Managed Kubernetes

Everything here is live in the dashboard today, under Kubernetes.

What's new

• Clusters in your private network. Kubernetes 1.36 with a fully managed control plane, highly available on paid plans, created from a short wizard and ready in about five minutes. The Free plan includes one cluster with one worker. See Kubernetes.
• Node pools. Group workers by size and zone, with your own labels and taints, and add or remove workers at any time. See node pools.
• Load balancers from Services. A Service of type LoadBalancer gets a platform load balancer, and the Service itself sets who may reach it, denied sources, its protection profile, idle timeout and client IP mode. See Configure a LoadBalancer Service.
• A managed HTTPS gateway. Attach HTTPRoutes or Ingresses, and the cluster serves them over HTTPS on <cluster>.sahabti.app, on extra names and on your own domains, certificates included, with no load balancer to set up. See Expose HTTP services.
• Persistent volumes. Two storage classes, one of which keeps the data after its claim or cluster is deleted; grow a volume from the console, and use a kept volume in a cluster again. See Kubernetes volumes.
• A cluster dashboard. Workloads and container logs, Services and routes, workers and their usage, storage, monitoring and events, read live in the console with your own role. See Kubernetes dashboard.
• Access per person and per cluster. Admin, Editor and Viewer roles given on each cluster, a kubeconfig that renews itself, and an API endpoint you can limit to your own networks or make private. See cluster access.
• Scripts and agents. Create, scale and delete clusters, and manage their node pools, volumes, gateway and access from the API and over MCP.
• Hostnames by kind. Virtual machines now get hostnames under vm.sahabti.app, game servers under play.sahabti.app and load balancers under lb.sahabti.app. Connect with the hostname the console shows. See instances.

Valheim, a container registry, and background processes for web apps

Everything here is live in the dashboard today.

What's new

• Valheim. The third game server joins Minecraft and Terraria, with backups of its worlds, and game servers now have their own Game servers entry in the sidebar, apart from your databases.
• Container Registry. A private registry for your container images, in sizes of 150, 300 and 500 GB. Its hostname gets a certificate Docker trusts, issued and renewed for you, so docker login and docker push work with no extra setup.
• Background processes for web apps. Run workers and schedulers next to the web process, each as its own container from the same image and environment; set the port the web process listens on; and add a pre-deploy command, such as database migrations, that runs once on every deploy before the new version takes traffic. If it fails, the deploy stops and the current version keeps serving.
• Processes. A web app's new Processes page shows each of its containers with its live status and recent output.

Load balancers and certificates

Everything here is live in the dashboard today.

What's new

• Load balancers. Create one under Load balancers and give it listeners for TCP, UDP or TLS, each forwarding to a target group of instances, virtual machines, web apps or addresses on your network, with health checks. Every load balancer gets a hostname under lb.sahabti.app, and on your workspace's shared IP each listener answers on a public port of its own. See load balancers.
• Protection and monitoring. A standard or strict protection profile against floods, overrides per listener, allowed and denied sources, and a list of blocked sources you can lift; traffic and connection charts on every load balancer.
• Certificates. Import a certificate chain and its private key once, on the workspace's Certificates page, and use it on TLS listeners. The key is encrypted at rest and never shown again.
• Web apps. Projects are now called Web apps across the dashboard.

Virtual machines, SSH keys and inbound rules

Everything here is live in the dashboard today.

What's new

• Virtual machines. Debian 13, Ubuntu 24.04 LTS and Rocky Linux 9 machines on your workspace's private network, under Virtual machines. They are key-only: add public keys on the workspace's SSH keys page, and choose the ones a machine trusts when you create it.
• Inbound rules. Every instance has a Network tab that lists which ports on its public address reach it, and from where. Forward a port to a service inside the machine — on the shared IP each rule gets a public port of its own between 40000 and 49999 — and limit any port, the built-in one included, to the IPv4 addresses and ranges you list.
• Public or private, after the fact. Make an instance public or private from the same tab at any time; its inbound rules are kept for when it is public again. See connecting.

Game servers, database import and export, and your own domains

Everything here is live in the dashboard today.

What's new

• Game servers. Launch a Minecraft (Paper) or Terraria (TShock) server in a few clicks, on sizes made for games with up to 16 GB of memory. Each comes with a console for server commands, live player counts, a file manager for worlds, settings and plugins, and backups of the whole server. Minecraft asks you to accept its EULA first.
• Import and export. PostgreSQL, MySQL and MariaDB instances have Export and Import tabs: dump a database to a gzip-compressed SQL file you download, or load a dump into a running instance. See backups.
• MariaDB tools, MySQL and MariaDB backups. MariaDB joins the table editor, the SQL editor and the database users panel, and MySQL and MariaDB instances can be backed up and restored like PostgreSQL. See database tools.
• Your own domains for web apps. Add a hostname on a web app's Domains page, prove you own the domain once with a TXT record, point the hostname at the platform with a CNAME, and the certificate follows on its own. See web apps.
• Managed services. The dashboard's Resources entry is now called Managed services.

