GHOST series

Servers that forget when you unplug them.

A GHOST instance has no disk. Not an encrypted disk — no disk. It PXE-boots a signed image straight into memory and runs its whole filesystem from tmpfs. Cut the power and the data is not deleted, not overwritten, not securely erased. It is gone, because DRAM cannot hold state without current.

It is the one place in this industry where “your data is unrecoverable” is a claim about physics rather than a promise about our intentions.

Deploy a GHOST instance Read the technical article

Boot sequence

What happens when a GHOST instance starts

No local storage device is attached to the instance at any point. Here is the whole chain, and where it verifies itself.

1
PXE request
The NIC's boot ROM asks for an address and a boot file over DHCP. Nothing has been read from a disk, because there is no disk.
2
iPXE over HTTPS
iPXE fetches the kernel and the initramfs over TLS from our provisioning host. Not TFTP — TFTP is unauthenticated and we do not use it.
3
Signature verification
The initramfs verifies a detached minisign signature over the root image against a key baked into it. If verification fails, the boot halts. It does not continue with a warning.
4
Unpack into tmpfs
The root filesystem is decompressed into tmpfs — a filesystem that exists only in the kernel page cache and has no backing store. Swap is disabled and cannot be enabled.
5
switch_root
Control passes to the real init. cloud-init applies your configuration. The machine is up, typically 31 seconds after power-on.

ghost-m · boot transcript

[    0.00] iPXE 1.21.1 -- Open Source Network Boot
[    0.31] net0: 52:54:00:c3:9f:11 using virtio-net
[    0.44] Configuring (net0)... ok
[    0.51] https://boot.is.vpsden.com/ipxe/ghost.efi
[    1.08] ok (3.2 MB)

[    1.09] Fetching kernel ......................... ok
[    1.44] Fetching initramfs ...................... ok
[    1.92] Fetching root.squashfs (312 MB) ......... ok

[    4.71] minisign: verifying root.squashfs
[    4.73] minisign: signature OK
[    4.73]   key <our minisign public key>
[    4.74]   sha256 <digest not published yet — see below>

[    4.75] mounting tmpfs on /newroot (16.0G)
[    6.88] unpacked 312 MB -> 894 MB in tmpfs
[    6.89] swap: DISABLED (no backing device present)
[    6.90] block devices: none

[    7.02] switch_root /newroot
[    9.41] cloud-init: applying vpsden:cfg#7f2a
[   28.9 ] systemd: reached target multi-user
[   31.2 ] ready

# lsblk
(no output — there are no block devices)

Honest threat analysis

What this defeats, and what it does not

Being precise here matters more than the sales pitch. RAM-only is a strong control against one specific class of threat and does nothing at all against others.

Threat	GHOST	Encrypted disk
Hardware seized and taken to a lab
Drive imaged after decommissioning
Forensic recovery of deleted files
Persistent rootkit surviving reboot
Accidental retention (logs, shell history, caches)
Snapshot taken while powered off
Provider compelled to hand over the volume
Snapshot taken while running
Live root compromise of the guest
Hypervisor operator reading guest memory
Cold boot attack at the moment of seizure	partial	partial
Network traffic interception

The cold boot caveat, stated plainly

DRAM does not decay instantly. Halderman et al. (USENIX Security, 2008) showed contents persist for seconds at room temperature and minutes when chilled. Exploiting that needs an adversary at the rack, at the moment power is cut, with cooling ready — it does not work after transport. That covers essentially every real hosting seizure, but not all conceivable ones, and anyone telling you otherwise is selling something.

Where GHOST adds nothing

If your risk is network interception, a compromised application, or a hostile hypervisor, GHOST is the wrong control and you are paying a RAM premium for a property you do not need. Encryption in transit and a smaller attack surface would serve you better. We would rather tell you that than sell you the expensive tier.

Making it practical

Four patterns for running real workloads on amnesiac hardware

Most software expects to keep things. These are the approaches our customers actually use.

Declarative configuration

Boot with a NixOS or cloud-init configuration that fully describes the machine. Nothing needs to persist because everything is reconstructed from the configuration itself. NixOS is our default GHOST image for exactly this reason — the configuration is the machine.

Off-node encrypted state

Keep the small amount that genuinely must survive — a database, a keyring, an onion service key — as an encrypted blob in a second jurisdiction, pulled and decrypted at boot with a key you supply. We hold ciphertext and a byte count. €3/month.

Naturally stateless services

Tor relays, VPN endpoints, reverse proxies, mail relays, CDN edges, build workers, load balancers. These need no adaptation at all and are the most common GHOST workload by a wide margin.

Streaming persistence elsewhere

Write to a durable store over the network — an encrypted object store, or a database on a cheap disk-backed instance in another region. The GHOST node becomes compute and never a system of record.

Short answer

What is the most common GHOST setup?

