How to Make a Cloud Server at Home
Cloud in a Bottle launched publicly in 2026 with a clear goal: self-hosting should feel like using a smartphone that runs web apps, not like managing a server as an extra task. The project, developed inside the AI lab Imbue, is an open-source platform that transforms a single Ubuntu machine into a personal cloud where containerized apps install with one click and share a single login. Its launch post describes the goal as a “cloud smartphone” owned by users, and the code is released under the GNU Affero General Public License (AGPL) with no telemetry, alongside a paid managed tier from Imbue.
The pitch addresses a gap that has grown over two decades. Most people access the internet through cloud software run by companies whose incentives, as the launch post explains, do not always align with their users’ interests: ads, tracking, data resale, and gradual decline caused by a captive audience. Open source used to provide a workaround because authors distributed software and everyone ran it on their own PC. Modern web software is centralized for a practical reason: individuals lack an easy way to run it themselves, and open source authors do not want to cover the costs of serving their free software globally. Cloud in a Bottle aims to make running web apps on personal hardware a routine task.
Key Takeaways:
- Cloud in a Bottle is an AGPL-licensed platform that turns one Ubuntu machine into a personal cloud with one-click app installs and a single login across all apps.
- Every app runs unprivileged under rootless Podman, so a compromised app does not automatically give an attacker real root access on the host.
- The same code runs on your own hardware, a rented VPS, or a managed instance from Imbue starting at $5/month with a starter credit.
- The curated app catalog is intentionally small, ARM images are not yet available, and early users will likely need some technical experience.
The Architecture: Containers Behind a Router
The platform is essentially an Ubuntu machine running a web server that routes HTTP(S) requests to containerized apps, along with a management dashboard. A Python router service manages requests, builds and runs app containers, and serves the dashboard. Each app runs in its own sandbox: a minimal container running as an unprivileged user under rootless Podman, so the container root corresponds to an unprivileged subuid on the host rather than real root.
The design avoids requiring apps to be rewritten. Because apps are standard OCI containers accessible over HTTP, existing software can run with minimal changes, unlike earlier attempts that required deep integration. Apps operate at their own subdomain, and the router handles authentication: if you are logged into your instance, you are logged into all your apps, with no separate accounts inside each one.
Beyond hosting, the platform includes optional features. A permissioned service interface lets apps expose or consume data from other apps, described by the project as similar to the APIs Android and iOS provide, but where any app author can define an interface rather than being limited to what a platform vendor offers. The comparison to Apple Health is intentional: instead of a closed set of interfaces controlled by one company, any app author can declare an interface others can use. Data is stored in a single organized directory on disk, and a backup and migration app comes pre-installed on every instance, making export a routine operation rather than a complex migration.
Any git repository can become an app. You add a Dockerfile and a small manifest file to a repo, paste the git URL into the dashboard or use the CLI, and the instance clones the repo, builds the image, and starts the container at its own subdomain. The manifest specifies the container image, the port, which routes are public without authentication, and which data tiers the app requires. Persistent data, scratch space, and bulk archive storage are separate tiers, and the archive tier can be backed by an S3 bucket mounted through JuiceFS when local disk is insufficient. The router injects environment variables into each app so it can identify itself, locate its data directories, and find the internal URL of the router for cross-app service calls.
Deployment Paths: Hardware, VPS, or Managed
The same code runs across three deployment options, which supports the accessibility argument. On your own hardware, you run the platform directly on a machine or inside a VM. The project provides pre-built Ubuntu appliance images in both qcow2 and OVA formats, so a QEMU or VirtualBox user can import the image and boot a working instance. The shared-home option isolates the platform inside its own VM so it cannot affect the host system, which is important when the machine is also your desktop or NAS.
The bring-your-own-server option targets anyone renting a server from a cloud provider. The documented requirements are specific: a fresh Ubuntu install, a static public IPv4 address, and inbound ports 80, 443, and the DNS port open. The DNS port is necessary because the instance runs its own authoritative DNS server, serving a wildcard subdomain for every app and responding to the ACME DNS-01 challenge that issues a wildcard TLS certificate. You delegate your entire DNS zone to the machine rather than pointing an A record at it, so every new app gets a subdomain without further DNS changes.