Deploy from GitHub, database tools, and an MCP endpoint

Until now Sahabti ran your data. This release runs your code too.

What's new

• Projects — deploy from GitHub. Connect GitHub, import a repository, and Sahabti detects the stack, builds a container, and serves it over HTTPS at a hostname of its own. Every push to the tracked branch ships a new version; a new container has to pass a health check before it takes over, and a failed one never reaches your visitors. Roll back and the exact image that was serving before goes live again — no rebuild. See the projects docs.
• Database tools. PostgreSQL and MySQL instances now carry a table editor, a SQL editor with history and CSV/JSON export, and a database users panel for handing each app or teammate its own account. Queries run inside the instance rather than over a connection from your browser, so a private instance is fully usable from the dashboard. See database tools.
• MCP for AI agents. https://api.sahabti.com/mcp puts twenty-six tools in front of Claude, Cursor, or your own agent — list and launch instances, read a failed provisioning log, run a query, take a backup, request more quota. Sign in with OAuth, or hand an unattended agent a scoped token. Connection secrets are deliberately not exposed to any tool. See MCP.
• Least-privilege API tokens. Minting a token now means picking exactly the resources and actions it needs — instance:read without instance:delete, lifecycle without query — capped at your own role, with an expiry up to a year. See API tokens.
• A workspace notification feed. What the platform did while you were away: instances that came up, the ones that failed and on which step, deployments that shipped.
• Retry a failed provision. An instance that stopped on an infrastructure step can be picked up again over the resources it already holds, instead of being deleted and recreated.
• Per-size network caps. Each instance size now carries a published network rate, so one busy neighbour can't take the uplink with it.

Everything here is live in the dashboard today.

Public IPs your way, two more engines, and on-demand backups

Everything here is live in the dashboard today.

What's new

• Public IPs, your way. When you make an instance public, pick how it's reached: a dedicated IP — its own floating address on the engine's native port — or a shared IP that rides the workspace's ingress address on a per-instance port. Dedicated is a paid-plan option; the Free plan runs on a shared IP.
• Two more engines. FerretDB (MongoDB-wire, on 27017) and Qdrant (vector search, on 6333) join the catalog — eight engines you can launch now, up from six.
• On-demand backups. Take an engine-native logical dump of a running PostgreSQL instance from its Backups panel, then restore it into a fresh instance without ever touching the source. PostgreSQL is the first engine in the panel; more join as their dump scripts ship.
• Live resize. Move a running instance to a bigger size from its Settings tab — the new CPU and memory apply live, no restart — as long as the new footprint fits your quota. Disk stays as provisioned.

See the instances and backups docs for the full picture.

Quota-based billing, live provisioning logs, and API tokens

Three things that make running more than one service on Sahabti easier to manage.

What's new

• Quota-based billing. Your plan grants a shared pool of vCPU, memory, and disk — spin up as many instances as fit, instead of paying per service. Start free, upgrade when you outgrow it.
• Live provisioning timeline. Watch each step — network setup, container creation, engine install, health check — stream in on the instance page as it happens, instead of a spinner.
• Live instance metrics. CPU, memory, disk, and network read straight off the hypervisor, over whichever window you pick — no agent to install.
• Scoped API tokens. Create a workspace token to drive instances from a script or CI, and revoke it from the same page the moment you're done with it.

Read how to wire up a token in the API docs.

Managed services, isolated by design

Sahabti is live: pick an engine from the catalog and get a running, isolated instance in about 75 seconds — no networking, TLS, or firewall config to write yourself.

What's new

• Six engines at launch. PostgreSQL 17, MySQL 8.4, MariaDB 11, Valkey 8, Memcached, and RabbitMQ. The rest of the catalog is listed in the dashboard and marked coming soon until its provisioning script ships.
• Isolated by design. Every instance runs in an unprivileged container on its workspace's own private network. Tenants can never reach each other — isolation is enforced at the network layer, not just a password.
• Reachable from anywhere. Each instance gets a public hostname and port that proxies straight into your private network, and the SQL engines come up with the platform certificate already installed.
• Fast provisioning. Pick an engine and a size; the network, container, and endpoint are provisioned automatically, and connection details are ready the moment it's up.

Launch your first instance from the dashboard — the catalog, sizing, and connection details are all one page.