Home Onidel Cloud

Onidel Cloud

Onidel Cloud features and how to utilise them
Onidel
By Onidel and 1 other
28 articles

BYO Windows Server Installation Guide

Onidel Cloud allows you to bring your own licensed copy of Windows Server and install it manually via a custom ISO. This guide walks you through preparing and installing Windows Server on a VPS using our VNC and ISO mounting features. Upload your Windows Server ISO 1. Prepare a direct HTTP URL that points to your Windows Server ISO file. Links from cloud storage services like Google Drive or Dropbox are typically not supported unless they provide a direct download link. 2. Login to Onidel Cloud, then go to Orchestration > Custom ISOs 3. Paste the direct ISO URL into the input field and click Upload 4. If the URL is valid, Onidel Cloud will begin transferring the ISO to your account. The download status will be updated every 5 minutes. Once the upload is complete, you will see a green Active status. 5. The ISO is now ready to be attached to your VPS for installation. Create your custom VPS 1. Head over to Virtual Machine Deploy page, the first step is to select the Server Type, then select the Location. 2. When selecting the image, you will see the uploaded ISO available in the ISO dropdown. Choose your uploaded Windows ISO. 3. You can skip SSH Keys and Firewall Group section unless you have specific requirements. 4. In the Server Configuration section, you can select the resources you require either with the prebuilt plans or customise the specifications. Windows Server will fit comfortably onto our $9.9/month plan, but you may customise your resources for your intended workload. 5. Choose your preferred payment cycle. Onidel Cloud supports both hourly billing and subscription-based plans, with discounts available for longer-term commitments. 6. Select any additional features you need, such as automatic backups. 7. Click Deploy Now. If you are selecting a subscription-based plan, an invoice will be generated for payment. Once the payment is completed, your VPS will be online and ready for installation in under 30 seconds. Changing VPS Settings Once your VPS is ready, you will receive an email with the access details. Before proceeding with the Windows installation, a few additional configuration steps are required: 1. Go to the VM Management page and open the Settings tab. 2. Enable TPM, switch the Boot Mode to UEFI, and click Change Boot Mode to apply the changes. 3. Next, navigate to Storage > ISO Images and attach the Virtio Drivers ISO. 4. Open the VPS Console, and follow the on-screen instructions to begin the Windows installation process. Installing Drivers 1. During installation, Windows Server may not detect any available drives for installation. To resolve this, click Load driver, then browse to the virtio-win-0.1.262 drive. Navigate to the amd64 directory, select the folder corresponding to your operating system version, and install the necessary storage drivers. 2. The installer should now detect the storage driver. Select it from the list and click Next to continue. 3. We will also need to install the network drivers. Click Load driver again, navigate to the driver disk, open the NetKVM directory, select the folder that matches your operating system version, and click Next to install 4. Once the storage and network drivers are installed, return to the drive selection screen and click Next to proceed with the installation. 5. Windows will begin copying files from the ISO and will automatically reboot once this step is complete. There is no need to detach the installation ISO at this point - as long as no keys are pressed during boot, Windows will continue the setup process automatically. 6. After the server reboots, you will be prompted to configure initial settings and set a password for the Administrator account. At this point, the Windows Server installation is complete. To enable Remote Desktop access, you will need to log in via the console. 7. Click the Console Commands button, then select Ctrl + Alt + Del to bring up the login screen. 8. To enable Remote Desktop access, navigate to the system settings and find Remote Desktop option. 9. Once Remote Desktop is enabled, you can log into the server using any remote desktop client. A successful login with the Administrator account will automatically log you out of the rescue console session.

Last updated on Aug 27, 2025

Self-Healing Failover Virtual Machines

Overview To ensure maximum uptime and reliability for your workloads, Onidel offers Self-Healing Failover Virtual Machines powered by high-availability (HA) clustering. This feature automatically detects host failures and seamlessly restarts your virtual machines (VMs) on healthy nodes, minimising downtime and reducing manual intervention. HA is available in Singapore, Sydney, Amsterdam and New York. HA is enabled on a VM when a green High Availability label is displayed next to the service name: How it works Distributed Storage with Triple Replication Your virtual machine disks are stored on NVMe-backed block storage, built on a Ceph-powered distributed storage system. Every block of data is replicated three times across independent nodes. This ensures: - Fault tolerance: Even if a storage device or node fails, your data remains accessible. - High performance: NVMe technology delivers fast read/write speeds. - Consistency: Automatic synchronisation maintains data integrity across all replicas. Continuous Node Monitoring The infrastructure continuously monitors the health of all compute nodes in the cluster. If a node becomes unresponsive (due to hardware, network, or power issues), the system immediately detects the failure. Automated VM Failover Once a failure is detected: - A failover event is triggered. - Affected VMs are automatically restarted on a healthy node within the same cluster. - The storage layer ensures that the VM has access to its replicated data with no risk of corruption. The system is self-healing, meaning no manual action is required from you: - Failed nodes are automatically isolated. - Services are restored as quickly as possible with minimal downtime. - Once the failed node is repaired and re-joins the cluster, it automatically reintegrates into the pool of available resources.

Last updated on Jan 18, 2026

Hourly Billing

Introduction Onidel Cloud provides hourly billing in select locations, where cloud server charges accrue in hourly increments. Currently, hourly charges are deducted directly from the customer's account balance, so customers must recharge their account before provisioning hourly VMs. Eligibility To be eligible for provisioning VMs on an hourly billing cycle, customers must: - Verify their mobile phone number: Please visit this page to verify your phone number. - Recharge account balance: Hourly charges are deducted directly from your account balance, so customers must ensure sufficient credit to cover hourly charges. Onidel Cloud requires a minimum account balance equivalent to at least one day of hourly charges. For example, if a VM costs A$0.0082 per hour, you will need a minimum balance of A$0.0082 x 24 = A$0.1968 to avoid an insufficient balance error. How am I billed for my VMs? The hourly rate is calculated by dividing the monthly rate by 672 hours (28 days). If your VM remains online for more than 672 hours within a calendar month, you will only be billed the monthly rate. An invoice with accumulated charges will be generated on the 1st of each month for your reference. If you upgrade or downgrade your VM, it will incur one full hour's charge at the current rate before the update is applied, which may result in charges exceeding 672 hours in months when resizing occurs. VMs in a stopped state continue to reserve dedicated system resources and will incur charges until they are destroyed. To stop accruing charges for a VM, please terminate the service. How is bandwidth usage calculated? We calculate your bandwidth usage based on both inbound and outbound traffic. How are bandwidth caps calculated? Each month consists of 672 hours, and bandwidth allocations are distributed hourly throughout the month. If you exceed your allocated bandwidth at any point, an overage charge will apply. Bandwidth for each VM is allocated on an hourly basis while the instance is active. The monthly bandwidth cap varies depending on the VM’s specifications, so for each hour the instance operates, you accrue one hour's worth of its monthly cap. Onidel customers with multiple cloud servers benefit from pooled bandwidth across their instances as described in Data Transfer (Bandwidth) Pooling What is the bandwidth overage rate? We charge $0.01 per GB for bandwidth usage that exceeds your allocated quota. You can also purchase additional bandwidth at a lower rate of $3.50 per TB. How can I increase my account resource limits? Your account may become eligible for higher limit increases as you establish a credible history. To review your current limits, visit: https://cloud.onidel.com/account/resource-limit. If you would like to request a limit increase, please open a support ticket and provide details of your use case for review.