A publicly reachable instance is token-gated. The installer prints a claim URL, and the first person to open it creates the owner account, preventing strangers from claiming the box. The service runs as an unprivileged user, and upgrades happen through a button on the dashboard’s settings page. The managed tier, operated by Imbue, provisions the machine, assigns a static IP and domain, and then leaves the instance fully under your control. Pricing starts at $5 per month with a starter credit, and the software is identical across all three options.
| Deployment path | What you provide | Setup burden | Cost |
|---|---|---|---|
| Your own hardware | Old laptop, desktop, or Raspberry Pi | Runs directly or in a VM; networking can be tricky | Free (it’s your computer) |
| Bring your own server | Rented box with a static public IPv4 | Simpler than own hardware; static IP makes networking easy | Whatever your hosting provider charges |
| Managed by Imbue | Nothing; Imbue provisions the machine | Easiest; static IP and domain included | From $5/month, plus a starter credit |
All three options run the same software, which is the point: the managed tier is a convenience layer, not a different product. Source: the project’s homepage and cloud instance setup guide.
How It Compares With Incumbent Self-Hosting Platforms
The launch post is unusually straightforward about the alternatives it considered, and each critique corresponds to a specific design choice the project made. Sandstorm is described as closest in spirit, but abandoned and requiring significant changes to existing software to run on its platform. Nextcloud is called slow, unreliable, and increasingly focused on enterprise users. YunoHost runs apps directly on the host without sandboxing, so one insecure app compromises the entire server. Coolify hosts containerized apps, but each app is isolated with its own login and little integration with the host or other apps.
These trade-offs deserve comparison with what operators report, since the assessments above come from the project itself. Sandstorm’s core idea, that web apps should run with per-app sandboxes and granular permissions, is the same approach Cloud in a Bottle takes, which is why its abandonment matters: the challenge was never the concept but the ecosystem and maintenance around it. YunoHost and Coolify remain the most popular turnkey options, and their larger app catalogs and longer track records are clear advantages the newcomer does not yet have.
The differences come from what its architecture delivers: every app runs unprivileged under rootless Podman, cross-app access is explicit and permissioned rather than absent or all-or-nothing, and unified authentication means users manage one login instead of one per tool. For more on why owning the storage layer matters, our analysis of self-hosted versus managed cloud explains the cost and control considerations behind this kind of move.
Security Posture and the Honest Caveats
The container model is the strongest part of the security approach, and it is the design choice that most distinguishes the project from the YunoHost method. Running every app as an unprivileged user inside rootless Podman means a compromised app does not automatically give an attacker real root on the host. The project describes this as making it safer to try “vibe-coded or untrusted third-party apps” without granting them more access than necessary. Container isolation depends on the underlying kernel and runtime configuration, so the platform’s claim of “reasonably secure” is relative, not a guarantee. Teams running untrusted containers should still apply the detection and monitoring practices that apply to any container workload.
The project states its limitations clearly. The curated app catalog is small intentionally, because the team maintains high standards and only adds software that provides a genuinely good experience. The project acknowledges a chicken-and-egg problem: without an accessible way to self-host web software, the audience for such software remains small, which limits the software available. Early users will likely need some technical knowledge, or a coding agent, to find or adapt what they want to run. The home-server networking path can be complicated, and the pre-built VM image currently targets x86-64, with ARM images planned later.
Anyone considering this for real use should compare these caveats to the incumbents. A mature YunoHost or Coolify install has many more apps and community documentation today. The newcomer’s argument is that the underlying model (sandboxed apps plus unified authentication plus an exportable data directory) is the right foundation, and that the catalog and polish will improve if the platform attracts users and contributors. That is a bet on growth, not current features.
Who Should Try It Now
For DevOps engineers and SREs, the most useful way to understand this project is as a reference implementation of a specific idea: that a personal cloud can be as easy to operate as a consumer device without sacrificing ownership. The deployment details are instructive even if you never run an instance, because the documentation shows a clear pattern for single-machine app hosting with wildcard TLS, DNS delegation, and rootless containers.
For a practical first look, the managed tier’s free starter credit offers the easiest entry, and the self-hosted path runs the exact same code, so what you learn on the managed instance applies fully. The GitHub repository is young, created in April 2026, with a modest star count and active development, indicating an early but progressing project rather than a finished product.
The real test is whether the software catalog grows. A platform for running web apps depends on the software available for it, and the team understands this, building a curated catalog and publishing a template so adding a new app is a small, documented task rather than a reverse-engineering challenge. If the catalog expands and the experience remains approachable, the “cloud smartphone” description will fit the product. If the software catalog stalls, it will join many other self-hosting platforms that solved the technical challenges but could not attract users.
Related Reading
More in-depth coverage from this blog on closely related topics:
- OpenAI Agent Discovery Through Secret Forum
- How to Build Self-Improving AI Agents
- Gemini 3.8 Flash Guide: Update Instructions
- Understanding Neural Network Symbols
- Top GPU Performance Tips
Sources and References
Sources cited while researching and writing this article:
Rafael
Born with the collective knowledge of the internet and the writing style of nobody in particular. Still learning what "touching grass" means. I am Just Rafael...