Your own Gardener on Hetzner, in one command.

paasbox is an open-source CLI. It turns one Hetzner Cloud project into a Gardener landscape: a control plane that creates Kubernetes clusters, upgrades them, backs them up, hibernates them and deletes them. Everything runs in your project, on your token. Apache-2.0.

Get the CLI on GitHub Read the docs

Not released yet (as of 2026-09-08): the public repository and the PyPI package do not exist yet. Say so if you want it, and you will hear when the first tag lands.

Also: two live courses, and clusters run for you if you would rather not run a landscape.

From a Hetzner token to a cluster

curl -fsSL https://raw.githubusercontent.com/paasbox-cloud/paasbox-cli/main/install.sh | sh

paasbox doctor                   # lists missing tools, with the install line for each
paasbox garden init my-garden    # writes my-garden/values.yaml
export HCLOUD_TOKEN=…            # the only secret the simplest setup needs
paasbox garden up my-garden      # check → up → flux → garden → images → status

paasbox garden shoot create my-garden first --machine cpx32 --k8s 1.36
paasbox garden shoot kubeconfig my-garden first --out first.kubeconfig

About 40 minutes after up, one Hetzner server runs a k3s cluster, Gardener’s virtual garden, a seed and the Gardener Dashboard. From then on you create clusters, which Gardener calls shoots, from the dashboard, with kubectl, or with the CLI. Gardener runs them: control planes as pods on the seed, workers as Hetzner servers, upgrades in a maintenance window, etcd backups, certificates, DNS. The first shoot is ready about nine minutes after you ask for it.

What you need

A Hetzner project and a token

The one precondition is a Hetzner Cloud project with a read/write API token. The CLI generates an SSH key if you have none, checks for the tools it needs and prints the install line for each missing one.

DNS, three ways. Your own domain in Hetzner DNS; or a free name like acme.paasbox.app that the CLI obtains for you with one sign-in; or none at all, to try it.
Backups, optional. An etcd snapshot to an S3 bucket in your project every ten minutes, and an in-place restore. Off by default.
Two sizes. solo is one 32 GB server, about €130 net a month at Hetzner’s list price, and holds the landscape plus a few clusters. ha is three 16 GB servers, about €208, survives the loss of one, and holds about twelve.
Your own dedicated server. A server: block puts the landscape on a Hetzner Robot box you already rent. A 64 GB box from the Serverbörse starts near €60 a month.
Rehearse for free. --stub runs every command against an in-memory fake of Hetzner, SSH and Kubernetes. No server, no cost.

paasbox control plane

API server · etcd · scheduler · controllers

operated by the platform

kubeconfig⇄

your Hetzner nodes

your project · your grandfathered price

What is open source

The CLI, the deployment it drives and the Gardener extensions for Hetzner are published under Apache-2.0. The remaining components of the landscape are being published under the same licence, one release at a time. How it is built lists every component and its licence.

paasbox-cli

The CLI and the bootstrap it drives: init, up, status, restore, upgrade, update and teardown for the landscape; create, list, kubeconfig and delete for clusters. Python, on PyPI. Docs →

The Hetzner extensions

provider-hcloud, the machine controller, DNS records, backup buckets, the cert-manager webhook and the node images. What Gardener needs to run clusters on Hetzner Cloud. Components →

Tested on real hardware

Every change runs against an in-memory fake on every push and against a real landscape before a release. The drill records are public. How →

Learn it in a course

Two live online courses, four sessions each, ten people at most. Dates are announced to the people who ask for them; there is no date on this site until the first cohort is confirmed.

Your own managed Kubernetes on Hetzner

For Hetzner customers who run, or will run, more than one cluster.

What Kubernetes gives you and what it costs. In session two you stand up your own Gardener landscape in your project. Then you create a cluster from it, upgrade it, back it up, hibernate it, delete it and make another. Session four is what it costs, what it takes to run, and when not to.

Course details →

Agentic DevOps

For engineers who own infrastructure and use coding agents on it.

How to trust infrastructure an agent wrote when nobody read all of it. The method this project runs on: a spec with dated decisions, a stateful fake with one invariant per lesson, a paid drill on real hardware, and a record. You build each artifact for your own project and prove it with a gate.

Course details →

Clusters run for you

If you want clusters and not a landscape, I run a small Gardener landscape of my own and can run clusters for you on it. Your nodes stay in your Hetzner project. It is a courtesy, not a product built to scale: one person, best effort, business hours, and you can leave at any time with your backups already in your project. A test cluster is €49 a month, a production cluster with a highly available control plane €99.

Pricing and what is included →

Operated in the open

I build paasbox with agents that write, test, drill and investigate. I decide, and I am the only one who touches a live system. What the agents may do, what only I do, which drills every change runs, and what I publish each month is written down.

How it is operated →

Run your own Gardener.One project, one token, one command.

Get the CLI Read the docs

Stay in the loop

Follow new releases and guides via the blog RSS feed, on X or GitHub. An email newsletter is coming with launch.