Last updated on Aug 25, 2025

Automatic Backup

Onidel Automatic Backup provides a reliable and efficient solution to safeguard your data with minimal effort. Designed for speed and flexibility, this feature ensures your critical information is securely stored and easily recoverable when needed. Key Features High-Performance SSD Storage Backups are stored on SSD storage, enabling lightning-fast backup creation and restoration. This ensures minimal downtime and quick access to your data when you need it most. Retention of Recent Backups The system retains the two most recent backup versions, giving you peace of mind with access to both your latest data and a previous backup. This dual-version approach enhances your recovery options. Customisable Backup Schedules Tailor the backup frequency to suit your needs: - Daily: Ideal for environments with frequent changes. - Weekly: Perfect for less dynamic workloads. - Monthly: Suitable for long-term archival needs. Choose the schedule that aligns with your operational requirements. Cost Structure Backups are priced at $0.10 per GB, calculated based on the size of the backed up disk. Flexible Recovery Options Onidel Automatic Backup offers versatile ways to access and utilise your backups: - Restore: Revert your instance to a selected backup version, ensuring quick recovery to a previous state. - Download Locally: Retrieve backups for local storage or disaster recovery planning. - Attach to Running Instance: Mount backups directly to an active instance for seamless individual file or system recovery. These options empower you to recover data on your terms. How to Enable Automatic Backup Enabling Automatic Backup is straightforward and can be done at different stages depending on your needs: - During Order: Activate automatic backups directly when placing your initial order. This ensures your instance is protected from day one with no additional setup required. - Via Backup Tab: If you didn't enable backups initially, you can turn them on later through the Backup tab on the VM management page. Simply click on the button and configure your preferred schedule. - Disabling and Re-enabling: You can disable automatic backups at any time if they're no longer needed. However, to re-enable the feature after disabling it, you'll need to contact customer support for assistance.

Last updated on Aug 25, 2025

Enable 2-FA

What is 2-Factor Authentication? 2-Factor Authentication (2FA) is an important security method that enhances the protection of your account by requiring two forms of identity verification during login. Onidel Cloud supports 2FA via email and TOTP (Time-based One-Time Password). Below are the steps to enable this feature. Enable 2-Factor Authentication 1. Log in to your Onidel Cloud account at https://cloud.onidel.com. 2. Click on Settings under the Account section in the left-hand menu to access the Account Settings page. 3. On the Account Settings page, select the 2-Factor Authentication tab. 4. Click on Activate 2FA and choose your preferred authentication method: via Email or through an Authentication App Using Email 1. After selecting Activate 2FA and Authenticate via Email click the Save Changes button. A notification will appear asking you to enter a verification code. Click on the link in the notification to send the verification code to your email. 2. Check your email inbox for the verification code to activate 2FA. The email will be sent from Onidel Cloud ([email protected]) with the subject: Onidel Cloud - Verification Code 3. Enter the verification code and click Confirm. If the code is correct, 2FA will be successfully enabled on your account. Using TOTP App 1. Select Activate 2FA and Authentication via app, then click Save Changes. A notification will appear asking you to scan the QR code using an authentication app (such as Google Authenticator or Duo Security) 2. Use a TOTP authentication app (such as Google Authenticator) to scan the QR code or manually enter the secret key into the app to add your account. 3. If successful, the app will display an account with the label Onidel Cloud: . 4. Enter the OTP code and click Confirm. 5. If the OTP is correct, 2FA will be successfully enabled on your account.

Last updated on Aug 25, 2025

Affiliate Program

At Onidel Cloud, we value your support in helping us grow. Our Affiliate Program is designed to reward you for bringing new users to experience our fast, reliable, and affordable cloud infrastructure. Whether you are a current customer or simply a fan of Onidel's services, the program allows you to earn extra income effortlessly. How to Get Started 1. Sign Up: Log in to your Onidel account and navigate to the Affiliate section. 2. Share Your Referral Link: Share your unique referral link with friends, colleagues, or your audience through social media, blogs, or emails. 3. Earn Rewards and Help Others Save: Watch your commissions grow as your referrals join and enjoy their exclusive bonus. Affiliate Rewards Structure One-Time Bonus - Earn a one-time A$5 reward for every referral who spends more than A$10 on Onidel Cloud services. - The one-time bonus will become available 30 days after the last eligible transaction, i.e., the transaction that pushes the total spend of your referral over the A$10 threshold. Recurring Commission for Referrers - Earn a 15% commission on every purchase your referral makes, whether it’s for a new service or for renewals. - This means that as your referral continues to use Onidel, your earnings keep growing! Exclusive Bonus for Referees - Your referral will receive a 25% bonus on their first invoice as a welcome gift for joining Onidel Cloud using your referral link. - This bonus helps them save immediately while experiencing Onidel's services. Accessing Your Commission Availability Period Commissions become available 30 days after the referral’s purchase. This delay ensures that transactions are valid and accounts for any refunds or disputes. Payout Options Once your available commission exceeds A$50, you can:: - Convert to Account Credit: Convert your commission into Onidel credits and use them to pay for your own services. - Withdraw Your Earnings: Transfer your earnings to your PayPal account. Benefits of Joining the Onidel Affiliate Program No Limits on Earnings There's no cap on how much you can earn. The more people you refer, the more rewards you get! Passive Income As long as your referrals remain active customers, you'll keep earning commissions on their purchases. Help Your Referrals Save With the 25% bonus on their first invoice, your referrals get a fantastic start with Onidel. Easy Payouts Whether you want to reinvest in Onidel services or withdraw your earnings, we've made the process seamless. Transparent Tracking Monitor your referrals and earnings in real-time through the Onidel dashboard. Example Scenario Let's say you refer three users who each spend A$50 in their first month. Here's how your earnings would look: - One-Time Bonus: A$5 x 3 = A$15 - 15% Commission: (15% of A$50) x 3 = A$22.50 - Total Earnings: A$37.50 from just three referrals in their first month. As these users continue to make purchases, you'll keep earning 15% commissions from them.

Last updated on Aug 25, 2025

Peer Server

The Peer Server functionality strengthens system reliability and fault resilience for mission-critical applications by preventing two servers from being hosted on the same hypervisor. A peer server is usually a secondary server that shares the same responsibilities as the primary server. For example, two web servers running behind a load balancer are considered peer servers since they both equally manage web traffic. However, servers do not need to serve the same purpose to utilise this feature. It can be used to ensure that two servers are placed on separate hypervisors, improving service availability and minimising downtime in the event of a hypervisor failure. How it Works When a peer server is assigned, the platform checks whether both servers are currently located on the same hypervisor. If they are, a live migration will be scheduled to separate them. During the migration, your server will remain fully operational, but management actions through the control panel will be temporarily unavailable. Each server can have only one designated peer server. It is not possible to configure three or more servers to ensure they are all placed on different hypervisors. How to set Peer Servers The Peer Server feature is available for plans that utilise distributed storage. To enable it, follow these steps: - Navigate to the VM management page. - In the Overview > System Information section, click Set Peer Server: - Choose the server you want to designate as a peer, then click Update Once configured, the platform ensures that peer servers are not placed on the same hypervisor and will initiate a live migration if necessary to meet this requirement.

