®
Circloud
NEST
®
Circloud
NEST
Local Cloud Platform

Self-hosted Container Platform — ship apps without hyperscale costs

Run Circloud® NEST on desktop VMs or on-prem servers with a full software-defined network: isolated Virtual Private Clouds, per-VPC Subnets, built-in Load Balancers, and NAT Gateways for outbound traffic — all driven by a single REST API. Expose your apps to the internet through Cloudflare tunnels using a domain you own. No public IP. No open ports. No hyperscale bill.

HOME HARDWARE
VMs on a host
Cluster of servers
Desktop · Rack Servers
EDGE
Cloudflare Tunnels · FREE
USERS
Public URL
Your hardware → Cloudflare edge → your users
See it in action

Production-grade on your own desktop or servers

From your app to a public URL Five steps, left to right. Your app is deployed into your cluster. Inside the cluster two VPCs, shop and games, each hold a subnet with three pods. The front-end pod of each VPC opens its own outbound tunnel to the Cloudflare edge, and beyond the edge a public web address points back down each tunnel, so a visitor reaches the app with no VPN, no open port and no public IP. 1 YOUR APP 2 YOUR CLUSTER 3 TUNNEL 4 EDGE 5 PUBLIC URL Your App DEPLOY YOUR SERVERS ·your cluster VPC ·shop SUBNET 10.10.1.0/24 shop-db shop-api shop-web FRONT-END VPC ·games SUBNET 10.20.1.0/24 games-db games-worker games-web FRONT-END VPC · SUBNET · POD — a private network per app CLOUDFLARE https://shop.yourdomain.com LIVE https://games.yourdomain.com LIVE
Your app → your pod → your tunnel → the edge → a public URL
Swipe the diagram sideways to see all of it

Zero open ports, globally accessible

No public IP needed. Your pods are reachable through your own domain name over a secure FREE Cloudflare tunnel — only the protocols and ports you explicitly allow ever reach your network.

You don’t install a firewall, configure NAT, or open inbound ports. Cloudflare’s edge sits in front of every request and provides DDoS protection, WAF, bot mitigation, TLS termination, and rate limiting for free, before traffic ever touches your machine.

Tunnel creation is built right into Circloud — no DNS records, no cloudflared installs, no clicking through the Cloudflare dashboard. Drop your Cloudflare account ID and API token into the GUI once and every pod you deploy can be exposed on a custom domain in seconds.

Full cloud stack — from one machine to a 100-server cluster

Deploy VPCs, containers, and isolated networking on a single desktop or server. Start on one machine and grow to a hundred. A single Core i9 server (96 GB RAM) already carries ~2,000 concurrent users and ~100K accounts; a Xeon 6 roughly triples that; and you can keep adding servers up to 100 — your own private cloud, on hardware you own.

You get the full cloud feature set out of the box: auto-healing pods, horizontal auto-scaling, persistent volumes, unlimited Cloudflare tunnels, monitoring, centralized logs, load balancers, NAT gateways, custom domains — every primitive you’d expect from a hyperscaler, running on hardware you own.

Capacity and Scaling
  1. 1 server
    Core i9
    96 GB RAM
    Concurrent users ~2,000
    Daily active users ~10,000
    Accounts ~100,000
  2. 1 server
    Xeon 6
    128 GB RAM
    Concurrent users ~6,000
    Daily active users ~30,000
    Accounts ~300,000
  3. 100 servers
    Xeon 6 cluster
    128 GB RAM each
    Concurrent users ~200,000
    Daily active users ~1,000,000
    Accounts ~10,000,000

Figures are per cluster. Scales to 100 servers in one private cloud.

AI-Agents and API-First Deployment

Create and Deploy your apps with AI agents

Complete REST API

Every operation — VPCs, subnets, pods, replicas, auto-scaling, persistent volumes, Cloudflare tunnels, custom domains — available as simple HTTP calls. The same API powers both GUIs; anything you click, a curl command can do.

Built for AI agents

A natural fit for Claude Code, Cursor, Copilot Workspace, or any LLM that can issue HTTP requests. An agent reads your code, builds the image, then calls the API to provision VPC + pods + tunnels + live URL — in under 30 seconds, zero human intervention.