A GHOST instance handling the sensitive front-half of a workload, paired with a cheap disk-backed instance in a second jurisdiction holding encrypted state. You get amnesia where it matters and cost-effective durability where it does not — and if the GHOST node is seized, the seizing party gets a diskless chassis.

Verify our images yourself

You are trusting the image we serve. That trust should be checkable, so our GHOST images are built reproducibly and both the hashes and the signing key will be published. Two builders starting from the same source tree get byte-identical output.

The image mirror and the signing key are not up yet. The commands below are the shape of the procedure rather than URLs you can run today, and we have deliberately not printed a public key that does not exist — a signing key is worth nothing unless you can check it against a source that is not us.

# fetch the current GHOST root image and its signature
curl -sO https://vpsden.com/images/<image>.squashfs
curl -sO https://vpsden.com/images/<image>.squashfs.minisig
minisign -Vm <image>.squashfs -P <our minisign public key>

# reproduce the build from source and compare
git clone https://git.vpsden.com/images.git && cd images
./build.sh <image>
sha256sum out/root.squashfs

Once the digests are up, a hash you produce that differs from the one we list will be a serious finding and we will want to hear about it immediately. Our security.txt has the contact.

You can also skip our images entirely: bring your own PXE-bootable image and supply your own signing key, and we will boot it without ever seeing its contents.

Plans

GHOST pricing

GHOST S

Diskless

€29.00

−42%

Diskless. The entire filesystem lives in volatile memory and dies with the power.

€16.90/month

€0.0232/hour · up to −28% on term

vCPU: 2
Memory: 8 GB (also your disk)
Storage: None — RAM only
Transfer: 10 TB @ 1 Gbps
IPv4 / IPv6: 1× / /64

Zero persistent storage — nothing to seize
PXE-booted signed image, verified at every boot
Reboot = provable total erasure
Config re-applied from your signed cloud-init

Configure GHOST S

GHOST M

Most deployed

€55.00

−42%

The size most people actually want: enough RAM to hold a real workload and its filesystem.

€31.90/month

€0.0437/hour · up to −28% on term

vCPU: 4
Memory: 16 GB (also your disk)
Storage: None — RAM only
Transfer: 20 TB @ 1 Gbps
IPv4 / IPv6: 1× / /64

Zero persistent storage — nothing to seize
PXE-booted signed image, verified at every boot
Reboot = provable total erasure
Optional encrypted off-node state vault
Dead-man switch included

Configure GHOST M

GHOST L

Diskless

€105.00

−43%

For workloads where the dataset itself must never touch a platter.

€59.90/month

€0.0821/hour · up to −28% on term

vCPU: 8 dedicated
Memory: 32 GB (also your disk)
Storage: None — RAM only
Transfer: 40 TB @ 1 Gbps
IPv4 / IPv6: 1× / /64

Zero persistent storage — nothing to seize
Dedicated cores, no oversubscription
PXE-booted signed image, verified at every boot
Optional encrypted off-node state vault
Dead-man switch + duress PIN
Multi-jurisdiction failover included

Configure GHOST L

RAM costs roughly forty times what NVMe does per gigabyte, which is the entire reason GHOST is priced above the disk-backed tiers. There is no privacy surcharge — you are paying for memory.

Questions

RAM-only questions

What is a RAM-only server?

A RAM-only server has no persistent storage attached. It network-boots a cryptographically signed image directly into memory and runs its entire filesystem from tmpfs. Because DRAM requires continuous power to retain state, an unplugged, seized or rebooted RAM-only node contains nothing recoverable.

What happens to my data if the server reboots?

Everything in the filesystem is lost, by design. The instance re-fetches its signed image and re-applies your cloud-init configuration, coming back as a clean machine. Anything that must survive should be held in an off-node encrypted state vault or written to a durable store over the network.

Are RAM-only servers vulnerable to cold boot attacks?

In principle yes, in practice rarely. Halderman et al. showed in 2008 that DRAM retains contents for seconds at room temperature and minutes when chilled. Exploiting that requires an adversary physically present at the rack at the moment power is cut, with cooling equipment prepared. It does not work after hardware has been transported, which describes essentially every real hosting seizure. Modern DDR4 and DDR5 also decay considerably faster than the modules used in the original research, and we enable memory scrambling and clear-on-reset in firmware.

How much does a RAM-only server cost?

VPSDEN GHOST instances start at €16.90 per month for 2 vCPU and 8 GB of RAM, rising to €59.90 for 8 dedicated cores and 32 GB. RAM is roughly forty times the cost per gigabyte of NVMe, which is why diskless instances are priced above equivalent disk-backed ones.

Deploy something that cannot be recovered.

GHOST instances from €16.90/month, live in about 31 seconds, paid in Monero.

Deploy GHOST M Read the deep dive

No email · No KYC · Pay in Monero · Deployed in under a minute