Last updated on Sep 03, 2025

Resource Alerts

Overview Resource alerts are automated notifications that monitor your server's performance metrics and notify you when usage patterns may impact server performance. This proactive monitoring helps you identify and resolve issues before they affect your users, including detecting potential security threats such as malware infections, suspicious activity, or unauthorised access attempts. How Resource Alerts Work Resource alerts monitor five key metrics: - CPU Usage: Average utilisation across all processors (0-100%) - Disk Read: Data read from disk storage (kB/s) - Disk Write: Data written to disk storage (kB/s) - Incoming Network Traffic: Data received by the server (kB/s) - Outgoing Network Traffic: Data sent from the server (kB/s) Monitoring Process: - Metrics are collected every 5 minutes - Every hour, the system calculates the average of all collected data points - If the one hour average exceeds your configured threshold, an alert is sent to your registered email address. - To prevent email flooding, subsequent notifications for the same alert are sent at least 4 hours apart. Understanding Alert Triggers Sudden increases in resource usage may indicate: Normal Activities - Traffic spikes from marketing campaigns - Scheduled backups or maintenance - Legitimate user activity increases - Software updates or deployments Potential Issues - DDoS attacks or brute force attempts - Malware or crypto-mining activity - Data exfiltration or unauthorised access - Misconfigured applications causing resource loops Configuring Alert Thresholds 1. Navigate to your server's management page 2. Click on the Resource Monitor tab 3. Select Resource Alerts 4. Adjust thresholds for each metric based on your usage patterns 5. Enable/disable specific alerts as needed Setting Appropriate Thresholds - New servers: 1. Let your server run normally for 24 hours 2. Review the usage graphs for each metric 3. Set thresholds based on the average values observed 4. Add 20-30% buffer for normal variations - Production servers: Set thresholds 20-30% above typical peak usage - Development servers: Consider higher thresholds or disable alerts Responding to Alerts When you receive an alert: 1. Do not panic - Alerts are informational and don't require immediate action 2. Check current usage - Log into your server to view real-time metrics 3. Identify the cause: - Review recent changes or deployments - Check access logs for unusual activity - Monitor running processes 4. Take action if needed: - Scale resources if legitimate growth - Block suspicious IPs if under attack - Optimise applications if inefficient - Adjust alert thresholds if false positive Common Scenarios High CPU Alert - Check for runaway processes: top or htop - Review application logs for errors - Consider CPU upgrade if consistently high High Network Traffic Alert - Analyse traffic sources: netstat or iftop - Check for DDoS patterns in logs - Verify CDN configuration if applicable High Disk I/O Alert - Check for large file operations: iotop - Review database query performance - Ensure adequate free disk space Disabling Alerts To disable alerts: 1. Access the Resource Alerts page 2. Toggle the active switch to off. Note: We recommend keeping critical alerts active even if you adjust thresholds rather than disabling completely.

Last updated on Feb 10, 2026

1-Click Apps

Overview 1-Click Apps provide pre-configured application environments that can be deployed instantly with minimal setup. These ready-to-use solutions eliminate the need for manual installation, configuration, and dependency management, allowing you to focus on using the application rather than setting it up. Key Features - Pre-configured environments: Applications are installed with recommended default settings. - Faster deployment: Skip manual installation steps and get started immediately. - Wide selection: Choose from commonly used apps such as CyberPanel, FASTPANEL, n8n, aaPanel and more. - Customisable: After deployment, you have full control to adjust settings, install additional packages, and configure the server as needed. How To Use 1-Click Apps To deploy with a 1-Click App, simply select the Application tab in the Software section when ordering a new service. You can also reinstall an existing VM using 1-Click Apps. Deployment time varies by application. Most apps are ready within 3–5 minutes, while some may take longer. For example, please allow 13–15 minutes for CyberPanel to be fully installed and ready to use. Notes & Limitations - 1-Click Apps are designed with default settings; additional hardening and optimisation may be required for production workloads. - Some applications may require post-installation steps (e.g., setting up an admin account). - Bandwidth, storage, and other resources depend on the VM plan you select.

Last updated on Sep 15, 2025

Reserved IP Addresses

Overview Reserved IP addresses (also known as floating IPs) are flexible, re-routable IP addresses that can be dynamically assigned to different virtual machines within your Onidel Cloud infrastructure. Unlike standard IPs that are permanently bound to a specific VM, Reserved IPs can be instantly moved between instances, providing high availability and seamless failover capabilities. When you provision a Reserved IP, it exists independently of any VM instance. You can attach it to a VM and later reassign it to another VM without changing DNS records or updating client configurations. Key Benefits - You can move the reserved IP address from one VM to another (e.g. during maintenance or in response to failure) through our control panel or API. - You can assign one or more Reserved IP addresses to your VM, allowing it to communicate with external systems using multiple public IPs. - When you decommission an old VM and provision a new one, you can attach the same Reserved IP. This avoids updating DNS records or client configurations, making migrations frictionless. - You can hold on to your favourite IP and use it again later - for any reason you like! How Reserved IPs Work A Reserved IP address has a dynamic, one-to-one relationship with an "Anchor" IP address. The Anchor IP is the primary IP address of the VM that the Reserved IP is being routed to. This sounds complicated, but it simply means that the Reserved IP piggybacks on another IP address, which you can choose and change at your leisure. Via the Onidel Cloud Control Panel and API, the Reserved IP ↔ Anchor IP relationship can be updated in real-time, allowing you to direct traffic to the VM of your choice. Example Scenario: 1. A user enters the Reserved IP address 198.51.100.50 in their browser 2. This Reserved IP's current Anchor IP is 203.0.113.10, which belongs to VM-A 3. The user will be served the website running on VM-A When you change the Anchor IP to 203.0.113.20 (which belongs to VM-B), the same user accessing the same Reserved IP will now be served the website running on VM-B. This change is instant, without any perceptible downtime from the end user's perspective. Behind the scenes, our infrastructure simply updates the routing table to forward all traffic destined for the Reserved IP to the new Anchor IP. Use Cases Unplanned Downtime Recovery If your primary VM becomes unavailable, instantly redirect traffic to a standby VM by reassigning the Reserved IP. This provides near-zero downtime recovery without DNS propagation delays. Zero-Downtime Maintenance Before performing maintenance on your production VM: 1. Ensure your standby VM is synchronised 2. Reassign the Reserved IP to the standby VM 3. Perform maintenance on the primary VM 4. Optionally reassign the Reserved IP back after maintenance Provisioning Reserved IPs Via Control Panel 1. Navigate to Network → Reserved IPs in your Onidel Cloud dashboard 2. Click New Reserved IP 3. Select IP type, your desired location and enter reserved IP name 4. Click Add Reserved IP Via API curl -X POST https://api.cloud.onidel.com/network/reserved-ips \ -H "Authorization: Token YOUR_API_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "ip_type": "ipv4", "location": "sydney" }' Reference: Reserved IPs - Developer Docs Pricing 1. Billing: Hourly billing with a maximum of $3.00/month per /32 IPv4 or $1.00/month per /64 IPv6 2. Minimum Charge: 24 hours 3. No bandwidth charges: Uses your VM's allocated bandwidth Configuring Reserved IPs Step 1: Configure on Target VMs Reserved IPs must be configured as secondary IPs on all potential target VMs: Ubuntu 22.04+ (Netplan): # Create a new file: /etc/netplan/60-reserved-ip.yaml network: version: 2 ethernets: eth0: addresses: - YOUR_RESERVED_IP/32 Apply the configuration: sudo netplan apply Ubuntu 20.04 and earlier / Debian: # Add to /etc/network/interfaces auto eth0:1 iface eth0:1 inet static address YOUR_RESERVED_IP netmask 255.255.255.255 Apply the configuration: sudo ifup eth0:1 # Or restart networking service sudo systemctl restart networking CentOS/RHEL: # Create /etc/sysconfig/network-scripts/ifcfg-eth0:1 DEVICE=eth0:1 IPADDR=YOUR_RESERVED_IP NETMASK=255.255.255.255 ONBOOT=yes Apply the configuration: sudo ifup eth0:1 # Or restart network service sudo systemctl restart network Step 2: Assign to Anchor IP Via Control Panel: 1. Go to Network → Reserved IPs 2. Click on your Reserved IP 3. Choose the target VM and click Attach Reserved IP Via API: curl -X PUT https://api.cloud.onidel.com/network/reserved-ips/YOUR_RESERVED_UUID \ -H "Authorization: Token YOUR_API_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "anchor_ip": "TARGET_VM_PRIMARY_IP" }' Reference: Reserved IPs - Developer Docs Step 3: Verifying Configuration Test connectivity to ensure the Reserved IP is properly routed: # From external host ping YOUR_RESERVED_IP # From the VM ip addr show | grep YOUR_RESERVED_IP