An agent builds the whole environment On the left, your own machine: an editor, a project folder holding a single spec file, the AI agents you already use, and the same folder afterwards with the app the agents wrote in it. In the middle, the four API calls the agents make - or the single POST /topology call that builds the same environment in one shot. On the right, your cluster: Circloud NEST answering the calls, two VPCs of pods, one tunnel out of each to the Cloudflare edge, and a live public address for each app. YOUR IDE VS CODE · CURSOR my-app — □ ✕ ← → ↑ This PC › my-app Name Type CIRCLOUD_NEST_API.md Markdown AGENTS writing code▌ <div> const </> { … } my-app — □ ✕ ← → ↑ This PC › my-app Name Type CIRCLOUD_NEST_API.md Markdown src Folder assets Folder styles Folder <> index.html HTML POST /vpcs POST /subnets POST /pods POST /tunnels OR POST /topology THE AGENT CALLS THE API YOUR SERVER CLUSTER CIRCLOUD NEST REST API · ONE TOKEN 200 OK VPC · shop subnet · web subnet · data VPC · games subnet · web subnet · data tunnel tunnel TLS AT THE EDGE CLOUDFLARE https://shop.yourdomain.comLIVE https://games.yourdomain.comLIVE
CIRCLOUD_NEST_API.md → code → VPCs · subnets · pods → tunnel → live URL
Swipe the diagram sideways to see all of it

Virtual Topology

Tenant-A Tenant
shop VPC
Subnetweb10.0.1.0/24
shop-web
shop-api
shop-cache
Subnetdata10.0.2.0/24
shop-db
games VPC
Subnetweb10.0.1.0/24
games-web
games-api
Subnetdata10.0.2.0/24
games-db
Tenant-B Tenant
blog VPC
Subnetweb10.0.1.0/24
blog-web
blog-cache
Subnetdata10.0.2.0/24
blog-db
analytics VPC
Subnetjobs10.0.1.0/24
etl
Subnetdata10.0.2.0/24
warehouse
Tenant VPC Subnet Pod

Layered, software-defined isolation

Each tenant gets fully isolated VPCs, carved into private Subnets, where Pods run side-by-side — all routed, addressed, and firewalled in software.

Because each VPC is a separate L3 boundary, two tenants can reuse the same CIDR ranges without ever colliding. Subnets stay private by default; outbound traffic flows through the per-VPC NAT; inbound is exposed only through Cloudflare tunnels.

Install and Scale

Simple one-click installation

Tell the installer which machines to use — Hyper-V virtual machines on a single PC, physical servers, or both — and press Install once. It prepares every machine, joins them into one cluster, and hands back a running private cloud with its web console.

The installer itself runs on your own Windows or Linux desktop, and you never set the machines up one by one.

One click builds the whole cluster An installer running on a Windows or Linux desktop shows one cluster, six machines detected, and a single Install button with the mouse resting on it. Its progress bar is full and reads cluster installed. Two routes leave the installer: one to three Hyper-V virtual machines on a single host, one to three physical servers of your own. All six machines are online, and one cluster is ready. INSTALLER MACHINE YOUR MACHINES Windows Linux Circloud NEST Installer Cluster nest-01 Machines 6 detected Install CLUSTER INSTALLED CASE 1 — HYPER-V VIRTUAL MACHINES HYPER-V HOST vm-01 vm-02 vm-03 CASE 2 — PHYSICAL SERVERS YOUR HARDWARE srv-01 srv-02 srv-03 ONE CLUSTER — READY
One click · virtual or physical · Windows or Linux
Swipe the diagram sideways to see all of it
Adding servers to a running cluster The installer, running on a Windows or Linux desktop, has an Add server button. Three more machines have joined a cluster that already had three, so all six are online, wired to the same cluster and adding their capacity to one shared total of 48 vCPU and 192 GB of memory. INSTALLER MACHINE Windows Linux ADD MACHINES Add server ALL MACHINES JOINED the installer you already have UP TO 100 SERVERS YOUR CLUSTER 6 SERVERS srv-01 ONLINE srv-02 ONLINE srv-03 ONLINE NEW SERVERS srv-04 ONLINE srv-05 ONLINE srv-06 ONLINE CLUSTER CAPACITY 48 vCPU · 192 GB RAM 3 servers → 6 servers · no rebuild, no downtime · the cluster just gets bigger
Swipe the diagram sideways to see all of it

Add a server. The cluster grows.

