Configure a template
Open a template and go to the Configuration tab. It is the guided way to set everything about the machine: resources, users, networking, limits, and what the people who deploy it can do.
Changes are kept when you click Save configuration. Leaving the tab with unsaved changes asks you first.
When a change takes effect
This is the table to keep in mind while you work. Saving always records a new version — but when your running copies actually see the change depends on what you changed.
| What you changed | What it needs | Why |
|---|---|---|
| Any file (Files tab or full editor), base image, Container users, Run as the signed-in user | Rebuild, then redeploy copies | It is baked into the image. The status goes back to draft. |
| CPU, memory, ports, network, SSH, home mount, bind mounts, everything under Edge & limits, Exposure & lifetime, Auto-login, Connection info, Advanced / infra, Deployment plans | Redeploy each copy | It is applied when a copy starts. No rebuild needed. |
| Name, description, artwork, categories, Stability, Launcher | Nothing | Shown straight away in the catalogue, the launcher and on existing copies |
If you have edits waiting for a rebuild, the editor says so: Edits are pending a rebuild — Deploy runs the last built version. Existing copies show an update available badge once a newer build exists — redeploy them to pick it up. See Build and deploy.
General
| Setting | Notes |
|---|---|
| Name | The title people see |
| Slug | The short identifier. It becomes the lab's id and the start of every copy's hostname, so it is capped at 15 characters: lowercase letters, digits and dashes. Saved with its own Save slug button. If it is taken, a short suffix is added. Locked after the first deploy. |
| Kind | Machine lab or App. An app is a machine with something to launch — it appears on the App Store's Apps shelf and on the launcher. Same switch as Launcher under Advanced. |
| Categories | What the lab is for. At least one; the first is the primary. Used by the store, the catalogue and AI assistants to filter. |
| Description | Shown in the catalogue |
| Stability | alpha, beta or stable |
Stability matters for sharing. alpha means private work in progress — only you can see or deploy it. Move it to beta or stable before you can share it with a workgroup or make it public.
Resources
| Setting | Notes |
|---|---|
| CPU | Cores, 1–16 |
| Memory | For example 512m or 2g |
| Ports | Container ports, space-separated, e.g. 80 or 22 8080 |
| Network | Internal-only (no VPN), or VPN enabled |
VPN enabled gives each copy an address on the private tunnel, so people reach it from their own devices. With it on you can pick up to four network tiles — the shared VPN plus any private networks you have — and the machine joins all of them. The person deploying a copy can choose which of their own networks it joins.
VPN support is checked on every build. If the check fails, VPN deploys are blocked until you fix the image and rebuild, or switch to internal-only.
User management
| Setting | What it does |
|---|---|
| SSH | Enable SSH access |
| Run as the signed-in user (shared home) | Creates the deploying person's own login inside the copy, with their account storage mounted as home — the way the platform's own dev labs work. Turning it on also turns on the home mount. |
| Home mount | Mount a persistent home volume at the path you give. Off means the home directory is lost on every redeploy. |
| Bind mounts | Extra folders from the deployer's storage, as source:destination |
| Container users | Linux accounts baked into the image: name, shell, sudo, and optionally one marked primary |
Bind mount presets. Click one to add it: Shared home, Persist /usr/local, App config dir, App data dir, Per-copy state. The source side can use placeholders:
| Placeholder | Filled with |
|---|---|
{labstorage} | The deployer's storage |
{lab_id} | The lab's id |
{username} | The copy's login user — by default the deployer's platform username |
{slot} | The copy number — 0 for the first deploy |
{instance_id} | A value unique to each copy |
Use {slot} or {instance_id} for state that must not be shared between
copies. Mounted data counts against the deployer's storage.
Container users are separate from the signed-in user — don't add the deployer there. Mark one as primary to have the connection details show it when the lab creates no login for the deployer.
The browser code editor runs as a user. If Run as the signed-in user is off and there are no container users, the editor warns you that the VS Code button won't launch.
Edge & limits
Controls applied in front of your app, on its domains.
| Setting | What it does |
|---|---|
| Rate limit | Requests per client per 1s, 3s, 10s or 1m, plus a burst. One shared allowance across the first deploy and every copy. Empty uses the platform default. |
| In-flight cap | Maximum requests processed at once. Extra requests get a "service unavailable" error instead of piling onto your app. |
| Max request body | Uploads larger than this are rejected. Up to 100 MB. |
| Compression | Compress responses at the edge (gzip) |
| Disk (layer) quota | A cap on what the machine writes outside the home directory, e.g. 5G. It can only lower the plan's limit, never raise it. |
| Health check | A command run inside the machine, with interval, timeout, warm-up and retries. In a scale group, an unhealthy replica is taken out of rotation automatically. |
| Error page | Customize the 502–504 page — HTML shown on the lab's domains when the app is down. Up to 64 KB. Empty uses the platform default. |
Each person deploying a copy can also set their own error page, which overrides yours — see Lab settings.
Exposure & lifetime
Deployer features unlock options for the people who deploy copies. Turning one on does not switch anything on by itself — each deployer configures it per copy, and needs to be entitled to it.
| Feature | Lets deployers… |
|---|---|
| HTTP proxies | Map container ports to their own domains — see Publishing ports |
| Raw TCP expose | Publish extra TCP ports publicly. Needs a persistent home mount; machine labs only. |
| Always-on | Keep their copy running past the idle timer — see Lab settings |
Proxy services are HTTP services you define once and every copy gets automatically. The first one powers the Launch button. See Auto-login and connection info.
Auto-login and Connection info
Sign visitors straight into your app when they click Launch, and choose the rows shown on each copy's dashboard. Both have their own page: Auto-login and connection info.
Advanced / infra
| Setting | What it does |
|---|---|
| Shell | The default shell |
| code-server | Enable code-server (VS Code in browser) |
| Public port 80 | Publish port 80, so the lab can be served on a domain |
| Launcher | Show on the /home app launcher — see below |
| GPU render | Attach a GPU render device, where the platform has one |
| KASM desktop | A graphical desktop lab |
| Runtime driver | How the machine is isolated. Options your platform does not offer are greyed out. |
Launcher lists the lab as a one-click app on the home page launcher: a click deploys it with the person's saved settings and opens it. It needs something to launch — a proxy service, code-server or a launch command. For a public template, it reaches everyone's launcher only after an administrator reviews it (see Share and publish).
Deployment plans
A separate card below the configuration, saved with Save plans.
| Plan | What it is |
|---|---|
| Default (paid) | The configuration above. Allow copy deployments (Deploy-a-copy / Scale) decides whether people on this plan can run extra copies and scale groups. Their plan's copy limit still applies. |
| Enable free plan | A lighter tier for free-plan users, with its own CPU, memory, network and copy switch |
Artwork
| Image | Use | Limit |
|---|---|---|
| Avatar | Square icon — the banner and the launcher | 2 MB, PNG, JPEG or WebP |
| Cover | Wide banner for catalogue cards | 2 MB |
Artwork changes show straight away; no rebuild or redeploy.
Next
- Build and deploy — validate, build, and run copies
- Auto-login and connection info — the Launch button and dashboard rows