Last updated on Oct 04, 2025

Object Storage

Locations Onidel offers S3-compatible Object Storage in the following locations: - Singapore 🇸🇬 (test file) - Sydney, Australia 🇦🇺 (test file) Technology The underlying technology powering Onidel Object Storage is CEPH - an open-source, robust distributed storage solution. Your data is triple replicated to make ensure its integrity and availability. Supported Features - CORS - Lifecycle Rules - Versioning support - Pre-signed URLs - Static Website Hosting Minimum Size Minimum Object Storage plan is 1TB. You can upgrade to higher capacity later. Pricing Ingress Ingress is free on Onidel Object Storage. You can upload as much data as you like. Egress Egress is free up to 3x the storage size so for example, if you have 1TB object storage plan, you can use up to 3TB of egress data transfer without any additional cost. Excess bandwidth is billed at $0.01 per GB. Using Object Storage Creating Object Storage Service 1. Log into Onidel Cloud Panel and navigate to Storage > Object Storage. Then, click on Create Object Storage Service button. 2. Now, choose the: - Location - if unsure, you can test the speed and latency to both of our locations using the test files provided at the top of this page. - Billing Cycle - annual billing gives you 20% discount. The billing period can be adjusted after the service is created. - Service Name - it is not the same as the bucket name. Later, you can create up to 100 unique storage buckets within one service and give a different name for each of them. - Storage Size - desired maximum object storage size, starts at 1TB and can be upgraded later. It can not be downgraded later. After that, click on Deploy Now and the service should appear in the Object Storage list. Creating a Bucket 1. After going to your newly created service, you can see stats about usage of capacity, traffic and active bucket amount. You can also create a new bucket. 2. Now select the: 1. Name of your bucket - it will be referenced in apps that use your S3 bucket. 2. Versioning toggle - if you need to store separate versions of objects uploaded to this bucket. This can increase the storage used by the object if there are multiple versions of it, but it lets you access specific version of the object instead of overwriting it on update. If unsure, leave this disabled. It can be enabled later. 3. Object Lock toggle - if you want to enable WORM (Write Once Read Many) feature of object storage. This ensures no data can be deleted and that there are always past versions of objects stored. Enabling WORM also turns on Versioning option. Then confirm creation by clicking the Create button. 3. After the bucket is created, you will see it in the Bucket List. Adding Your Own Domain If you want to use your own domain with Onidel Object Storage, take a look at a dedicated tutorial.

Last updated on Feb 28, 2026

Custom ISOs

Custom ISO images are fully supported on Onidel Cloud. It enables you to perform installation from your own installation media which can be handy for Uniform deployments, Encrypted Drive installations or just deploying an OS that is not available from our templates. Onidel supports Custom ISOs of size up to 10 GB. Installation from Custom ISO Upload ISO image 1. First, obtain a direct HTTP or HTTPS link to your ISO image. Our panel does not support uploading ISO images directly from your PC, so you will need to prepare a link to the ISO image you want to use. Please note services like Google Drive or Dropbox usually do not support sharing direct links. 2. Login into your Onidel Cloud Account, then go to Orchestration > Custom ISOs. 3. Now paste the direct ISO link into the Remote URL field and click the Upload button. 4. After this, the download of your custom ISO image should start. 5. Once it's finished you will see the custom ISO in the list of available ones below. Deploying a new VM with your Custom ISO 1. If you want to provision a new Virtual Machine using the image you just uploaded, go to Compute > Virtual Machine > Deploy New Server, then in the Software part, select the image from the ISO tab. 2. Next, select your desired specifications and adjust all necessary deployment settings and create the VM as usual by clicking the Deploy Now button. 3. After the VM is created, you can click on the View Console button and install your custom ISO manually. Reinstalling an existing VM into your Custom ISO 1. To reinstall an already provisioned Virtual Machine with your Custom image, you need to mount the custom ISO in the Compute > Virtual Machine > (select your VM) > Storage > ISO images. 2. Now, you should see the custom ISO you have uploaded before. Click Attach on the ISO you want to reinstall from. 3. You will now be asked to confirm whether the Virtual Machine can be reboot (to adjust the boot order and make it boot from your ISO automatically). Click check the checkbox and click the Attach ISO button. 4. After this, the VM will reboot into the ISO your just mounted and you can proceed with manual installation using the VM Console. Troubleshooting If your Virtual Machine did not boot into your Custom ISO despite it being mounted properly, check the Boot Mode selection inside Settings tab of your VM and try changing it to match the boot mode that is supported by your custom ISO.

Last updated on Feb 11, 2026

VM Snapshots

Onidel Cloud supports taking, restoring and downloading snapshots of Virtual Machines. Creating Snapshot of a VM 1. Navigate to Compute > Virtual Machine > (select your VM) > Storage > Snapshots. 2. Click on Create Snapshot button, choose a Name and optional Description of the snapshot. 3. Creating a snapshot usually takes a few minutes depending on the size of the drive. You should see Snapshot In Progress status on the VM. During all this time your VM will stay online but you can't perform any actions on it. 4. After this is finished, you should see the snapshot in the list under Storage > Snapshots. From there, you can Restore, Download or Delete the snapshot. Restoring from a Snapshot 1. Navigate to Compute > Virtual Machine > (VM to restore snapshot on) > Storage > Snapshots. 2. Then, click the Restore button of a selected snapshot. 3. Next you will be asked to confirm whether it's okay for a snapshot to be restored there. Keep in mind, restoring a snapshot will overwrite all existing data of the target VM. 4. After confirming, the VM will start being restored. 5. The process should take a few minutes and after this, the VM will boot from disk restored from snapshot. Deploying new VM from a Snapshot You can also use it as base image when creating a new Virtual Machine. Just go to Compute > Virtual Machine > Deploy New Server, then in the Software part, select your snapshot from the Snapshot tab. In most cases, the new VM will get a different IP address and hostname (as set during deployment). Those are automatically managed by cloud-init on all major Linux distributions. All other configuration and data will be recreated from the snapshot. FAQ Price 2 snapshots per account are free. If you need more, please contact us via ticket. Location Snapshots are tied to a specific location, so a snapshot of a VM in one location can only be restored within the same location, either on the same or different Virtual Machine. Target drive size Snapshots can only be restored to a target with equal or larger drive. Restoring snapshot to a Virtual Machine with a smaller disk is not supported. Retention Snapshots are not removed when destroying a VM they were taken from. If you no longer need a snapshot, you need to delete it separately.

