Configure a template
Open a template and go to the Configuration tab. It is the guided way to set everything about the machine: resources, users, networking, limits, and what the people who deploy it can do.
Your changes are saved when you select Save configuration. Leaving the tab with unsaved changes asks you first.
When a change takes effect
This is the table to keep in mind while you work. Saving always records a new version — but when your running copies actually see the change depends on what you changed.
| What you changed | What it needs | Why |
|---|---|---|
| Any file (Files tab or full editor), base image, Container users, Run as the signed-in user | Rebuild, then redeploy copies | It is baked into the image. The status goes back to draft. |
| CPU, memory, ports, network, SSH, home mount, bind mounts, everything under Edge & limits, Exposure & lifetime, Auto-login, Connection info, Advanced / infra, Deployment plans | Redeploy each copy | It is applied when a copy starts. No rebuild needed. |
| Name, description, artwork, categories, Stability, Launcher | Nothing | Shown immediately in the catalog, the launcher and on existing copies |
If you have edits waiting for a rebuild, the editor says so: Edits are pending a rebuild — Deploy runs the last built version. Existing copies show an update available badge once a newer build exists — redeploy them to pick it up. See Build and deploy.
General
| Setting | Notes |
|---|---|
| Name | The title people see |
| Slug | The short identifier. It becomes the lab's id and the start of every copy's hostname, so it is capped at 15 characters: lowercase letters, digits and dashes. Saved with its own Save slug button. If it is taken, a short suffix is added. Locked after the first deploy. |
| Kind | Machine lab or App. An app is a machine with something to launch — it appears on the App Store's Apps shelf and on the launcher. Same switch as Launcher under Advanced. |
| Categories | What the lab is for. At least one; the first is the primary. Used by the store, the catalog and AI assistants to filter. |
| Description | Shown in the catalog |
| Stability | alpha, beta or stable |
Stability matters for sharing. alpha means private work in progress — only you can see or deploy it. Move it to beta or stable before you can share it with a workgroup or make it public.
More on the slug. It is also locked once the template has been published to the App Store — The slug is locked once the template has been published to the LabStore. After the first deploy, the error reads The slug is locked once the template has been deployed. If you need a different slug later, fork the template and set the slug on the fork before deploying it.
Categories. Pick up to 12. Order matters: the first is the one shown wherever only one category fits.
Resources
| Setting | Notes |
|---|---|
| CPU | Cores, 1–16 |
| Memory | For example 512m or 2g |
| Ports | Container ports, space-separated, e.g. 80 or 22 8080 |
| Network | Internal-only (no VPN), or VPN enabled |
VPN enabled gives each copy an address on the private tunnel, so people reach it from their own devices. With it on you can pick up to four network tiles — the shared VPN plus any private networks you have — and the machine joins all of them. The person deploying a copy can choose which of their own networks it joins.
VPN support is checked on every build. If the check fails, VPN deploys are blocked until you fix the image and rebuild, or switch to internal-only.
User management
| Setting | What it does |
|---|---|
| SSH | Enable SSH access |
| Run as the signed-in user (shared home) | Creates the deploying person's own login inside the copy, with their account storage mounted as home — the way the platform's own dev labs work. Turning it on also turns on the home mount. |
| Home mount | Mount a persistent home volume at the path you give. Off means the home directory is lost on every redeploy. |
| Bind mounts | Extra folders from the deployer's storage, as source:destination |
| Container users | Linux accounts baked into the image: name, shell, sudo, and optionally one marked primary |
Bind mount presets. Select one to add it: Shared home, Persist /usr/local, App config dir, App data dir, Per-copy state. The source side can use placeholders:
| Placeholder | Filled with |
|---|---|
{labstorage} | The deployer's storage |
{lab_id} | The lab's id |
{username} | The copy's login user — by default the deployer's platform username |
{slot} | The copy number — 0 for the first deploy |
{instance_id} | A value unique to each copy |
Use {slot} or {instance_id} for state that must not be shared between
copies. Mounted data counts against the deployer's storage.
Container users are separate from the signed-in user — don't add the deployer there. Mark one as primary to have the connection details show it when the lab creates no login for the deployer.
The browser code editor runs as a user. If Run as the signed-in user is off and there are no container users, the editor warns you that the VS Code button won't launch.
