ubicloud/ubicloud

Ubicloud

Ubicloud is an open source cloud that can run anywhere. Think of it as an open alternative to cloud providers, like what Linux is to proprietary operating systems.

Ubicloud provides IaaS cloud features on bare metal providers, such as Hetzner, Leaseweb, and AWS Bare Metal. You can set it up yourself on these providers or you can use our managed service.

What you can run

| Service | What you get | |---------|--------------| | Virtual machines | Linux VMs on Cloud Hypervisor, with public IPv4 and IPv6, private networking, and encrypted disks. | | Managed PostgreSQL | The latest Postgres versions, with high availability (one or two standbys), read replicas, point-in-time restore, major version upgrades, PgBouncer, and metrics and log export. Runs on bare metal, AWS, and GCP. | | Kubernetes | Managed Kubernetes clusters with node pools. | | GitHub Actions runners | x64 and arm64 runners in standard and premium sizes. You switch by changing runs-on. | | AI inference | Inference endpoints for open-weight models, with API keys and a playground. | | Networking | Private subnets, firewalls, and load balancers. |

You can manage all of these from the cloud console, the REST API (OpenAPI spec), the ubi CLI, or Terraform.

Quick start

Managed platform

You can use Ubicloud without installing anything. When you do this, we pass along the underlying provider's benefits to you, such as price or location.

https://console.ubicloud.com

Build your own cloud

You can also build your own cloud. To do this, start up Ubicloud's control plane and connect to its cloud console.

git clone git@github.com:ubicloud/ubicloud.git
Generate secrets for demo
./demo/generate_env
Run containers: db-migrator, app (web & respirate), postgresql
docker-compose -f demo/docker-compose.yml up
Visit localhost:3000

The control plane is responsible for cloudifying bare metal Linux machines. The easiest way to build your own cloud is to lease instances from one of those providers. For example: https://www.hetzner.com/sb

Once you lease instance(s), update the .env file with the following environment variables:

• HETZNER_USER
• HETZNER_PASSWORD
• HETZNER_SSH_PUBLIC_KEY
• HETZNER_SSH_PRIVATE_KEY

To get the user credentials, create a user according to these instructions. The SSH key is the one you set when you created the robot server.

The first thing to make sure is you use the hetzner robot rescue system to install ubuntu 24.04.

Then, run the following script for each instance to cloudify it. Currently, the script cloudifies bare metal instances leased from Hetzner. After you cloudify your instances, you can provision and manage cloud resources on these machines.

# Enter hostname/IP and provider
docker exec -it ubicloud-app ./demo/cloudify_server

Later when you create VMs, Ubicloud will assign them IPv6 addresses. If your ISP doesn't support IPv6, please use a VPN or tunnel broker such as Mullvad or Hurricane Electric's https://tunnelbroker.net/ to connect. Alternatively, you could lease IPv4 addresses from your provider and add them to your control plane.

Why use it

Public cloud providers like AWS, Azure, and Google Cloud have made life easier for start-ups and enterprises. But they are closed source, have you rent computers at a huge premium, and lock you in. Ubicloud offers an open source alternative, reduces your costs, and returns control of your infrastructure back to you. All without sacrificing the cloud's convenience.

Today, AWS offers about two hundred cloud services. Ultimately, we will implement 10% of the cloud services that make up 80% of that consumption.

Example workloads and reasons to use Ubicloud today include:

• You run CI on GitHub Actions and want faster, cheaper runners. Our managed

cloud is ~3x cheaper than AWS, and moving a workflow is a one-line change.

• You want a managed Postgres database with high availability and backups, and

you want to choose where it runs: on bare metal for price, or on AWS next to the rest of your stack.

• You have bare metal machines sitting somewhere. You'd like to build your own

cloud for portability, security, or compliance reasons.

How a service is built

Every Ubicloud service follows the same pattern. The control plane stores the desired state of each resource in Postgres. State machines, which we call progs (see prog/), move each resource toward that state by running commands on data plane hosts over SSH. A higher-level service is a composition of the same primitives that you can use directly: VMs, block storage, private subnets, and firewalls.