Outgrown the hardware? Add the new machines to the list and run the installer again. They join the cluster you already have, and their capacity is available to every VPC and pod straight away.

The same step repeats as far as a hundred servers — no reinstall, no migration, no second licence, and the apps already running keep their addresses and their public URLs.

High Availability, Auto-scaling, and Auto-healing

Every pod can run multiple replicas, spread across your machines, with a built-in load balancer distributing traffic between them — one service address in front, healthy replicas behind it. Lose a machine, and the surviving replicas keep answering.

Auto-healing watches every replica. If one crashes or stops responding, the platform detects it and starts a fresh replica automatically — no pager, no manual restart.

Auto-scaling watches CPU load. When traffic climbs it adds replicas of your pod, up to your maximum; when load drops it scales back down to save resources. Both are a single checkbox, at creation or any time after.

Auto-healing and auto-scaling Two panels. Auto-healing: three replica tiles; one crashes and turns red, the platform restarts it, and the readout returns to 3 of 3 healthy. Auto-scaling: as users arrive the CPU meter climbs past the 70 percent threshold, extra replicas of the pod shop-web appear, and when load drops the extras are removed again, back down to the minimum of two. AUTO-HEALING ✕ restarted 3 / 3 HEALTHY 2 / 3 HEALTHY · RESTARTING AUTO-SCALING USERS × 3 × 8 CPU 70% 41% 88% 49% pod shop-web REPLICAS shop-web-1 shop-web-2 shop-web-3 shop-web-4 replicas: 2 · min 2 · max 10 replicas: 4 · min 2 · max 10
Auto-healing · Auto-scaling — your pods look after themselves
Swipe the diagram sideways to see all of it

Cost Comparison

Platform software licensing

Enterprise container platforms like OpenShift, Tanzu, or Rancher charge per-core or per-node license fees that can reach tens of thousands of dollars per year — and those fees renew annually.

Circloud® NEST is a one-time purchase of $11.85, with no recurring license fees, no per-core charges, and no vendor lock-in.

Platform licensing — annual cost (3-node cluster)
Red Hat OpenShift $13,000 – $30,000+ / yr
VMware Tanzu $5,000 – $20,000+ / yr
SUSE Rancher Prime $7,300 – $25,600 / yr per node
Replit $25 – $100 / mo ($300 – $1,200 / yr)
Circloud® NEST $11.85 one-time
One-time purchase — no recurring license fees, no per-core charges
$13k+
OpenShift / yr
per 3-node cluster
$11.85
Circloud® NEST — once, forever
unlimited nodes

Infrastructure hosting

Running 4 production VMs (4 vCPU, 8 GB each) with managed containers, a database, load balancer, and storage costs $400–$800+ per month on AWS, Azure, or GCP.

With Circloud® NEST, the same workloads run on hardware you already own — your electricity bill is the only recurring cost.

AWS / Azure / GCP
$0 $500 $1,000
$800+ / mo
4× m5.xlarge + EKS + RDS + ALB + storage + egress
Your Desktop/Servers
$0 $500 $1,000
$0 / mo
no recurring fees — hardware you own
~15x
Lower hosting cost
$0
Recurring fees
100%
Data on your hardware

Feature Comparison

How Circloud® NEST compares to managed cloud services and enterprise container platforms across features, pricing, and operational overhead.

