Fased on GCP Compute Engine
Use a normal Compute Engine Linux VM and the maintained Hosting installer.
It creates the non-root application account, installs the independent native
signer and root updater, configures systemd, joins Tailscale, hardens remote
access, and keeps updates and rollback coordinated.
Do not run the full Docker Gateway on a GCP VM. Docker Gateway support is Local
only, and there is no install.sh --hosting-docker mode. On Compute Engine, use
install.sh --hosting exactly as shown below.
What you need
- A Google Cloud project with billing and Compute Engine enabled
- A VM running Ubuntu LTS (recommended)
- Initial SSH access through
gcloud or the Google Cloud console
- A Tailscale account
- Tailscale installed and signed into the same tailnet on your own computer
- Project/VM console access retained for emergency recovery
Use the general VPS sizing guidance before
choosing a machine. Do not create a firewall rule for the raw Gateway port
(18789).
1. Create the VM
You can use the Compute Engine console, or create an Ubuntu LTS VM with
gcloud. Select the current Ubuntu LTS image family offered in your project
and a machine size that meets the VPS sizing guidance. For example:
Provider image names can change; if that family is unavailable, select the
current Ubuntu LTS image in the console or list available families before
creating the VM.
2. Enter a root shell on the VM
The remaining installation commands run inside that root shell, not on your
local computer.
3. Run the Hosting installer
From the provider root console, follow the
one-command Hosting guide. It verifies the tagged Hosting
release before privileged Fased installation. Do not install Docker, Node, Go,
or Fased globally first.
When Tailscale prints a login URL, open that URL in the browser on your own
computer and approve the VM. Return to SSH only after the VM appears in the
correct tailnet. The installer stops before SSH/firewall lockdown if it cannot
verify a valid tailnet address.
4. Verify private access
From your own computer, with Tailscale connected to the same tailnet:
If no application SSH key was available during bootstrap, use:
Do not close the bootstrap session until private access works.
5. Verify Fased
As the app user on the VM:
The install is ready only when health passes, the Gateway is running, the RPC
probe succeeds, plugins are clean, and signer doctor reports the expected
native protocol.
6. Open the Control UI privately
Keep the Gateway on loopback. If you need a direct browser tunnel, run this on
your own computer:
Then open http://127.0.0.1:18790/. Use the dashboard/token instructions
printed by the installer; never publish port 18789 through a GCP firewall or
external load balancer.
Updates and repair
For a normal update, connect as app over Tailscale and run:
Use install.sh --hosting again only for an intentional hosted repair or
reinstall. See VPS Hosting and
Updating and rollback for the complete lifecycle and
backup guidance.
Container note
Docker may still be installed on the same VM for optional per-session Agent
sandboxing while the Gateway and native signer remain managed by the host
installer. That is different from running the full Gateway in Docker. See
Sandboxing.