Last updated on Feb 13, 2026

Firewall and IP Lists

Onidel dashboard has built in support for firewall. It can be useful to filter incoming traffic on a layer above your VM guest Operating System. Any incoming traffic filtered out on that layer is not counted towards your server's data usage. Firewall is managed with Firewall Groups which allow you to create reusable groups of rules that can be applied to multiple Virtual Machines simultaneously. IP Lists are used to group IP addresses and subnets. Later, the firewall rules can be applied to them. That is especially useful when using external CDNs like Cloudflare or AWS Cloudfront, monitoring tools or services you want to only expose to trusted networks. Creating a Firewall Group Firewall Groups are sets of firewall rules which can be reused across multiple VMs in different locations. 1. Go to Networks > Firewall and click Add Firewall Group button. 2. Create a name for the Firewall Group. Ideally, it should describe what the rules defined there will achieve together. 3. Now, you can add rules in the firewall group by clicking the pen icon in Actions column. 4. Select a protocol or application, destination ports and source IP range to allow access from. After that click Save button on the right and the rule will be added to the list. The two rules at the bottom are permanent, they drop all incoming traffic. We use deny-by-default approach, user-created allow rules will take higher precedence according to how high they are on the list. There is no distinction between IPv4 and IPv6 in firewall rules. If you want a rule to work with specific address family, just define the Source as either IPv4 or IPv6 subnet. 5. After all the rules are added, click on Linked Instances to apply Firewall Group to your VMs. 6. From there, select your VM name and click the button on the right to apply the defined rules. 7. You will be asked for a confirmation of linking the set of rules to the VM instance. The VM won't reboot but it can take up to 2 minutes for the new rules to be applied. 8. Now, the rule has been applied to selected VM. The instance should also be visible in the Linked Instances tab. Additionally, going to Compute > Virtual Machine > (select your VM) > Network > Security should also show and let you change the rule group being used for your VM. Your firewall group can now also be selected when creating a New VM in the panel. 9. The firewall group can be modified even after VMs were linked to it and the new rules will take effect on all the VMs where given rule is set. Testing Firewall Rules To verify the rules were applied correctly, I initially started an nginx service running on port 80 (that was not covered by inbound rules added in the group). 1. Without firewall the web service was accessible with no restrictions: 2. After adding the VM to Firewall Group, the service is firewalled off and not accessible anymore: The default firewall deny policy is to DROP packets which causes timeout on filtered connections instead of rejecting them immediately. Using IP Lists Onidel provides a predefined set of IP Lists used for common reverse proxies, monitoring services or other known subnets which one may want to have allowed to access services on their VM. Currently the panel has predefined IP Lists for: - Cloudflare (reverse proxy) - AWS CloudFront (reverse proxy) - HetrixTools (monitoring) - UptimeRobot (monitoring) - Onidel (our IP ranges) Built-in To give certain service access to your VM, go to Networks > Firewall > (Select Firewall Group) and add a new Rule selecting IP List as a Source. Here, we allow 3rd party UptimeRobot service to send ICMP packets to all VMs using this Firewall Group. The VMs do not respond to pings from the outside: PING 104.250.118.70 (104.250.118.70) 56(84) bytes of data. --- 104.250.118.70 ping statistics --- 4 packets transmitted, 0 received, 100% packet loss, time 3084ms However UptimeRobot can monitor them just fine with the PING checks: Custom If you want to define your own list of source addresses and subnets use in Firewall rules, you can use IP Lists. 1. In the Onidel Dashboard, go to Network > IP Lists and create a new one by clicking on Add IP List button. 2. Create a name and description for the IP List. 3. Then, you can add multiple IPv4/IPv6 addresses or subnets to the set. Just put it in the input field and click the Add button. *Note: you can not add an entry for subnet with /0 zero prefix size. We use hash:net set to match addresses within subnet and such notation is not supported there. If you really need to add entire address space to IP List, you would need to split the subnet into two /1s, like explained *here. 4. In this example, I added IP addresses of my other servers as well as some IPv4 and IPv6 ranges I consider trusted. 5. When you're done, just go back to Firewall Groups and the Firewall Group we were working with before. Then just add a new rule, selecting newly created IP List as a Source. 6. After this, only the IP addresses defined in IP List should be able to access to the restricted internal service.

Last updated on Feb 23, 2026

How to mount and use Block Storage

Block Storage is currently supported at 4 locations: - Australia (HDD and SSD NVMe) - Singapore (HDD and SSD NVMe) - Netherlands (SSD NVMe) - USA (SSD NVMe) It works as an addon to your existing VPS. You can easily move the storage between VMs in the same region since Block Storage can be attached and detached at any time. Block Storage behaves just like a regular storage device, on Linux it can be partitioned and mounted with a filesystem. In this tutorial we will buy and mount Block Storage to use as storage for Nextcloud data disk. You may have other use case, but the setup itself should be pretty similar. Creating Block Storage 1. Ensure you have an active VM in the desired location. In the Onidel Cloud Panel, go to Compute > Virtual Machine to see a list of your Virtual Machines. 2. Next, navigate to Storage > Block Storage and click on New Block Storage button. 3. Then you will be asked for storage type and location you want the storage to be created in. The storage type selection should depend on your intended workload, in our case HDD storage should work just fine for storing personal files with Nextcloud. Make sure the location is the same as your VM. It can not be changed once the storage is ordered. 4. Next, pick your desired Billing cycle, Storage name and Disk size and click Deploy Now. The name can be changed later and disk size can be increased (but not decreased) on demand. 5. After paying the generated invoice, you should see the service being active in the list of Block Storages. Attaching Block Storage to the VM 1. By clicking into the newly Block Storage, you can select which VM to mount it to. The dropdown should show all VMs you have running in the same location as your storage block. 2. After selecting the VM you want to attach the storage to, click on Save Changes button and Confirm you want to make changes to this service. 3. The VM instance should now be listed alongside your storage in Block Storages list. 4. After going to Compute > Virtual Machine > (select your VM) > Storage > Disks, you should also see the storage now being attached properly from there. Mounting Block Storage inside the VM 1. Firstly, login into your Virtual Machine using SSH. You will need root privileges to perform most of the tasks listed below. 2. Verify the storage was mounted correctly inside the guest OS. root@vm-sg:~# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS sr0 11:0 1 1024M 0 rom sr1 11:1 1 4M 0 rom vda 254:0 0 20G 0 disk ├─vda1 254:1 0 19.9G 0 part / ├─vda14 254:14 0 3M 0 part └─vda15 254:15 0 124M 0 part /boot/efi vdb 254:16 0 1000G 0 disk Your 1TB block storage drive /dev/vdb should be visible at the bottom. 3. Now you can create partition table and first partition on the drive. We will use fdisk for that - to create GPT partition table, use the g command, then create one large partition with n and write changes to the drive with w. Leave defaults where asked. root@vm-sg:~# fdisk /dev/vdb Welcome to fdisk (util-linux 2.41). Changes will remain in memory only, until you decide to write them. Be careful before using the write command. Device does not contain a recognized partition table. Created a new DOS (MBR) disklabel with disk identifier 0x77eca7ed. Command (m for help): g Created a new GPT disklabel (GUID: C54D761B-AD48-4C64-93A2-FA5D78F118AD). Command (m for help): n Partition number (1-128, default 1): First sector (2048-2097151966, default 2048): Last sector, +/-sectors or +/-size{K,M,G,T,P} (2048-2097151966, default 2097149951): Created a new partition 1 of type 'Linux filesystem' and of size 1000 GiB. Command (m for help): w The partition table has been altered. Calling ioctl() to re-read partition table. Syncing disks. 4. Next, create a filesystem on the one large partition we just created. Here, we create ext4 filesystem using mkfs.ext4, but you can use other one if you want. root@vm-sg:~# mkfs.ext4 /dev/vdb1 mke2fs 1.47.2 (1-Jan-2025) Discarding device blocks: done Creating filesystem with 262143488 4k blocks and 65536000 inodes Filesystem UUID: 201c4e8d-1d35-48d0-aa8b-97dd893a4795 Superblock backups stored on blocks: 32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208, 4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968, 102400000, 214990848 Allocating group tables: done Writing inode tables: done Creating journal (262144 blocks): done Writing superblocks and filesystem accounting information: done 5. Create mount point for created partition (can be arbitrary directory on your system). root@vm-sg:~# mkdir /mnt/nextcloud-data 6. Note down the PARTUUID value of your partition. root@vm-sg:~# lsblk -o PARTUUID /dev/vdb1 PARTUUID 78ddd192-302a-46b1-95a5-94bf16f99a50 7. Add this entry at the end of /etc/fstab file (replace PARTUUID value with the one you got above and mount point if different one was used): PARTUUID=78ddd192-302a-46b1-95a5-94bf16f99a50 /mnt/nextcloud-data ext4 rw,noatime,errors=remount-ro,x-systemd.growfs 0 2 8. To check if everything was done properly, mount all fstab entries with mount -a and verify the filesystem was mounted: root@vm-sg:~# mount -a mount: (hint) your fstab has been modified, but systemd still uses the old version; use 'systemctl daemon-reload' to reload. root@vm-sg:~# systemctl daemon-reload root@vm-sg:~# df -h /dev/vdb1 Filesystem Size Used Avail Use% Mounted on /dev/vdb1 984G 2.1M 934G 1% /mnt/nextcloud-data After the addition to fstab, the filesystem should be remounted automatically on each boot. Nextcloud specific configuration You can skip this section if not interested. By this point, your storage should be configured properly and ready to use! 1. There are several ways of running Nextcloud but probably the easiest way is to go with Docker and docker compose. 2. You can use this docker compose file and replace the mount points so that the app uses your Storage Block as storage for data: ... image: nextcloud restart: always ports: - 8080:80 depends_on: - redis - db volumes: - /mnt/nextcloud-data:/var/www/html/data - config:/var/www/html/config - apps:/var/www/html/apps ... Remember this setup is only for demonstration purposes. In reality, you need to secure your Nextcloud instance - setup strong passwords and use a reverse proxy to communicate over HTTPS. 3. You may need to change permissions on the storage directory to align with the user Nextcloud is running as (id 33), like mentioned here: root@vm-sg:~# chown -Rv 33:33 /mnt/nextcloud-data/ changed ownership of '/mnt/nextcloud-data/lost+found' from user:user to 33:33 changed ownership of '/mnt/nextcloud-data/' from user:user to 33:33 4. After the initial setup, you Nextcloud should be using your Block Storage drive. Upgrading the Block Storage If you ever run out of capacity on your block storage, you can easily upgrade it from Onidel Cloud panel. 1. Go to Storage > Block Storage > (select your Block Storage) > Upgrade. 2. Then increase the size of your drive using the slider and click the Upgrade button. 3. Confirm the change and pay the generated invoice. 4. Now, going back to the SSH console, you will see the drive changed size to 2TB, however the partition is still only 1TB. root@vm-sg:~# lsblk /dev/vdb vdb 254:16 0 2T 0 disk └─vdb1 254:17 0 1000G 0 part /mnt/nextcloud-data 5. The easiest way to resize partition is to use the growpart command as such: root@vm-sg:~# growpart /dev/vdb 1 CHANGED: partition=1 start=2048 old: size=2097149951 end=2097151966 new: size=4194301919 end=4194303966 6. After this, reboot your VM and the x-systemd.growfs hook we specified in fstab earlier should automatically resize the filesystem as well. Then you will see the new size being available. FAQ Can my Storage Block be moved to another location? No, the Storage Blocks are limited only to one location and can only be used in location they were created in. Can a Storage Block be moved to different VM? Yes. You just need to unmount and detach a Storage Block from your VM and attach, then mount it to another one. This is possible as long as all VMs are in the same location. Is it possible to shrink a Storage Block? No, we do not support shrinking a Storage Block due to high risk of data loss. If you need to shrink a storage block, you will need to create a new, smaller one and migrate your data manually there. Can storage type be changed? No, storage type (HDD vs SSD NVMe) can not be changed after the Storage Block is created. You will need to migrate your data manually. What kind of IO performance to expect? Some quick benchmarks I ran in Singapore using ext4 as a filesystem on mounted storage with yabs.sh (fio) to measure the IO performance: NVMe SSD fio Disk Speed Tests (Mixed R/W 50/50) (Partition /dev/vdb1): --------------------------------- Block Size | 4k (IOPS) | 64k (IOPS) ------ | --- ---- | ---- ---- Read | 136.29 MB/s (34.0k) | 1.09 GB/s (17.1k) Write | 136.65 MB/s (34.1k) | 1.10 GB/s (17.2k) Total | 272.94 MB/s (68.2k) | 2.20 GB/s (34.4k) | | Block Size | 512k (IOPS) | 1m (IOPS) ------ | --- ---- | ---- ---- Read | 1.04 GB/s (2.0k) | 1.03 GB/s (1.0k) Write | 1.10 GB/s (2.1k) | 1.10 GB/s (1.0k) Total | 2.14 GB/s (4.1k) | 2.13 GB/s (2.0k) HDD fio Disk Speed Tests (Mixed R/W 50/50) (Partition /dev/vdb1): --------------------------------- Block Size | 4k (IOPS) | 64k (IOPS) ------ | --- ---- | ---- ---- Read | 40.03 MB/s (10.0k) | 629.06 MB/s (9.8k) Write | 40.13 MB/s (10.0k) | 632.37 MB/s (9.8k) Total | 80.16 MB/s (20.0k) | 1.26 GB/s (19.7k) | | Block Size | 512k (IOPS) | 1m (IOPS) ------ | --- ---- | ---- ---- Read | 922.29 MB/s (1.8k) | 902.43 MB/s (881) Write | 971.29 MB/s (1.8k) | 962.53 MB/s (939) Total | 1.89 GB/s (3.6k) | 1.86 GB/s (1.8k) Do not take those as a guarantees, the actual results may differ based on storage utilization and other factors in a shared environment.