Feature Circloud® NEST Cloud Providers
AWS / Azure / GCP		 Enterprise
OpenShift / Tanzu / Rancher		 Replit
Price $11.85 one-time $400 – $800+ / mo $5k – $30k / yr $25 – $100 / mo
Recurring license fees ✓ None ✗ Pay-as-you-go ✗ Annual subscription ✗ Monthly
REST API ✓ Full coverage ✓ ✓ ◉ Limited
Web Console / GUI ✓ ✓ ✓ ✓
VPC / Subnets ✓ ✓ ◉ Namespace-level ✗
Multi-tenant isolation ✓ Network-level isolation ✓ Account-level ◉ Namespace-level ✗
Network security (firewall) ✓ Security Rules, DDoS protection, TLS ✓ Security Groups ◉ NetworkPolicy ✗
Load Balancing ✓ ✓ ✓ ✗
Monitoring ✓ Built-in ◉ CloudWatch / extra cost ◉ Prometheus add-on ◉ Basic
Container orchestration ✓ ✓ ✓ ✗
Automatic scaling ✓ ✓ ✓ ◉ Limited
Auto-healing ✓ ✓ ✓ ✗
High Availability ✓ Multi-node ✓ Multi-AZ ✓ ✗
Zero-trust tunnels ✓ ◉ Add-on ✗ ✗
Run on your own hardware ✓ ✗ ◉ Extra cost ✗
No open inbound ports ✓ ✗ ✗ ✗
Persistent volumes ✓ ✓ ✓ ✗
Data sovereignty ✓ ◉ Region-locked ◉ Depends ✗ US only
Vendor lock-in ✓ None ✗ Proprietary ◉ Platform-specific ✗ Proprietary
Setup time ~15 min Hours–days Days–weeks Minutes
Total cost (3 years, 4 VMs) $11.85 $14,400 – $28,800+ $15,000 – $90,000+ $900 – $3,600
INTERNET / USERS HTTPS · any browser · any device · your custom domain CLOUDFLARE EDGE TLS termination · DDoS protection · Global routing · WAF cloudflared · outbound only · zero open ports CIRCLOUD GATEWAY Tunnel Daemon · REST API · Auth · Ingress Router FastAPI · PostgreSQL CloudManager GUI CloudUser GUI Resource Monitor VM NODE 1 · Hyper-V / Bare-metal ⎈ Cluster software Private network Routing Internet Load balancing Switching Firewall Games-VPC Tenant: GameStudio Public Subnet Frontend React · SPA 3D-Engine WebGL · Three.js ● HTTPS tunnel ×3 replicas Matchmaker WebSocket · auto-scale Leaderboard Redis · real-time Chat-Service auto-heal ✓ Private Subnet Backend Node.js · API DB PostgreSQL private · no exposure Game-Server auto-scale Redis session cache Analytics vol:/data · persistent VM NODE 2 · Hyper-V / Bare-metal ⎈ Cluster software Private network Routing Internet Load balancing Switching Firewall MyStore-VPC Tenant: MyStore Public Subnet Frontend Next.js · SSR Payments Stripe · webhook ● HTTPS tunnel ×2 replicas Backend FastAPI · auto-heal ✓ Private Subnet DB PostgreSQL Search Elasticsearch private · no exposure Inventory vol:/data · persistent AI-APP VPC Tenant: DeepLab ML Subnet AI-Agent LLM · inference ML-Pipeline training · batch GPU-Worker CUDA · GPU-bound Model-DB vol:/models Vector-Store pgvector Redis-Cache embeddings ● HTTPS tunnel ×2 replicas private Inference-API FastAPI · auto-scale Feature-Store vol:/data · persistent

Your apps. Your servers. Your rules.

Circloud® NEST brings true multi-tenant isolation to hardware you own. Each tenant gets a dedicated Virtual Private Cloud with its own private network — completely invisible to other tenants. Subnets are carved out automatically, and containerized workloads run as isolated Isolated Pods that never share network space across tenants.

Traffic reaches your apps without a single open inbound port. Cloudflare’s global edge handles TLS, DDoS protection, and global routing. An encrypted outbound-only tunnel delivers requests directly to your server — no public IP, no firewall rules, no exposure.

Scale horizontally across multiple VM nodes as your workloads grow. Each VM runs independent VPCs with full subnet isolation, giving you cloud-grade network architecture on bare-metal economics.

Every request travels through Cloudflare

A user makes an HTTPS request to your custom domain. Cloudflare’s edge terminates TLS, applies DDoS protection, and forwards the request through an encrypted outbound-only tunnel to your server. Circloud® NEST’s gateway routes the request to the correct tenant container and returns the response — zero open ports on your machine at any point in the chain.

Built for

Independent developers

Host full-stack apps on local VMs and expose them with Cloudflare tunnels.

All size datacenters

Offer isolated, API-driven VPCs to every client on racks you already run — no per-VM licensing.

All size businesses

Use physical servers for predictable costs while keeping cloud-grade workflows.

~95%
cheaper than cloud infra
10K+
daily users per machine
0
open inbound ports
100%
self-hosted