# Frequently Asked Questions

Here are some most commonly asked questions

# Why am I receiving a low credit warning even though auto recharge is enabled?

Users who have credits remaining for less than 7 days receive a low credit warning email once per day.  
  
To avoid this, increase your credit warning limit to a level corresponding to your cash burn rate to satisfy the 7-day credit requirement.

You can change your credit warning limit anytime within your account settings or by visiting <span style="color:rgb(230,126,35);">[https://dash.elest.io/account/<wbr>payment-options</wbr>](https://dash.elest.io/account/payment-options).</span>

# Can I install more than one software on the same VM?

Our dedicated services are running in complete isolation, so one service equals one VM. Using our CI/CD system, you can install multiple software's on a single VM.

# Can I migrate/clone my service to another cloud or region?

Yes, you can migrate or clone a running service to any other target cloud or region by simply clicking the "clone" button on the service dashboard.

[![image.png](https://docs.elest.io/uploads/images/gallery/2025-03/scaled-1680-/4Htimage.png)](https://docs.elest.io/uploads/images/gallery/2025-03/4Htimage.png)

[![image.png](https://docs.elest.io/uploads/images/gallery/2025-03/scaled-1680-/9BPimage.png)](https://docs.elest.io/uploads/images/gallery/2025-03/9BPimage.png)

[![image.png](https://docs.elest.io/uploads/images/gallery/2025-03/scaled-1680-/ha2image.png)](https://docs.elest.io/uploads/images/gallery/2025-03/ha2image.png)

# Is it possible to restrict access to my virtual machine (with a firewall)?

Yes, every service has a pre-configured firewall that allows access to the internet through ports specific to certain applications. From the service dashboard, you can easily restrict access to a single or a range of IPs.

<span style="color:rgb(230,126,35);">[Learn more about setting your firewall](https://docs.elest.io/books/security/page/network-firewall "https://docs.elest.io/books/security/page/network-firewall")</span>

# What type of support does Elestio offer?

Email and community support via our forum is available to everyone with our Test plan, with no SLA.

Staging Support plans offers a guaranteed response within 2 business days and priority queueing for support tickets, and email support.

Production Support plans offer a guaranteed response within 1 business day, highest priority queueing for support tickets, a dedicated customer success manager, and phone and email support.

  
<span style="color:rgb(230,126,35);">[Learn more about our support plans](https://docs.elest.io/books/services-dashboard/page/service-support-plans "https://docs.elest.io/books/services-dashboard/page/service-support-plans")</span>

# Can my software services communicate between different cloud providers safely?

Every Elestio project establishes a unique and secure encrypted virtual network, allowing services within the project to communicate through private IPv4 addresses.

This communication occurs with nearly line-speed throughput, regardless of location or service provider.

The driving force behind this distinctive capability is Nebula, initially developed by Slack and released as open-source software in 2020. you can learn about nebula from **[<span style="color:rgb(230,126,35);">here.</span>](https://github.com/slackhq/nebula)**

It provides a virtual private cloud (VPC) Isolated per project.

##### **How can I Enable/Disable the Global Private IP?**

<div id="bkmrk-to-toggle-the-global">To toggle the Global Private IP on or off, follow these steps:</div><div id="bkmrk-"></div><div id="bkmrk-navigate-to-the-serv">1. Navigate to the services section in the Elestio dashboard using the left sidebar.
2. Choose your specific service.
3. Locate the Network row in the same overview tab.
4. Within the Network row, find the Global Private IP switch on the right side and toggle it to enable or disable the Global Private IP.

</div>[![image.png](https://docs.elest.io/uploads/images/gallery/2023-12/scaled-1680-/HHTimage.png)](https://docs.elest.io/uploads/images/gallery/2023-12/HHTimage.png)


#####  

##### **How to associate the Service with the Private IP rather than the Public IP?**

Taking the example of the MySQL service, if you want to bind it to the Private IP instead of the Public IP, making it accessible only within the global private network of your project in Elestio, follow these steps:

1. Navigate to the services section in the Elestio dashboard using the left sidebar.
2. Choose your specific MYSQL service.
3. Click the "Update Config" button in the Software row on the Overview tab.
4. Within the docker-compose file, locate the following section:

```bash
ports:
    - '24306:3306'

```

Replace it with:

```bash
ports:
    - 'GLOBAL_PRIVATE_IP:24306:3306'

```

The value for GLOBAL\_PRIVATE\_IP 10.xx.xxx.x corresponds to your Global Private IP, and you can locate it in the service details.