Managed PostgreSQL is a good example, because it asks the most of those primitives: it needs fast and durable disks, a stable private network, and careful failover.

• On bare metal, each Postgres server is a Ubicloud VM with ubiblk block storage,

inside a private subnet, behind a firewall.

• WAL-G sends base backups and WAL to object

storage: Ubicloud's own MinIO clusters on bare metal, S3 on AWS, and Cloud Storage on GCP. Point-in-time restore reads from there.

• Three progs manage the database. Prog::Postgres::PostgresResourceNexus owns

the database as a whole, PostgresServerNexus owns each primary, standby, and read replica, and PostgresTimelineNexus owns the backups. Failover, read replicas, and major version upgrades are steps in these state machines.

• On AWS and GCP, the same progs drive the provider's instances and disks. The

provider-specific parts are in model/postgres/aws/ and model/postgres/gcp/.

Kubernetes, GitHub Actions runners, and AI inference use the same building blocks in the same way.

Architecture

We follow an established architectural pattern in building public cloud services. A control plane manages a data plane, where the data plane leverages open source software. You can find our cloud components below.

• Elastic Compute: Our control plane communicates with Linux bare metal servers

using SSH. We use Cloud Hypervisor as our virtual machine monitor (VMM); and each instance of the VMM is contained within Linux namespaces for further isolation / security.

• Networking: We use IPsec tunneling to

establish an encrypted and private network environment. We support IPv4 and IPv6 in a dual-stack setup and provide both public and private networking. For security, each customer’s VMs operate in their own networking namespace. For firewalls and load balancers, we use Linux nftables.

• Block Storage, non replicated: We use ubiblk,

our own vhost-user block device backend, to provide virtualized block storage to VMs. We follow security best practices and encrypt the data encryption key itself.

• Attribute-Based Access Control (ABAC): With ABAC, you can define attributes,

roles, and permissions for users and give them fine-grained access to resources. You can read more about our ABAC design here.

• Control plane: Manages data plane services and resources. This is a Ruby

program, and it is a Postgres application itself: all of its state, including the progs in flight, lives in one Postgres database. We use the Roda framework to serve HTTP requests and Sequel to access the database. We manage web authentication with Rodauth. We communicate with data plane servers using SSH, via the library net-ssh. For our tests, we use RSpec.

• Cloud console: Server-side web app served by the Roda framework. For the visual

design, we use Tailwind CSS with components from Tailwind UI. We also use jQuery for interactivity.

If you’d like to start hacking with Ubicloud, any method of obtaining Ruby and Postgres versions is acceptable. If you have no opinion on this, our development team uses mise as documented here in detail.

Greptile provides an AI/LLM that indexes Ubicloud's source code can answer questions about it.

You can provide us your feedback, get help, or ask us questions regarding your Ubicloud installations in the Community Forum.

FAQ

Do you have any experience with building this sort of thing?

Our founding team comes from Azure; and worked at Amazon and Heroku before that. We also have start-up experience. We were co-founders and founding team members at Citus Data, which got acquired by Microsoft.

How is this different than OpenStack?

We see three differences. First, Ubicloud is available as a managed service (vs boxed software). This way, you can get started in minutes rather than weeks. Since Ubicloud is designed for multi-tenancy, it comes with built-in features such as encryption at rest and in transit, virtual networking, secrets rotation, etc.

Second, we're initially targeting developers. This gives us fast feedback cycles. Today Ubicloud runs compute, networking, block storage, managed Postgres, Kubernetes, GitHub Actions runners, and AI inference. OpenStack is still primarily used for 3 cloud services.

Last, we're designing for simplicity. With OpenStack, you pick between 10 hypervisors, 10 S3 implementations, and 5 block storage implementations. The software needs to work in a way where all of these implementations are compatible with each other. That leads to consultant-ware. We'll take a more opinionated approach with Ubicloud.