nubo runners
A deploy target. On hardware you own.
A Nubo runner is a small process you install on your server. It opens an outbound connection to Nubo and turns the machine into a deploy target, with the same push-to-deploy flow, logs, and rollbacks as the managed cloud. Point a coding agent at Nubo over MCP and it can create Frames, push builds, and read logs on its own.
linux x86_64 or arm64 · kernel 4.x or newer · no inbound ports
One command. Installed in under a minute.
Run it on any Linux box that can dial out. The runner connects to Nubo and the machine shows up in your dashboard as a deploy target.
Outbound only. Reverse-tunneled.
The runner opens one outbound connection to Nubo's control plane. Deploys arrive over that channel, and logs and status stream back the same way. You don't open any inbound ports or punch holes through the firewall.
runner live link · websocket
*.frames.example.com → your server
- · runner connected
- · task dispatched
- · logs streaming back
- · rolled out
nubo-agent
- · docker + caddy ready
- · pulling git repo
- · building image
- · serving traffic
Cloud convenience. Server control.
- Same dashboard, same flow · Push to deploy, real-time logs, one-click rollback. Identical to Nubo Cloud, just running on hardware you control.
- No vendor lock-in · Your code lives in your repo, runs on your machine. Nubo orchestrates; the bits stay yours.
- Egress on you · Traffic stays on your network. We don't meter the bandwidth on your own box.
- Mix with cloud · Run production on Nubo Cloud, staging on the runner in your basement. Or the other way around.
Anywhere with a shell.
Linux x86_64 or arm64, kernel 4.x or newer. That's it. The runner doesn't need its own hostname, its own IP, or a public port.
- home labs Home lab · An old Mac mini, a Raspberry Pi cluster, a NUC under the desk.
- vps $5 VPS · Hetzner, DigitalOcean, OVH, Vultr. Anywhere with a public IP and a shell.
- on-prem On-prem · The rack in the office, the server you provisioned a year ago, the box in the closet.
- edge Edge boxes · Branch offices, retail stores, factory floors. Ship updates without touching the device.
How the runner talks to us.
End-to-end TLS, scoped tokens, and outbound-only connections. The runner never accepts incoming traffic; it dials home, and that's the only path in or out.
- tls All traffic uses TLS to shuttle.withnubo.com. Mutual auth with the runner's signed token.
- tokens Each runner has its own token, scoped to its Frames. Rotate or revoke from the dashboard, anytime.
- outbound No inbound ports. The runner dials Nubo and keeps the channel open. Firewall stays closed.
- data Logs and metrics flow back through the same channel. Nothing else leaves the box.
stop reading
Go deploy something.
Free for 7 days, no card, no sales call. We will not pretend this page wasn't built to make you want to ship on a Sunday. It was.