 5. Click the "Update &amp; Restart" button to apply the changes.

<div id="bkmrk--2"></div><div id="bkmrk-afterward%2C-the-mysql">Afterward, the MySQL port will only be accessible from the internal network through the global private IP address on port 24306.</div><div id="bkmrk--3"></div><div id="bkmrk-this-setup-is-akin-t">This setup is akin to a Virtual Private Cloud (VPC), where all other services deployed in the same Elestio project coexist within the same Virtual VPC.</div><div id="bkmrk--4"></div><div id="bkmrk--5"></div><div id="bkmrk--6"></div><div id="bkmrk--7"></div><div id="bkmrk--8"></div>

# Can I deploy Elestio services on-premise or on my existing cloud infrastructure?

Yes, you can connect any on-premises or cloud VM managed services dashboard with our "Bring Your Own VM" (BYOVM) feature. Any software we provide can be installed on your own infrastructure, and it will be handled just like any other virtual machine (VM) we run on your behalf: backed up, updated, and secured.

<span style="color:rgb(230,126,35);">[Learn more about our BYOWM capability](https://docs.elest.io/books/cloud-providers/page/byovm-bring-your-own-vm "https://docs.elest.io/books/cloud-providers/page/byovm-bring-your-own-vm")</span>

# I'm trying to add AWS keys to Elestio but getting an error "You are not authorized to perform this operation" in BYOAWS

##### This error will appear when adding AWS Access and Secret Credentials keys if your keys do not have AmazonEC2FullAccess access permission on your AWS account.

In order to use these keys, please try to grant permission on your AWS account.

To find out more about generating AWS Access and Secret keys and granting access, see our [<span style="color:rgb(230,126,35);">***<span style="text-decoration:underline;">documentation</span>***</span>](https://docs.elest.io/books/getting-started/page/how-to-create-aws-access-and-secret-key-for-byoaws "https://docs.elest.io/books/getting-started/page/how-to-create-aws-access-and-secret-key-for-byoaws").

# Can I use OUTFILE in Managed MySQL?

Yes it's possible on Elestio. Since we are running MySQL inside a docker container you will have to modify the stack to mount a new volume in the docker-compose. You can edit it with UPDATE CONFIG button from our dashboard  
  
You will have to add a line like this in the mysql container  
\- ./files:/var/lib/mysql-files

[![image.png](https://docs.elest.io/uploads/images/gallery/2023-04/scaled-1680-/image.png)](https://docs.elest.io/uploads/images/gallery/2023-04/image.png)

Then click on the button "Apply &amp; restart"  
  
After that you can use queries like this:

```sql
SELECT * FROM `help_topic` INTO OUTFILE '/var/lib/mysql-files/test1.csv';
```

and your file test1.csv will be present on the host vm in /opt/app/files/test1.csv

You can access it over SSH / SFTP / File Explorer / VS Code ...

If you want to use InFile to import CSV to a Table, you must add another option at end of row 6 (command) of the docker-compose file:

<div id="bkmrk---local-infile%3D1"><div>--local-infile=1</div></div><div id="bkmrk--1"></div><div id="bkmrk--2"></div><div id="bkmrk-then-also-modify-the">Then also modify the mysql-docker-cli.sh to add "--local-infile" at the end of it</div><div id="bkmrk-finally-you-can-star">Finally you can start the cli with: </div><div id="bkmrk--3"></div><div id="bkmrk-.%2Fopt%2Fapp%2Fmysql-dock">./opt/app/mysql-docker-cli.sh;</div><div id="bkmrk--4"></div><div id="bkmrk-from-there-you-can-n">from there you can now load data from CSV with a query like this:</div><div id="bkmrk--5"></div><div id="bkmrk-use-your_db_name_her">use YOUR_DB_NAME_HERE;</div><div id="bkmrk-load-data-local-infi">LOAD DATA LOCAL INFILE '/var/lib/mysql-files/**yourFile.csv**' INTO TABLE **yourTableNameHere** FIELDS TERMINATED by ',' LINES TERMINATED BY '\n' IGNORE 1 LINES;</div><div id="bkmrk--6"></div><div id="bkmrk--7"></div><div id="bkmrk-you-should-then-see-">You should then see something like:</div><div id="bkmrk-query-ok%2C-10634-rows">Query OK, 10634 rows affected, 65535 warnings (0.48 sec)  
Records: 10634 Deleted: 0 Skipped: 0 Warnings: 251949</div>

# How can I automatically remove system log files in order to free up disk space?

By default, new instances are automatically configured to delete log files on a daily basis.

However, if your virtual machine (VM) does not have these files at `/opt/maintenance-daily.sh` or if you have deleted them, you can easily configure the deletion process by following the steps below.

To create a script that deletes log files on your VM, begin by accessing the terminal (Open Terminal). You can find it within the service details on the top right side of the dashboard.