Edge & limits
Controls applied in front of your app, on its domains.
| Setting | What it does |
|---|---|
| Rate limit | Requests per client per 1s, 3s, 10s or 1m, plus a burst. One shared allowance across the first deploy and every copy. Empty uses the platform default. |
| In-flight cap | Maximum requests processed at once. Extra requests get a "service unavailable" error instead of piling onto your app. |
| Max request body | Uploads larger than this are rejected. Up to 100 MB. |
| Compression | Compress responses at the edge (gzip) |
| Disk (layer) quota | A cap on what the machine writes outside the home directory, e.g. 5G. It can only lower the plan's limit, never raise it. |
| Health check | A command run inside the machine, with interval, timeout, warm-up and retries. In a scale group, an unhealthy replica is taken out of rotation automatically. |
| Error page | Customize the 502–504 page — HTML shown on the lab's domains when the app is down. Up to 64 KB. Empty uses the platform default. |
Each person deploying a copy can also set their own error page, which overrides yours — see Lab settings.
Accepted values
| Setting | Range and default |
|---|---|
| Rate limit | 1–1,000 requests per period; burst 1–5,000. An empty burst uses the same number as the average. Leave the average empty to turn the limit off. |
| In-flight cap | 1–1,000. Empty means no cap. |
| Max request body | Entered in bytes — 1048576 is 1 MB. From 1 KB up to 100 MB. Empty means no limit of your own. |
| Disk (layer) quota | A size like 5G or 512M. It takes effect only on servers that support storage quotas. |
| Health check | A command of up to 512 characters. every (interval), timeout and warm-up take durations like 10s, 500ms or 1m; they default to 10s, 3s and 20s. retries is 1–10, default 3. |
| Error page | HTML up to 64 KB |
Exposure & lifetime
Deployer features unlock options for the people who deploy copies. Turning one on does not switch anything on by itself — each deployer configures it per copy, and needs to be entitled to it.
| Feature | Lets deployers… |
|---|---|
| HTTP proxies | Map container ports to their own domains — see Publishing ports |
| Raw TCP expose | Publish extra TCP ports publicly. Needs a persistent home mount; machine labs only. |
| Always-on | Keep their copy running past the idle timer — see Lab settings |
Proxy services are HTTP services you define once and every copy gets automatically. The first one powers the Launch button. See Auto-login and connection info.
Auto-login and connection info
Sign visitors straight into your app when they select Launch, and choose the rows shown on each copy's dashboard. Both have their own page: Auto-login and connection info.
Advanced / infra
| Setting | What it does |
|---|---|
| Shell | The default shell |
| code-server | Enable code-server (VS Code in browser) |
| Public port 80 | Publish port 80, so the lab can be served on a domain |
| Launcher | Show on the /home app launcher — see below |
| GPU render | Attach a GPU render device, where the platform has one |
| KASM desktop | A graphical desktop lab |
| Runtime driver | How the machine is isolated. Options your platform does not offer are grayed out. |
Launcher lists the lab as a one-click app on the home page launcher: selecting it deploys it with the person's saved settings and opens it. It needs something to launch — a proxy service, code-server or a launch command. For a public template, it reaches everyone's launcher only after an administrator reviews it (see Share and publish).
Deployment plans
A separate card below the configuration, saved with Save plans.
| Plan | What it is |
|---|---|
| Default (paid) | The configuration above. Allow copy deployments (Deploy-a-copy / Scale) decides whether people on this plan can run extra copies and scale groups. Their plan's copy limit still applies. |
| Enable free plan | A lighter tier for free-plan users, with its own CPU, memory, network and copy switch |
Free plan settings override the configuration above for deploys made on the free plan:
| Setting | Choices | Starts at |
|---|---|---|
| CPU | 1–16 cores | 1 |
| Memory | A size like 512m | 512m |
| Network | Internal-only or the Default VPN. Private networks are not offered here. | Internal-only |
| Allow copy deployments | Whether free-plan users can run extra copies and scale groups | Off |
Saving the plans records a new version, like any other save, and running copies pick the change up on their next redeploy. No rebuild is needed.
Artwork
| Image | Use | Limit |
|---|---|---|
| Avatar | Square icon — the banner and the launcher | 2 MB, PNG, JPEG or WebP |
| Cover | Wide banner for catalog cards | 2 MB |
Artwork changes show immediately; no rebuild or redeploy.
The avatar is resized to a roughly square 400-pixel icon, and the cover to a 1200-pixel-wide banner. You can upload up to 100 template images in 24 hours.
Next
- Build and deploy — validate, build, and run copies
- Auto-login and connection info — the Launch button and dashboard rows