Launch your SaaS on servers you rent yourself: app, PostgreSQL, Redis and preview environments included.

Push an image and get a URL with TLS. Add a database or a cache with one resource each. Every pull request gets its own preview environment. It runs on Kubernetes clusters that Gardener creates and upgrades for you, in your own Hetzner project. Open source.

Get the CLI on GitHub See how it works

In development, not launched (as of 2026-09-16): the app layer runs end to end on a test cluster; it has not yet run in a production Gardener landscape, and there is no public repository or package to install yet. Say so if you want it, and you will hear when the first tag lands.

Also: two live courses, and clusters run for you if you would rather not run a landscape.

Deploy an app

If you build and ship a SaaS app — alone, with a small team, or with an AI coding agent doing much of the work — this is the layer between a container image and a URL your users can reach. Two objects, applied to your cluster:

apiVersion: paas.paasbox.com/v1alpha1
kind: App
metadata: { name: shop, namespace: shop }
spec:
  image: registry.example.com/acme/shop:1.4.2
  port: 8000
  uses: [{ name: db, kind: ManagedPostgres, prefix: DB_ }]
  scale: { min: 0, max: 5 }
---
apiVersion: paas.paasbox.com/v1alpha1
kind: ManagedPostgres
metadata: { name: db, namespace: shop }
spec:
  plan: s
  storage: 20Gi
  backup: { retention: 7d, objectStoreSecretRef: { name: s3-backups } }

kubectl apply -f app.yaml
pb status
# KIND             NAMESPACE  NAME  PHASE  READY  ENDPOINT
# App              shop       shop  Ready  True   https://shop.shop.apps.acme.paasbox.app
# ManagedPostgres   shop       db    Ready  True   db-rw.shop.svc:5432

shop scales to zero when idle and back up on the first request, with TLS on its URL from the start. db gets continuous backups and a credentials Secret; DB_HOST, DB_PORT, DB_USER, DB_PASSWORD, DB_NAME and DB_URI land in the app’s environment as references into that Secret, never as copies. The same layer adds a Redis-compatible cache or queue broker (ManagedValkey), a background worker process, a migration step before every rollout, and a preview environment per branch (pb preview up). The PaaS docs →

What runs underneath

Every App and database lives on a Kubernetes cluster — a Gardener shoot. paasbox garden up turns one Hetzner Cloud project into a Gardener landscape that creates those clusters, upgrades them, backs them up and deletes them, in about 40 minutes, one command:

curl -fsSL https://raw.githubusercontent.com/paasbox-cloud/paasbox-cli/main/install.sh | sh

paasbox garden up my-garden                                        # check → up → flux → garden → images → status
paasbox garden shoot create my-garden first --machine cpx32 --k8s 1.36

What you need

A Hetzner project and a token

The one precondition is a Hetzner Cloud project with a read/write API token. Everything else — DNS, backups, the server size, a dedicated box instead of a cloud server — is a choice, not a requirement, and the CLI does the rest.

DNS, three ways. Your own domain in Hetzner DNS; or a free name like acme.paasbox.app that the CLI obtains for you with one sign-in; or none at all, to try it.
Backups, optional at the landscape level, mandatory for every database. An etcd snapshot to an S3 bucket in your project every ten minutes, and continuous backups for every ManagedPostgres.
Two sizes. solo is one 32 GB server, about €130 net a month at Hetzner’s list price, and holds the landscape plus a few clusters. ha is three 16 GB servers, about €208, survives the loss of one.
Your own dedicated server. A server: block puts the landscape on a Hetzner Robot box you already rent. A 64 GB box from the Serverbörse starts near €60 a month.
Rehearse for free. --stub runs every command against an in-memory fake of Hetzner, SSH and Kubernetes. No server, no cost.

paasbox control plane

API server · etcd · scheduler · controllers

operated by the platform

kubeconfig⇄

your Hetzner nodes

your project · your grandfathered price

Everything runs in your project, on your token; nobody else’s account is in the path. Your own Gardener has the full sizing table, the DNS decision and the dedicated-server option.

What is open source

The CLI, the deployment it drives and the Gardener extensions for Hetzner are published under Apache-2.0. The remaining components of the landscape, including the app layer above, are being published under the same licence, one release at a time. How it is built lists every component and its licence.

paasbox-cli

The CLI and the bootstrap it drives: init, up, status, restore, upgrade, update and teardown for the landscape; create, list, kubeconfig and delete for clusters. Python, on PyPI. Docs →

paasbox-paas

The App, ManagedPostgres and ManagedValkey layer, and pb, the CLI for the three things kubectl is bad at: a deploy that only bumps the image, a status table, and previews. Docs →

The Hetzner extensions

provider-hcloud, the machine controller, DNS records, backup buckets, the cert-manager webhook and the node images. What Gardener needs to run clusters on Hetzner Cloud. Components →

Tested on real hardware

Every change runs against an in-memory fake on every push and against a real landscape before a release. The drill records are public. How →

Learn it in a course

Two live online courses, four sessions each, ten people at most. Dates are announced to the people who ask for them; there is no date on this site until the first cohort is confirmed.

Your own managed Kubernetes on Hetzner

For Hetzner customers who run, or will run, more than one cluster.

What Kubernetes gives you and what it costs. In session two you stand up your own Gardener landscape in your project. Then you create a cluster from it, upgrade it, back it up, hibernate it, delete it and make another. Session four is what it costs, what it takes to run, and when not to.

Course details →

Agentic DevOps

For engineers who own infrastructure and use coding agents on it.

How to trust infrastructure an agent wrote when nobody read all of it. The method this project runs on: a spec with dated decisions, a stateful fake with one invariant per lesson, a paid drill on real hardware, and a record. You build each artifact for your own project and prove it with a gate.

Course details →

Clusters run for you

If you want clusters and not a landscape, I run a small Gardener landscape of my own and can run clusters for you on it. Your nodes stay in your Hetzner project. It is a courtesy, not a product built to scale: one person, best effort, business hours, and you can leave at any time with your backups already in your project. A test cluster is €49 a month, a production cluster with a highly available control plane €99.

Pricing and what is included →

Operated in the open

I build paasbox with agents that write, test, drill and investigate. I decide, and I am the only one who touches a live system. What the agents may do, what only I do, which drills every change runs, and what I publish each month is written down.

How it is operated →

Launch your SaaS.On servers you rent yourself.

Get the CLI See the PaaS docs

Stay in the loop

Follow new releases and guides via the blog RSS feed, on X or GitHub. An email newsletter is coming with launch.