Once the terminal is open, copy and paste the provided code below to create the script responsible for deleting log files.

```shell
#Create a script to remove logs every day.
echo 'echo "$(tail -c 30m /tmp/appStack.log)" > /tmp/appStack.log' >> /opt/maintenance-daily.sh
echo 'echo "$(tail -c 30m /tmp/externalBackup.log)" > /tmp/externalBackup.log' >> /opt/maintenance-daily.sh
echo 'echo "$(tail -c 30m /var/log/syslog)" > /var/log/syslog' >> /opt/maintenance-daily.sh
echo 'journalctl --vacuum-time=10d --vacuum-size=500M;' >> /opt/maintenance-daily.sh

#Grant the script executable permissions.
chmod +x /opt/maintenance-daily.sh

#To run these scripts every day, create a cron job on the virtual machine.
crontab -l | { cat; echo "0 1 * * * /opt/maintenance-daily.sh"; } | crontab -
```

You can modify these cron execution times by replacing `0 1 * * *` with your own cron execution times.

We keep a 30-mb log file by default, however, you can change the `30m` number to something else if you wish to keep a larger log file.

# How to resolve the Borg acquire lock in remote backups.

##### If you see the following error when listing, restoring, or taking manual backups for your Borg remote backups.

```bash
Failed to create/acquire the lock /root/.cache/borg/f80e5dfd25cb9/lock.exclusive (timeout).
```

##### You may simply solve it by following the instructions below:

- You can connect with the VM terminal and run the below command.

```bash
borg break-lock BorgRepoName
```

By using the command, you can determine your BorgRepoName

```bash
cd /opt/borg;
cat backupInfo.sh;
#It will return output like these:
BORG_PASSPHRASE=xxxxxxxxxxxxxxxxx borg info ssh://xxxxxxxxxxxx.repo.borgbase.com/./repo;
```

The ssh://xxxxxxxxxxxx.repo.borgbase.com/./repo; is your Borg repo name. You can use that in the command above.

<div id="bkmrk-"></div>Example: borg break-lock ssh://xxxxxxxxxxxx.repo.borgbase.com/./repo;

# How to resolve the Borg cache error in remote backups.

##### If you see the following error related to the Borg cache when listing, restoring, or taking manual backups for your Borg remote backups.

```bash
Local Exception
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/borg/archiver.py", line 5089, in main
    exit_code = archiver.run(args)
  File "/usr/lib/python3/dist-packages/borg/archiver.py", line 174, in wrapper
    assert_secure(repository, kwargs['manifest'], self.lock_wait)
  File "/usr/lib/python3/dist-packages/borg/cache.py", line 209, in assert_secure
    sm.assert_secure(manifest, manifest.key, lock_wait=lock_wait)
  File "/usr/lib/python3/dist-packages/borg/cache.py", line 174, in assert_secure
    with cache_config:
  File "/usr/lib/python3/dist-packages/borg/cache.py", line 334, in _check_upgrade
    raise Exception('%s does not look like a Borg cache.' % config_path) from None
Exception: /root/.cache/borg/f80e55dff9886465adf97645/config does not look like a Borg cache.
```

##### You may simply solve it by following the instructions below:

- You can connect with the VM terminal and run the below command.

```bash
borg delete --cache-only BorgRepoName
```

By using the command, you can determine your BorgRepoName

```bash
cd /opt/borg;
cat backupInfo.sh;
#It will return output like these:
BORG_PASSPHRASE=xxxxxxxxxxxxxxxxx borg info ssh://xxxxxxxxxxxx.repo.borgbase.com/./repo;
```

The ssh://xxxxxxxxxxxx.repo.borgbase.com/./repo; is your Borg repo name. You can use that in the command above.

<div id="bkmrk-"></div>Example: borg delete --cache-only ssh://xxxxxxxxxxxx.repo.borgbase.com/./repo;

# I added fund to my elestio account, but my service is still not running

##### If your service was suspended due to lack of credits and now it is still inactive even after adding the funds to your elestio account then please follow the below steps to active the inactive services.

> If termination protection is enabled on your service, kindly disable it first before proceeding with the action. You can find instructions on how to disable termination protection <span style="text-decoration:underline;">***<span style="color:rgb(132,63,161);text-decoration:underline;">[here](https://docs.elest.io/books/services-dashboard/page/service-protection)</span>***</span>

**Step 1:** Navigate to the <span style="color:rgb(230,126,35);">**<span style="text-decoration:underline;">[elest.io](https://dash.elest.io/)</span>**</span> dashboard and access the "***<span style="color:rgb(132,63,161);">Services</span>***" option in the left sidebar.

