Identity & tiers

hopbox's front door has no signup: your SSH key is your identity. The box is owned by that key's fingerprint, and every operation — the boxes you see with ssh cli@host ls, the ones you can rm — is scoped to it.

• Reconnect with the same key → the same box (within its lifetime).
• A different key → a different owner. It sees none of your boxes, and can't attach to a box of yours that's alive under the same name.
• No key distribution, no accounts to provision. Bring any SSH key.

ssh proj@host                # owned by your key's fingerprint
ssh cli@host ls              # lists only boxes owned by that key

Box lifecycle + identity

Boxes auto-suspend when idle and resume on reconnect for everyone — the base lifecycle and most controls (keep-alive, per-box idle, suspend/resume) are not gated by identity. What verification unlocks is persistence and sharing: marking a box durable (never idle-reaped), always-on (auto-suspend off, unlimited keep-alive), and minting share links that let others into your boxes. Quotas, bigger flavors, and billing come later.

See lifecycle and the lifecycle flags.

Accounts

Your account is your SSH key fingerprint — the same identity that owns your boxes, so there's nothing to sign up for. ssh cli@host acc shows it:

$ ssh cli@box.hopbox.dev acc
Account
  fingerprint   SHA256:…
  verified      no
  tier          Free — boxes suspend when idle and are reaped after 3h; no durable, always-on, or sharing
  member since  2026-07-03

  Verify to mark boxes durable, keep them always-on, and share them:  ssh cli@<host> acc register

Verification (acc register) lets you mark boxes durable: a durable box is exempt from idle-reap and persists indefinitely instead of being reaped after --idle-reap. It's per box and off by default — verifying doesn't make everything permanent; you opt each box in with ssh cli@<host> durable <box> on (or box-guest durable on from inside). Verification also unlocks always-on (auto-suspend off, unlimited keep-alive) and share links that let others into your boxes. (Quotas, bigger flavors, and billing come later.) It's off unless the operator sets --verify-mode:

• github — GitHub OAuth device flow (the pick for developers): acc register shows a code + github.com/login/device; you authorize in a browser; hopbox links your GitHub id. One GitHub → one key: a second key can't verify with the same GitHub account, so nobody spins up ten keys for ten durable quotas. Needs a GitHub OAuth app (--github-client-id).
• manual — operator-completed callback, for dev / trusted use.

The verification step itself is open to anyone; what it unlocks is the durable tier, and the one-identity-per-key rule is what actually bounds abuse. See the verification flags.

Per-key quotas are the floor underneath all of this: --quota-boxes caps how many concurrent boxes any single key may hold, and --quota-boxes-verified sets a higher cap for verified accounts. So ten throwaway keys are each capped, and verifying (one GitHub → one key) is how you earn the larger allowance.

Tiers

Your tier decides what you may ask for. There are two:

	free	durable
Who	any SSH key	a verified account
Concurrent boxes	--quota-boxes	--quota-boxes-verified
Box lifetimes	run, work	all four
Hard deadline	up to 24 h if you ask	none unless you ask
keep-alive pin	up to 1 h	unlimited

A run box is work that finishes — it reaps shortly after you disconnect, and it always carries a deadline, so a job that hangs cannot bill forever. A work box is a workstation: it suspends when idle and never acquires a deadline you didn't ask for. durable and always are the persistence privileges described under lifecycle.

Every principal here holds a key. hopbox has no identity-less tier: there is no way to get compute without presenting one.

Isolation

Boxes are isolated by construction — microVMs are hardware-isolated on a dedicated bridge, egress is fenced from the host's other services / your LAN / your tailnet, and every box is resource-capped by its flavor. See secure by default.

See also

• SSH & the front door — the username grammar and reserved names.
• hopboxd config — the front-door and lifecycle flags.