Standard Cloud Guide

Starter Cloud plan includes a dedicated Docker container for your AI team. This guide covers provisioning, terminal access, GitHub setup, and lifecycle management.

What you get

A dedicated Ubuntu 22.04 container on Hetzner arc-cloud-prod (157.180.44.232):

• Claude CLI pre-installed and authenticated
• Arc binary pre-installed
• Persistent /workspace volume (survives container restarts)
• Non-root arcuser for security
• 1.5 vCPU, 2 GB RAM, no-new-privileges security policy

Provisioning

1. Upgrade to Starter Cloud plan (Settings → Billing).
2. Go to Settings → Cloud Workspace.
3. Click Provision Container — takes ~30 seconds.
4. Once status shows ready, click Open Terminal.

Web Terminal

The terminal is a full xterm.js WebSocket session proxied through the CRM server. You can run:

arc <project>          # start a bridge session
claude -p "..."        # direct Claude call
git clone ...          # clone your repo into /workspace

The session uses your CRM JWT for auth — no SSH keys needed from your browser.

Chat ↔ Cloud routing (Phase 70)

Once provisioned, chat messages from CRM or Telegram run inside your container, not on the master server. The worker spawns claude -p in /workspace/<project>; edits land in your bot-org repos; idle pause snapshots push the work to GitHub. Full guide: cloud-chat-routing.md.

Repositories

Every Arc OS project automatically gets a private repo under a bot-managed GitHub organisation. Your Cloud Workspace clones every project repo into /workspace/<project> on provision, and pushes a snapshot on pause. You drive the sync from your laptop via arc pull / arc push / arc cloud sync.

For the full model — three repo types (system / project / external), the naming convention, day-to-day commands, and external-repo flow — see cloud-repos.md.

GitHub SSH Setup (for external repos)

The Arc OS auto-managed repos described above need zero setup — they authenticate via a short-lived installation token written to ~/.git-credentials automatically. The SSH setup below is only needed when you want to clone your own private GitHub repos as external entries under the Repositories panel:

1. In Settings → Cloud Workspace, click GitHub SSH Setup.
2. Arc OS generates an Ed25519 key pair in the container.
3. Copy the public key shown in the UI.
4. Add it to GitHub → Settings → SSH and GPG keys → New SSH key.
5. Test with ssh -T [email protected] in the terminal.

Idle & Resume

Containers auto-pause after 30 minutes of inactivity (cron runs every 5 min on the API server). This is intentional — a paused container costs $0 compute.

To resume:

• Send any message in CRM Workspace chat
• Run /continue in Telegram (if your project has a TG bot)
• Click Resume in Settings → Cloud Workspace

Resume takes ~2-3 seconds (Docker unpause).

Lifecycle States

Cancellation

When you cancel Starter Cloud:

• Container status changes to paused immediately
• Your /workspace data is preserved for 7 days
• After 7 days, container is deprovisioned

To re-activate, upgrade back to Starter Cloud — a new container is provisioned.

Security

• Container runs as arcuser (non-root)
• --cap-drop=ALL --security-opt=no-new-privileges at runtime
• SSH bridge from API server uses dedicated hetzner_ed25519 key (not your personal key)
• Container IP is internal to Hetzner network — no direct public access
• All traffic proxied through 62.171.128.248 (Contabo API server) → 157.180.44.232 (Hetzner containers)