[![Screenshot 2023-10-05 204817.png](https://docs.elest.io/uploads/images/gallery/2023-10/scaled-1680-/screenshot-2023-10-05-204817.png)](https://docs.elest.io/uploads/images/gallery/2023-10/screenshot-2023-10-05-204817.png)

**Step 2:** Choose the specific service you wish to activate from the list, and within your service details overview, locate the "***<span style="color:rgb(132,63,161);">Power</span>***" tab.

[![image.png](https://docs.elest.io/uploads/images/gallery/2023-10/scaled-1680-/image.png)](https://docs.elest.io/uploads/images/gallery/2023-10/image.png)

**Step 3:** Activate the service by clicking the "***<span style="color:rgb(132,63,161);">Power On</span>***" button. A confirmation prompt will appear; proceed by clicking the "***<span style="color:rgb(132,63,161);">Accept</span>***" button to confirm the action.

[![image.png](https://docs.elest.io/uploads/images/gallery/2023-10/scaled-1680-/7n4image.png)](https://docs.elest.io/uploads/images/gallery/2023-10/7n4image.png)

<p class="callout success">After completing these steps, your service will become active within a matter of seconds.</p>

<p class="callout info">To prevent service suspension due to insufficient credits, consider enabling the auto-refill setting. For detailed instructions on how to set up auto-refill, <span style="color:rgb(45,194,107);">***<span style="text-decoration:underline;">[<span style="color:rgb(35,111,161);text-decoration:underline;">please refer to this guide</span>](https://docs.elest.io/books/billing/page/payment-options)</span>***</span>.</p>

# Elestio Domain shows SSL expired or Deceptive Site ahead

<span style="color:rgb(230,126,35);">**<span style="color:rgb(0,0,0);">Current Status:</span>** <span style="color:rgb(45,194,107);">Resolved @ 2023-11-04, 07:11</span></span>

<span style="color:rgb(230,126,35);"><span style="color:rgb(45,194,107);">**<span style="color:rgb(0,0,0);">Resolution:</span>** <span style="color:rgb(0,0,0);">Google unflagged our domain in less than 24h in response to our appeal</span></span></span>

<span style="color:rgb(0,0,0);">**Date of incident:** 2023-11-03, 13:22</span>

Dear Valued Customers,

We want to inform you about an incident that has recently affected our website or your services. Some regions are currently experiencing difficulties accessing our website, as Google has temporarily flagged our domain **\*.elestio.app** as unsafe, resulting in a "Deceptive Site Ahead" warning message. We understand that this may have caused some concern, and we would like to provide you with a clear explanation of the situation.

This issue stems from Google's Safe Browsing program, which is designed to protect users from visiting websites that may pose a risk to their online safety. While we have always prioritized the security and trustworthiness of our website, there has been an unfortunate misunderstanding that led to this warning.

Here's what we have done to address this situation:

1. **Immediate Investigation:** As soon as we became aware of the issue, we initiated a comprehensive investigation to determine the root cause of the warning.
2. **Review of Website Security:** We have reviewed our website's security protocols and scanned for any potential vulnerabilities or security threats to ensure the safety of your data.
3. **Communication with Google:** We have contacted Google to clarify the nature of our website and to resolve the issue. We are working closely with their team to have our domain unblocked as soon as possible.
4. **Customer Support:** Our customer support team is available to assist you with any concerns or questions you may have. Please do not hesitate to reach out if you experience any issues related to our website or your services

We want to assure you that our website is safe, secure, and has not been compromised. We value your trust and take the security of your information very seriously. We apologize for any inconvenience this may have caused and appreciate your understanding during this time.

As the situation progresses, we will keep you informed with updates regarding the resolution of this issue. Your safety and peace of mind are of the utmost importance to us, and we are committed to swiftly resolving this matter.

> **Note:** This incident will not have any impact on your custom domain. If you are currently using a custom domain with our services, rest assured that it will function as expected without any disruptions.

<p class="callout success">If your website does not currently have a custom domain and you wish to add one, please follow the steps provided [***<span style="text-decoration:underline;">here </span>***](https://docs.elest.io/books/security/page/custom-domain-and-automated-encryption-ssltls)to initiate the process.</p>

Thank you for your continued support and trust in our services. We look forward to serving you without interruption as soon as this issue is fully resolved.

<span style="color:rgb(230,126,35);">**<span style="color:rgb(0,0,0);">Current Status:</span> <span style="color:rgb(45,194,107);">Resolved @ 2023-11-04, 07:11</span>**</span>

<span style="color:rgb(0,0,0);">**Resolution:** Google unflagged our domain in less than 24h in response to our appeal</span>

We are pleased to inform you that our services are now up and running smoothly again 🎉 We sincerely appreciate all of your support and cooperation during this period. Your understanding and patience have been invaluable to us.

