your docker instances are still on a dedicated KVM for each instance.

I can only imagine the overhead on this

Exactly. Unfortunately it just isn't sustainable with our current model. We'd ultimately love to do this, but the costs would make it difficult to remain sustainable. That's why we lock down Docker like crazy, maintain strict isolation, and patch vulnerabilities as quickly as possible. Hell if we did that we couldn't post offers here on the future. Still waiting on the Provider tag 😉

stupidgenius

@calibernodeUser said: Good question, and I'd rather give you a straight answer than let an assumption stand.

Did AI write this? Because this sounds a lot like AI.

calibernode

@stupidgenius said:

@calibernodeUser said: Good question, and I'd rather give you a straight answer than let an assumption stand.

Did AI write this? Because this sounds a lot like AI.

Yes AI was used above to clean up the grammar from my mumbo jumbo. 😂

But the facts remain the same and we stand by everything stated in the post. No bullshit was added.

calibernode

@AnthonySmith said:
I have not actually had a chance to update the rules yet so thanks for following the existing ones but a few days before the new host tag system came out, as you have 8 upvotes I will just go ahead and add the tag manually, good reminder to update the rules after all the changes.

No problem at all.

I’ll also say that we are legally registered in North Carolina. Our WHOIS information is public and verifiable on our domain and our business reg can also be verified directly with the State of North Carolina that maintains public records

If anyone would like to verify we are registered as Caliber Node, LLC.

I know I mentioned some of that in the original post however I'll put it here on the comments for those that didn't wanna read all that.

Thanks!