Last updated on Feb 16, 2026

Private Networking (VPC)

Onidel Cloud supports VPC (Virtual Private Cloud) in every location. Private Networking allows Virtual Machines within one location to connect directly without reaching to the internet. This reduces the security risks by eliminating the need to expose internal services to the public. Private Networks usually offer higher throughput when sending data between VMs and they are not accounted for the used traffic. Creating and using Private Networks (VPCs) is completely free of charge. Prerequisites It is required to have at least two VMs in the same location to make meaningful use of the VPC network. Creating a Private Network 1. In Onidel Dashboard, go to Networks > VPC and click the New VPC Network button. 2. Then select the location you want the network to be created in. The location needs to be the same as the VMs from the Prerequisites section. 3. In the Private IP Range configuration, select Generate An IP Range For Me. There is also an option to Configure Your Own IP Range. Usually not needed unless you need to use a specific private address space for the internal network. In VPC Config enter the name and description of the private network and click Create VPC Network. 4. After that, the VPC Network will be created. You may need to wait up to 5 minutes for it to become Available. Adding Virtual Machines to VPC 1. Going to Compute > Virtual Machine > (select your VM) > Network > Private Network, you can add a VM to newly created private network by clicking the Join Network button. 2. You will be asked to select the VPC from the list and then to confirm joining the network. The VM will be rebooted to apply changes. 3. Once the VM joins network successfully, you will see your VPC listed in Private Networks tab. Assigning a VPC during VM creation When creating a new Virtual Machine instance, there is an option to enable VPC Network and select one for VM to be in. Using the VPC In this example setup, we have added 2 VMs in Amsterdam to the Private Network. You can see both of the VMs being listed in the VPC tab by going to Networks > VPC > (your VPC). 1. After logging into the VM you should see an additional interface with a private IPv4 address associated with it. $ ip a ... 3: ens19: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc fq_codel state UP group default qlen 1000 link/ether 0c:1d:e1:42:0c:5a brd ff:ff:ff:ff:ff:ff altname enp6s19 altname enx0c1de1420c5a inet 10.20.160.3/20 brd 10.20.175.255 scope global ens19 valid_lft forever preferred_lft forever inet6 fe80::e1d:e1ff:fe42:c5a/64 scope link proto kernel_ll valid_lft forever preferred_lft forever Since we use VXLANs as the transport protocol for VPC Networks, the MTU of this interface must be set to 1450 bytes. 2. You should also be able to ping the other VM via its private address. $ ping -c4 10.20.160.2 PING 10.20.160.2 (10.20.160.2) 56(84) bytes of data. 64 bytes from 10.20.160.2: icmp_seq=1 ttl=64 time=0.399 ms 64 bytes from 10.20.160.2: icmp_seq=2 ttl=64 time=0.352 ms 64 bytes from 10.20.160.2: icmp_seq=3 ttl=64 time=0.406 ms 64 bytes from 10.20.160.2: icmp_seq=4 ttl=64 time=0.404 ms --- 10.20.160.2 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3069ms rtt min/avg/max/mdev = 0.352/0.390/0.406/0.022 ms 3. From there, you can communicate between VMs using the VPC interface. Additional notes Bandwidth and Traffic Accounting I have used iperf3 utility to test the throughput between two VMs on via the private network. It was roughly 3Gbps (which is 3x the faster than the public interface). $ iperf3 -c 10.20.160.2 -t 120 Connecting to host 10.20.160.2, port 5201 [ 5] local 10.20.160.3 port 60338 connected to 10.20.160.2 port 5201 [ ID] Interval Transfer Bitrate Retr Cwnd [ 5] 0.00-1.00 sec 363 MBytes 3.04 Gbits/sec 0 1.63 MBytes [ 5] 1.00-2.00 sec 359 MBytes 3.01 Gbits/sec 0 1.63 MBytes ... [ 5] 118.00-119.00 sec 364 MBytes 3.06 Gbits/sec 0 2.90 MBytes [ 5] 119.00-120.00 sec 370 MBytes 3.10 Gbits/sec 529 1.52 MBytes - - - - - - - - - - - - - - - - - - - - - - - - - [ ID] Interval Transfer Bitrate Retr [ 5] 0.00-120.00 sec 41.9 GBytes 3.00 Gbits/sec 3438 sender [ 5] 0.00-120.00 sec 41.9 GBytes 3.00 Gbits/sec receiver iperf Done. The speed generally depends on the location and other factors of shared environment so it is not guaranteed you will get the same result. During this test, over 40 GB of transfer was used but since all packets were transmitted over the private network, the traffic usage was not accounted to the VM.