Sincerely,

Team Elestio.

# How are operating system(OS) upgrades managed?

<div id="bkmrk-automatic-minor-os-u">**Automatic Minor OS Updates:**</div><div id="bkmrk-"></div><div id="bkmrk--1"></div><div id="bkmrk--2"></div><div id="bkmrk-minor-operating-syst">Minor operating system updates are automatically performed every Sunday by default. (Note: This **[<span style="color:rgb(230,126,35);">setting </span>](https://docs.elest.io/books/services-dashboard/page/software-os-updates-configuration "setting")**can be modified or disabled in the service settings.)</div><div id="bkmrk--3"></div>**Major OS Updates:**

- For major updates, utilize our clone feature. This involves cloning the application stack and data from your current instance on an end-of-life OS (e.g., Ubuntu 22.04) and deploying it to a new instance with the latest OS version (e.g., Ubuntu 26.04).
- This cloning feature is accessible to all our customers.
- After cloning, review and ensure everything is functioning properly before redirecting your DNS from the old instance to the new one.

**In-Place Update (with Level 3 Support Plan):**

<div id="bkmrk-if-you-have-a-level-">If you have a Level 3 support plan, our team can perform an in-place update on your existing instance (with up to 1 hour of downtime).</div><div id="bkmrk--4"></div><div id="bkmrk--5"></div><div id="bkmrk--6"></div><div id="bkmrk--7"></div><div id="bkmrk--8"></div><div id="bkmrk--9"></div><div id="bkmrk--10">  
</div><p class="callout info">Feel free to contact our [<span style="color:rgb(230,126,35);">**support team**</span>](https://dash.elest.io/support/creation "support team") if you have any further questions or concerns about OS upgrades.</p>

# Why did the payment fail when I was attempting to add credits?

##### Encountering difficulties with payment failures while attempting to add credits? Fear not, as we've outlined a comprehensive guide to help you address the issue:

#####   
**Resolving Payment Failures: A Step-by-Step Guide**

If you've been experiencing payment failures while adding credits from our dashboard, here's what you need to do:

**1. Verify Card Details:**  
 Ensure the accurate input of your card number, expiry date, and CVV/CVC/CSC during the payment process.  
**2. International Payments Check:**  
 Confirm whether your card allows international payments, as this could be a potential reason for the payment failure.  
**3. Account Compatibility:**  
 Check that your account supports e-commerce transactions and ensure that the set limits are appropriate for a seamless payment process.

#####   
**Possible Reasons for Payment Failure:** 

If the aforementioned conditions are met and you're still facing issues, consider the following potential reasons:

**1. Unsupported Card:**  
 It's possible that the card you're using may not be supported for this type of transaction.  
**2. Insufficient Funds:**  
 Ensure that your account has sufficient funds to cover the intended payment amount.  
**3. Bank Declined Payment:**  
 The bank may have declined the card payment for security or other reasons.

For a more accurate understanding of the specific reason behind the payment failure, we recommend reaching out to [*<span style="color:rgb(230,126,35);">**Elestio's support.**</span>*](https://dash.elest.io/support/creation)

Our dedicated support team will provide precise information to help you successfully resolve the issue and get back to enjoying our services hassle-free. Feel free to contact us for any assistance you may need!

# How can project ownership or service billing be transferred to another user's account?

This guide explains how to transfer a project ownership from one Elestio account to another.

## Prerequisites

Before starting the transfer:

- The new owner must have an active Elestio account
- The new owner must be added as a member in the project with **Admin** or **Billing Admin** role
- The new owner must have sufficient credit for at least 1 month of service
- Each project can only have one owner

## Transfer Steps

### Step 1: Access Project Settings

Log in to your Elestio account and select the project you want to transfer. Click on the **Project Settings** tab.

[![Screenshot 2025-09-07 at 13.28.00.png](https://docs.elest.io/uploads/images/gallery/2025-09/scaled-1680-/screenshot-2025-09-07-at-13-28-00.png)](https://docs.elest.io/uploads/images/gallery/2025-09/screenshot-2025-09-07-at-13-28-00.png)

### Step 2: Start the Transfer

In the top right corner of the Project Settings page, click the **Transfer project** button.

[![Screenshot 2025-09-07 at 15.21.02.png](https://docs.elest.io/uploads/images/gallery/2025-09/scaled-1680-/screenshot-2025-09-07-at-15-21-02.png)](https://docs.elest.io/uploads/images/gallery/2025-09/screenshot-2025-09-07-at-15-21-02.png)

### Step 3: Enter New Owner Email

A popup window will appear. Enter the email address of the new owner in the **New Owner Email** field.

