The upgrade everyone reaches for second. It solves the obvious problem completely, and quietly introduces the one that makes people give up.
A server you rent is always on, properly reachable, and yours. If you already run infrastructure, already have opinions about your base image, and would rather own the whole stack than rent it, a VPS is a perfectly good answer and costs a few dollars a month in machine time. Plenty of capable people run exactly this and are happy. The question is not whether it works. It is what it asks of you every week after it works.
The server is a few dollars. The hours are the price: the OS patches, the container that stopped, the certificate that expired, the disk that filled with logs. None of it is hard. All of it arrives without asking whether this was a good week.
The agent runtimes move fast, and a release that changes a config format arrives whenever it arrives. On your own box you find out because something stopped, usually at the worst moment, and rolling back is your problem too.
Docker on a shared kernel is a good boundary against accidents and a weaker one against a determined escape. Running several agents on one host means a compromise in the careless one reaches the careful one, and building real per-agent isolation is a serious piece of work most people correctly decide not to do.
Every agent gets its own gVisor sandbox with a kernel-level boundary, its own namespace, service account and network policy, and no public ports. It can reach the public web, but never our internal network, the cloud metadata server or other tenants. Updates are tested on our own agents first, then rolled out with undo, pause and reinstall available from the dashboard. With the Backups add-on (included on Max), backups run daily with 30 days of history and one-click restore. The patching, the certificates and the disk are not on your list any more.
Keep your server if running infrastructure is something you are good at and enjoy, or if a requirement genuinely forces the whole stack to be yours. Move when you notice the maintenance is the reason you have stopped improving the agent itself, or when you want more than one agent and per-agent isolation becomes the next project.
Your agent, running on isolated infrastructure in the EU, reachable in the apps you already open.