Last updated on Feb 25, 2026

AMD SEV-SNP Attestation and Memory Encryption

Onidel fully supports AMD SEV-SNP technology on both EPYC™ Premium and EPYC™ High-Frequency Virtual Machines. Price Using AMD SEV-SNP is free of charge. It is a feature that can be turned on and off for a VM at any time. Requirements and Limitations AMD SEV-SNP requires certain conditions to be fully functional: - UEFI boot mode - AMD SEV-SNP requires the VM to be booted in UEFI boot mode. - Recent Linux Operating System - AMD SEV-SNP requires kernel 6.11 or newer inside guest to work reliably. Additionally, if you are using the GRUB bootloader, ensure EFI_UNACCEPTED_MEMORY is supported. Otherwise your guest OS may not be able to address all the allocated memory while SEV-SNP is enabled. It is recommended to use GRUB version 2.12 or newer. It also comes with a few drawbacks: - No vTPM or Secure Boot - Current implementation of AMD SEV-SNP inside the hypervisor we use does not support vTPM or Secure Boot. We will focus on exploring alternative solutions to enable vTPM support running inside SEV-SNP environment at VMPL0, like the Coconot SVSM. - No Live Migration - The VM will be powered off during hypervisor maintenance since AMD SEV-SNP can not run on a different CPU. Enabling SEV-SNP for your VM 1. In Onidel Cloud Platform, navigate to Compute > Virtual Machines > (Select your VM) > Settings. From there, you need to change the Boot Mode to UEFI and click on Change Boot Mode button. The VM will restart automatically after the changes to Boot Configuration. 2. After the VM is restarted, you can now enable the AMD SEV-SNP option in the Security Settings. Then, you will need to restart the Virtual Machine manually by clicking on Server Restart icon. 3. Once the VM boots back up, you should see the notices about AMD SEV features in the system dmesg log. This indicates the feature has been enabled successfully and the VM currently has its memory encrypted. $ dmesg | grep SEV [ 0.391403] Memory Encryption Features active: AMD SEV SEV-ES SEV-SNP [ 0.392603] SEV: Status: SEV SEV-ES SEV-SNP [ 0.515139] SEV: APIC: wakeup_secondary_cpu() replaced with wakeup_cpu_via_vmgexit() [ 0.569713] SEV: Using SNP CPUID table, 33 entries present. [ 0.570745] SEV: SNP running at VMPL0. [ 1.471827] SEV: SNP guest platform device initialized. [ 8.508905] sev-guest sev-guest: Initialized SEV guest driver (using VMPCK0 communication key) [ 9.297485] kvm_amd: KVM is unsupported when running as an SEV guest Verification and Attestation You can use the snpguest utility to perform guest attestation and make sure your VM runs on a genuine AMD CPU (the Versioned Chip Endorsement Key (VCEK) is signed by authentic key from AMD). Installing snpguest 1. Install required dependencies. snpguest is written in Rust and requires to be compiled manually since it has not been packaged for all major distributions yet. On Debian/Ubuntu: $ apt update $ apt install -y curl git gcc make pkg-config libssl-dev On CentOS/RHEL/Alma/Rocky: $ dnf update -y $ dnf install -y curl git gcc make pkgconfig openssl-devel Then install the newest version of Rust from the rustup distribution. $ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh 2. Next clone the snpguest repository, activate the rust environment and compile the utility with cargo. $ git clone https://github.com/virtee/snpguest.git $ cd snpguest $ source "$HOME/.cargo/env" $ cargo build --release ... Compiling snpguest v0.10.0 (/root/snpguest) Finished `release` profile [optimized] target(s) in 5m 51s 3. After the successful compilation, the resulting binary should be in target/release directory. $ ./target/release/snpguest Navigation utility for AMD SEV-SNP guest environment Usage: snpguest [OPTIONS] <COMMAND> Commands: report Report command to request an attestation report certificates Certificates command to request cached certificates from the AMD PSP fetch Fetch command to request certificates verify Verify command to verify certificates and attestation report display Display command to display files in human readable form key Key command to generate derived key ok Probe system for SEV-SNP support generate Generate Pre-Attestation components help Print this message or the help of the given subcommand(s) Options: -q, --quiet Don't print anything to the console -h, --help Print help -V, --version Print version Generating Attestation Report Now you can generate the attestation report. $ snpguest report report.bin request-data.txt --random This command will generate two files: - report.bin - an attestation report of your VM. - request-data.txt - securely generated random data that acts like a 512 bits nonce and prevents replay attacks. Reading Attestation Report You can display the report taken in the previous step using the display report command of snpguest. Here, you can see all the environment parameters of your Virtual Machine. There is also a Measurement hash which can be used for measured boot with golden hash calculated inside the trusted environment. $ snpguest display report report.bin Attestation Report: Version: 3 Guest SVN: 0 Guest Policy (0x30000): ABI Major: 0 ABI Minor: 0 SMT Allowed: true Migrate MA: false Debug Allowed: false Single Socket: false CXL Allowed: false AEX 256 XTS: false RAPL Allowed: false Ciphertext hiding: false Page Swap Disable: false ... Platform Info (39): SMT Enabled: true TSME Enabled: true ECC Enabled: true RAPL Disabled: false Ciphertext Hiding Enabled: false Alias Check Complete: true SEV-TIO Enabled: false Key Information: author key enabled: false mask chip key: false signing key: vcek Report Data: 4D 58 60 89 7A AB 2E EA E1 2E B5 69 00 16 4D FD 10 32 AA 59 FF DD B1 0D 23 54 2A 31 FF 92 F4 59 41 CE C3 28 3A 57 83 43 94 87 27 21 D7 4E 47 3B 89 9B A2 8A 6B 55 AF E4 B3 4D 2F 7B 12 83 22 7F Measurement: E9 BF F4 69 E7 D3 D1 F5 84 B0 FA 32 27 92 C0 03 4A 50 C7 75 17 D3 A0 85 16 0E 30 07 0E F4 04 88 60 9D 47 0B EB A3 02 58 97 8B A1 6B 96 C2 0A 74 ... Fetching AMD Certificate Chain To verify the signature on your report, you need the public certificate chain. It consists of the AMD Root Key (ARK), AMD SEV Key (ASK), and the Versioned Chip Endorsement Key (VCEK). The certificate chain is fetched from the AMD Key Distribution System (KDS). Note: use the value milan on EPYC™ Premium and turin on EPYC™ High-Frequency Virtual Machines. $ mkdir certs $ snpguest fetch ca pem ./certs milan # turin if running epyc high-frequency vm $ snpguest fetch vcek pem ./certs report.bin $ ls -la certs/ total 20 drwxr-xr-x 2 root root 4096 Feb 28 19:09 . drwxr-xr-x 8 root root 4096 Feb 28 19:01 .. -rw-r--r-- 1 root root 2277 Feb 28 19:02 ark.pem -rw-r--r-- 1 root root 2325 Feb 28 19:02 ask.pem -rw-r--r-- 1 root root 1887 Feb 28 19:09 vcek.pem Verifying the Certificate Chain Now use the snpguest utility to verify fetched certificates. This ensures that the VCEK was legitimately signed by the ASK, and the ASK was signed by the ARK. The correct output is shown below. $ snpguest verify certs ./certs The AMD ARK was self-signed! The AMD ASK was signed by the AMD ARK! The VCEK was signed by the AMD ASK! Verifying the Attestation Report Finally, verify the attestation report of your VM. The expected output shown below. $ snpguest verify attestation ./certs report.bin Reported TCB Boot Loader from certificate matches the attestation report. Reported TCB TEE from certificate matches the attestation report. Reported TCB SNP from certificate matches the attestation report. Reported TCB Microcode from certificate matches the attestation report. VEK signed the Attestation Report! The successful verification means: - The report was cryptographically signed by genuine AMD hardware (your VM is not being emulated or spoofed by a malicious hypervisor). - The state and measurements (Launch Digest) of your VM match the expected policies of a SEV-SNP confidential environment. Additional Notes OVMF Stub To enable measured boot, we publish the OVMF binary used on our hypervisors. You can download it from here. Keep in mind fully measured boot may not yet be possible due to current architecture of our hypervisors. Data Encryption While properly working AMD SEV-SNP encrypts the working memory (RAM) making it impossible to trivially dump it from the hypervisor, your data may still not be encrypted at rest. If you need to make sure your data remains inaccessible from the hypervisor, we strongly recommend performing a Custom OS installation using LUKS to encrypt data on the disk. Performance Benchmarks To encrypt and decrypt memory contents, AMD SEV-SNP uses a dedicated hardware AES-128 encryption engine integrated within the DRAM controller of EPYC CPU. This eliminates the need for the CPU to perform any expensive cryptographic operations associated with encryption memory at GB/s speeds. As a result, the performance in synthetic benchmarks is almost on par with a VM that has memory unencrypted. The impact of SEV-SNP is most noticeable on the disk IO speeds. To communicate with external devices like nvme disks on the host, the guest needs to copy unencrypted version of the data to a shared memory region using SWIOTLB (Software I/O Translation Lookaside Buffer). This slows down IO operations especially at high speeds due to the data copying operations required. Both benchmarks were taken using yabs.sh on EPYC™ Premium (Milan) platform. Without AMD SEV-SNP Sat Feb 28 19:42:15 UTC 2026 Basic System Information: --------------------------------- Uptime : 0 days, 0 hours, 2 minutes Processor : AMD EPYC 7713 64-Core Processor CPU cores : 1 @ 1996.249 MHz AES-NI : ✔ Enabled VM-x/AMD-V : ✔ Enabled RAM : 1.9 GiB Swap : 0.0 KiB Disk : 19.6 GiB Distro : Debian GNU/Linux 13 (trixie) Kernel : 6.12.73+deb13-amd64 VM Type : KVM IPv4/IPv6 : ✔ Online / ✔ Online IPv6 Network Information: --------------------------------- ISP : Onidel Pty Ltd ASN : AS152900 Onidel Pty Ltd Host : Onidel Pty Ltd Location : Amsterdam, North Holland (NH) Country : Netherlands fio Disk Speed Tests (Mixed R/W 50/50) (Partition /dev/vda1): --------------------------------- Block Size | 4k (IOPS) | 64k (IOPS) ------ | --- ---- | ---- ---- Read | 120.81 MB/s (30.2k) | 1.79 GB/s (28.0k) Write | 121.13 MB/s (30.2k) | 1.80 GB/s (28.1k) Total | 241.95 MB/s (60.4k) | 3.59 GB/s (56.1k) | | Block Size | 512k (IOPS) | 1m (IOPS) ------ | --- ---- | ---- ---- Read | 10.06 GB/s (19.6k) | 6.74 GB/s (6.5k) Write | 10.59 GB/s (20.6k) | 7.19 GB/s (7.0k) Total | 20.66 GB/s (40.3k) | 13.93 GB/s (13.6k) Geekbench 6 Benchmark Test: --------------------------------- Test | Value | Single Core | 1232 Multi Core | 1338 Full Test | https://browser.geekbench.com/v6/cpu/16798001 YABS completed in 10 min 40 sec With AMD SEV-SNP Sat Feb 28 19:58:14 UTC 2026 Basic System Information: --------------------------------- Uptime : 0 days, 0 hours, 0 minutes Processor : AMD EPYC 7713 64-Core Processor CPU cores : 1 @ 1996.249 MHz AES-NI : ✔ Enabled VM-x/AMD-V : ✔ Enabled RAM : 1.8 GiB Swap : 0.0 KiB Disk : 19.6 GiB Distro : Debian GNU/Linux 13 (trixie) Kernel : 6.12.73+deb13-amd64 VM Type : KVM IPv4/IPv6 : ✔ Online / ✔ Online IPv6 Network Information: --------------------------------- ISP : Onidel Pty Ltd ASN : AS152900 Onidel Pty Ltd Host : Onidel Pty Ltd Location : Amsterdam, North Holland (NH) Country : Netherlands fio Disk Speed Tests (Mixed R/W 50/50) (Partition /dev/vda1): --------------------------------- Block Size | 4k (IOPS) | 64k (IOPS) ------ | --- ---- | ---- ---- Read | 96.56 MB/s (24.1k) | 768.70 MB/s (12.0k) Write | 96.81 MB/s (24.2k) | 772.75 MB/s (12.0k) Total | 193.37 MB/s (48.3k) | 1.54 GB/s (24.0k) | | Block Size | 512k (IOPS) | 1m (IOPS) ------ | --- ---- | ---- ---- Read | 1.74 GB/s (3.4k) | 2.05 GB/s (2.0k) Write | 1.84 GB/s (3.5k) | 2.19 GB/s (2.1k) Total | 3.59 GB/s (7.0k) | 4.24 GB/s (4.1k) Geekbench 6 Benchmark Test: --------------------------------- Test | Value | Single Core | 1380 Multi Core | 1376 Full Test | https://browser.geekbench.com/v6/cpu/16798234 YABS completed in 10 min 0 sec