[![Screenshot 2025-09-07 at 15.21.45.png](https://docs.elest.io/uploads/images/gallery/2025-09/scaled-1680-/screenshot-2025-09-07-at-15-21-45.png)](https://docs.elest.io/uploads/images/gallery/2025-09/screenshot-2025-09-07-at-15-21-45.png)

### Step 4: Confirm Your Identity

For security, you'll need to:

1. Enter your current account password
2. Enter the verification code sent to your email

[![Screenshot 2025-09-07 at 13.32.25.png](https://docs.elest.io/uploads/images/gallery/2025-09/scaled-1680-/71yscreenshot-2025-09-07-at-13-32-25.png)](https://docs.elest.io/uploads/images/gallery/2025-09/71yscreenshot-2025-09-07-at-13-32-25.png)

### [![Screenshot 2025-09-07 at 13.38.04.png](https://docs.elest.io/uploads/images/gallery/2025-09/scaled-1680-/screenshot-2025-09-07-at-13-38-04.png)](https://docs.elest.io/uploads/images/gallery/2025-09/screenshot-2025-09-07-at-13-38-04.png)

### Step 5: New Owner Confirmation

The new owner will receive an email notification. They must accept the transfer to complete the process.

[![Screenshot 2025-09-07 at 15.13.37.png](https://docs.elest.io/uploads/images/gallery/2025-09/scaled-1680-/screenshot-2025-09-07-at-15-13-37.png)](https://docs.elest.io/uploads/images/gallery/2025-09/screenshot-2025-09-07-at-15-13-37.png)

## Important Notes

- The transfer is not complete until the new owner accepts it via email
- Once transferred, all billing responsibilities move to the new owner
- Make sure the new owner has enough credit before initiating the transfer

# How Does Elestio’s Pricing Work?

Elestio offers a flexible cloud hosting platform that allows you to deploy and manage applications with ease. Unlike traditional cloud providers, Elestio's pricing is based on an **hourly billing system** with **prepaid credits**, providing transparency and control over your expenses.

---

## 1. Hourly Billing with Prepaid Credits

Elestio operates on an **hourly billing model**, meaning you are charged for every hour a service exists on your account.

- **Billing continues until deletion:** Shutting down or powering off a service does **not** stop billing.
- **Prepaid credits:** You must add prepaid credits to your account. The hourly costs are automatically deducted.
- **Service plan determines cost**: Pricing is fixed by the plan and does not depend on usage, traffic, or resource consumption.

---

## 2. Service Plans and Pricing

Elestio offers a variety of service plans to cater to different workloads. Each plan specifies the number of CPUs, RAM, storage, and the associated **hourly cost**.

##### Netcup Plans (Hourly &amp; Monthly Approximate Cost)

<table id="bkmrk-plan-cpus-ram-storag"><thead><tr><th>Plan</th><th>CPUs</th><th>RAM</th><th>Storage</th><th>Hourly Cost</th><th>Monthly Cost\*</th></tr></thead><tbody><tr><td>NC-MEDIUM-2C-4G</td><td>2</td><td>4 GB</td><td>60 GB</td><td>$0.0219</td><td>$16</td></tr><tr><td>NC-LARGE-4C-8G</td><td>4</td><td>8 GB</td><td>100 GB</td><td>$0.0411</td><td>$30</td></tr><tr><td>NC-XLARGE-8C-16G</td><td>8</td><td>16 GB</td><td>200 GB</td><td>$0.0753</td><td>$55</td></tr><tr><td>NC-2XLARGE-16C-32G</td><td>16</td><td>32 GB</td><td>400 GB</td><td>$0.1534</td><td>$112</td></tr><tr><td>NC-3XLARGE-16C-64G</td><td>16</td><td>64 GB</td><td>600 GB</td><td>$0.2315</td><td>$169</td></tr></tbody></table>

\*Monthly cost is an approximation assuming continuous usage.

> Note: Pricing is **fixed per plan** and does **not** depend on traffic, CPU usage, or number of users.

---

## 3. Support Plans

Support plans are also **charged hourly** and can **change once a month**.

- **Support Levels:** Level 1 (Free), Level 2 ($50/service/month), and Level 3 ($200/service/month).
- **Minimum Period for Level 2 &amp; 3**:
    
    
    - For Level 2 and Level 3 support plans, you must keep your service for at least **two weeks**.
    - If you delete a service **within the first two weeks**, you will be charged a fee:
        
        
        - Level 2: $25
        - Level 3: $100
- Support plans provide features such as service support, high retention periods, automated Borg backups, snapshots, uptime guarantees, and priority assistance.