Last updated on Feb 28, 2026

BGP and BYOIP (Bring Your Own IP)

Onidel supports BGP sessions and BYOIP across all of our locations, except Vietnam. This article outlines the pricing, requirements, and process for getting started. Pricing - $10 one-time setup fee per location. There is no recurring fee. - Any subsequent changes to advertised prefixes or IP filter updates incur an additional $10 per request. What We Provide - A default route only is provided over the BGP session. - If you do not have your own ASN, we will assign you a private ASN for the session. Requirements - A valid Letter of Authorization (LOA) authorising Onidel (AS152900) to advertise your prefixes. - Valid ROAs (Route Origin Authorizations) must be in place to speed up the provisioning process. Exact-match ROAs are required - ensure your ROA covers the exact prefix length you intend to announce. Setup Timeline Setup time varies by location. Generally, provisioning is completed within 5 business days, but may take up to 2 weeks depending on the location and any outstanding requirements. Process 1. Open a support ticket detailing the following: - Your ASN (if applicable) - The prefix(es) you wish to announce - The location(s) where you need the BGP session 2. Attach a signed LOA authorising Onidel (AS152900) to announce your prefixes, originating from your ASN (if you have one) or from our ASN (AS152900). 3. We issue an invoice for the setup fee. 4. Once payment is received, we proceed with provisioning and will update you on the outcome via the support ticket.

Last updated on Feb 28, 2026