---

## 4. Billing Continuity

- **Hourly billing** continues regardless of the service power state.
- **Deleting a service** is the only way to stop charges.
- **Partial hours are billed as full hours**, ensuring predictable costs.

---

## 5. Cost Management Tips

1. **Choose the right service plan** – avoid over-provisioning.
2. **Track prepaid credits** – refill before running out.
3. **Delete unused services** – to stop hourly charges.
4. **Plan support subscriptions;** consider a minimum two-week period for Level 2 and 3 plans.

---

## 6. Conclusion

Elestio’s pricing model provides **flexibility, predictability, and control**. By understanding hourly billing, prepaid credits, service plans, and support plan rules, you can manage your cloud resources efficiently and avoid unexpected charges.

For detailed pricing and plans, visit the **<span style="color:rgb(230,126,35);">[Elestio Pricing Page](https://elest.io/pricing#pricing)</span>**<span style="color:rgb(230,126,35);">.</span>

# How to host a static frontend website on elestio

**Here is how you can host a static website on Elestio using our CICD service**

This is useful if you want to deploy a static website from a zip file or from a bunch of files, if instead your files are in a [Git repository please check this tutorial instead](https://docs.elest.io/books/cicd-pipelines/page/deploy-your-first-cicd-pipeline-on-elestio).

**1)** Open [elestio dashboard](https://dash.elest.io/) and click on CI/CD on the left menu, there click on **Docker Compose &gt; Custom docker compose**

[![image.png](https://docs.elest.io/uploads/images/gallery/2026-01/scaled-1680-/image.png)](https://docs.elest.io/uploads/images/gallery/2026-01/image.png)

**2)** on the next step select Deploy on a new VM and select your target cloud provider/region (we recommend netcup &amp; hetzner) then click on the Next button on the right side

[![image.png](https://docs.elest.io/uploads/images/gallery/2026-01/scaled-1680-/ZPEimage.png)](https://docs.elest.io/uploads/images/gallery/2026-01/ZPEimage.png)

**3)** Past in the docker compose the custom stack below then click on Create CI/CD pipeline

[![image.png](https://docs.elest.io/uploads/images/gallery/2026-01/scaled-1680-/BTXimage.png)](https://docs.elest.io/uploads/images/gallery/2026-01/BTXimage.png)

```
services:
  nginx:
    image: nginx:alpine
    ports:
      - "172.17.0.1:3000:80"
    volumes:
      - ./html:/usr/share/nginx/html:ro
```

**4)** Few minutes later the service will be deployed, then you can then connect with tools provided in Elestio service &gt; VSCode or File Explorer, from there you can place your files in /opt/app/html/ and they will be served on the default url of the pipeline.

**5)** You can also configure a custom domain for your pipeline by following [this documentation](https://docs.elest.io/books/cicd-pipelines/page/custom-domains-on-cicd-pipelines).

# How to Enable Root Login on Your VM (BYOVM)

Elestio’s **BYOVM (Bring Your Own VM)** workflow requires **direct root-level SSH access** to the target host. Many cloud providers disable or restrict root login by default; this document outlines how to safely re-enable it while maintaining a strong security posture.

<div id="bkmrk-"><div>---

</div></div>#### Architectural Requirement for Root Access

Elestio performs **low-level system provisioning and lifecycle management** directly on the host. This includes:

<div id="bkmrk-writing-configuratio"><div>- Writing configuration and state under `/root/` other privileged paths
- Installing and managing system packages and daemons
- Modifying network configuration, firewall rules, and kernel-adjacent settings
- Executing privileged deployment and orchestration tasks

</div></div>Relying on a non-root user with `sudo` is intentionally avoided due to

<div id="bkmrk-inconsistent-sudo-av"><div>- **Inconsistent `sudo` availability and behavior** across distributions and cloud images
- **Hard dependencies on root-owned paths** (e.g., `/root`, system-level configs)
- **Increased operational complexity** from privilege escalation (TTY requirements, environment differences, edge cases)
- **Higher failure surface** during automated provisioning

</div></div>From an automation and reliability standpoint, **direct root access is deterministic and reduces ambiguity**.

<div id="bkmrk--1"><div>---

</div></div>#### Security Model: Root Access with SSH Keys

Enabling root login is **not inherently insecure** when implemented correctly.

Elestio enforces the following security guarantees:

<div id="bkmrk-password-authenticat"><div>- **Password authentication is permanently disabled**
- **Only SSH key-based authentication is permitted**
- **Root login is restricted to key-based access (`prohibit-password`)**

</div></div>##### Implications

<div id="bkmrk-no-password-based-lo"><div>- No password-based login is possible under any circumstances
- Attack vectors such as brute-force or credential stuffing are eliminated
- Access is strictly limited to holders of the corresponding private key

</div></div>Blocking the root while allowing SSH access to an enabled user does **not materially improve security**. Any compromise of such a user trivially escalates to root (`sudo su`). The **true security boundary is the SSH private key**, not the username.

<div id="bkmrk--2"><div>---

</div></div>##### Step 1: Remove Provider-Imposed Restrictions

Some providers (notably AWS and GCP) inject a forced command `/root/.ssh/authorized_keys` to prevent root login:

```bash
no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"ubuntu\" rather than the user \"root\".';echo;sleep 10;exit 142"
```

<div id="bkmrk--3"><div></div></div>This must be removed.

Execute as a privileged non-root user (e.g., `ubuntu`, `ec2-user`):

```bash
sudo sed -e "s/echo;sleep 10;exit 142//g" -i /root/.ssh/authorized_keys
```

Validate:

```bash
sudo cat /root/.ssh/authorized_keys
```

Expected state: **only raw public key entries, no `command="..."` prefix**.

<div id="bkmrk--4"><div>---

</div></div>##### Step 2: Configure SSH Daemon

Inspect the current configuration:

```bash
sudo grep -i PermitRootLogin /etc/ssh/sshd_config
```

Enforce the correct policy:

```bash
sudo sed -i 's/^.*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
```

##### Semantics

<div id="bkmrk-prohibit-password-%E2%9C%85-"><div>- `prohibit-password`
    
    
    - ✅ (allows) SSH key authentication
    - ❌ (blocks) password authentication

</div></div>This is the **recommended and secure baseline configuration**.

<div id="bkmrk--5"><div>---

</div></div>##### Step 3: Reload SSH Service

Apply changes without terminating the active session:

```bash
sudo systemctl reload sshd || sudo service ssh reload
```

<div id="bkmrk--6"><div>---

</div></div>##### Step 4: Validate Root Access

From your local environment:

```bash
ssh -i /path/to/private_key root@<server_ip>
```

A successful connection should yield a root shell immediately.

<div id="bkmrk--7"><div>---

</div></div>##### Provider Behavior Matrix

<div id="bkmrk-provider-root-access"><div><table><thead><tr><th>Provider</th><th>Root Access Default</th><th>Notes</th></tr></thead><tbody><tr><td>AWS EC2 (Ubuntu)</td><td>Blocked</td><td>Requires `authorized_keys` fix</td></tr><tr><td>AWS EC2 (Amazon Linux)</td><td>Blocked</td><td>Requires `authorized_keys` fix</td></tr><tr><td>Google Cloud</td><td>Blocked</td><td>Requires `authorized_keys` fix</td></tr><tr><td>Azure</td><td>Blocked</td><td>Controlled via `sshd_config`</td></tr><tr><td>DigitalOcean</td><td>Enabled</td><td>No action required</td></tr><tr><td>Hetzner</td><td>Enabled</td><td>No action required</td></tr><tr><td>Vultr</td><td>Enabled</td><td>No action required</td></tr><tr><td>Linode (Akamai)</td><td>Enabled</td><td>No action required</td></tr></tbody></table>

</div></div>For AWS and GCP, **Step 1 is mandatory** in most cases.

<div id="bkmrk--8"><div>---

</div></div>##### Troubleshooting

##### Root login still denied

Check for override files:

```bash
sudo grep -r PermitRootLogin /etc/ssh/sshd_config.d/
```

Ensure all instances are set to:

```text
PermitRootLogin prohibit-password
```

<div id="bkmrk--9"><div>---

</div></div>##### Forced “login as ubuntu” message

Indicates the provider-injected restriction is still present.

Re-run Step 1 and re-validate `/root/.ssh/authorized_keys`.

<div id="bkmrk--10"><div>---

</div></div>##### SSH key not accepted

Ensure the key exists and permissions are correct:

```bash
sudo cat /root/.ssh/authorized_keys
```

If missing:

```bash
sudo cp ~/.ssh/authorized_keys /root/.ssh/authorized_keys
sudo chmod 600 /root/.ssh/authorized_keys
sudo chown root:root /root/.ssh/authorized_keys
```

<div id="bkmrk--11"><div>---

</div></div>##### Consolidated Execution Block

```bash
# Remove provider-enforced root restriction
sudo sed -e "s/echo;sleep 10;exit 142//g" -i /root/.ssh/authorized_keys

# Enable root login via SSH key only
sudo sed -i 's/^.*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config

# Normalize any drop-in overrides
sudo sed -i 's/^.*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config.d/*.conf 2>/dev/null || true

# Reload SSH daemon
sudo systemctl reload sshd || sudo service ssh reload
```