Cerbos Hosting Live In 5 Minutes

Deploy Cerbos hosting and run a self-hosted authorization service that answers whether a user may act on a resource, on a dedicated Cloud VPS. xCloud starts the pinned Cerbos 0.56.0 container with a persistent policy volume, serves the HTTP API and explorer over HTTPS on your domain, publishes a gRPC port and turns telemetry off. It has no login of its own, so you control who can reach it.

Deploy your Cerbos

No terminal
No technical skills needed
No lock-in, cancel anytime

What is Cerbos?

Cerbos is an authorization layer that lets you define context-aware access control rules for your application resources in simple YAML policies. Its Policy Decision Point is a stateless service that your applications ask whether a principal may perform an action on a resource, through CheckResources and PlanResources calls, supporting both roles and attribute-based conditions. Run on your own server it is a self-hosted Cerbos, an alternative to a hosted authorization service such as AWS Verified Permissions, under the Apache-2.0 licence.

On xCloud it is one container, ghcr.io/cerbos/cerbos 0.56.0 pinned by digest, with the cerbos_policies volume at /policies. The HTTP API and explorer sit behind HTTPS and a gRPC port is published on a host port. There is no database, no login and no API key, and the policy store starts empty.

From Sign-Up to a Live Cerbos In Just 3 Easy Steps

A Cerbos install normally means the PDP container, a policy directory, a CORS and server config, an HTTPS front end and a decision about the gRPC port before the first check. This is the same result without assembling any of it.

Step 01
Sign Up
Create your xCloud account and pick Cerbos from the OneClick catalog. Choose a domain and a server; the install form has no fields and generates nothing, because Cerbos has no accounts.
Step 02
We Deploy It For You
One click. We start ghcr.io/cerbos/cerbos 0.56.0, pinned by digest, as one container, mount cerbos_policies at /policies, restrict browser origins to your domain, turn telemetry off and publish the HTTP API over HTTPS. It is ready in seconds.
Step 03
Add Policies And Decide Who Can Reach It
The policy store starts empty, so every check is denied. Copy YAML files in over SSH with docker cp and the server reloads them. Open the gRPC port only for your application servers, or leave it closed and use the HTTP API.

Everything Cerbos Does, On Your Own Server

Cerbos 0.56.0 runs here as a stateless decision point, with its policies kept as YAML files on a volume you own.

Policies As YAML Files
Define access rules for each resource in simple, structured YAML. The disk driver watches the directory and applies changes without a restart.
RBAC And ABAC
Start with roles and extend to attribute-based conditions evaluated at run time, with derived roles, as upstream describes.
CheckResources And PlanResources
Ask whether a principal can access a resource, or which resources of a kind a principal can access, through the HTTP API or gRPC.
Stateless, No Database
Cerbos needs no database here: policies are files read from a persistent volume, and the service holds no session state.
No Login, You Control Access
There are no users or API keys. Anyone who can reach the domain or the gRPC port can send requests, so restrict access yourself.
Telemetry Off, Admin API Off
Anonymous telemetry is disabled, and the admin API is never switched on, so policies cannot be changed over the network.

Everything You Need To Run Your Authorization Service 24/7

Managed hosting for Cerbos, so the parts that keep it online are not your problem.

Cerbos 0.56.0 deployed instantly
Image pinned by digest
Telemetry turned off
Admin API never enabled
Free SSL certificate
Server backups and snapshots
Server security updates included
30+ server locations
Unused balance refunded

What You Can Do With Cerbos

Move permission checks out of your application code
Ask Cerbos whether a user may approve an expense or edit a report, instead of scattering if-statements through every service.
Filter lists by what a user may see
Use PlanResources to get the conditions for which resources of a kind a principal can access, then turn them into a database query.
Version policies in Git
Keep YAML policies in version control, validate them with cerbosctl compile or the test runner, then copy them to the server.
Serve many applications from one decision point
Let several services call one Cerbos over HTTP or gRPC, with access to it limited to your own application servers.

Cerbos vs Alternatives

AWS Verified Permissions: A managed authorization service from AWS; Cerbos is Apache-2.0 software you run yourself, with policies as YAML files on your own xCloud server.
OpenFGA: A fine-grained authorization server, available as its own OneClick app; compare its relationship-based model with Cerbos's YAML policies of roles and conditions.
Open Policy Agent: A general-purpose policy engine with its own policy language; compare it with Cerbos's resource-focused YAML format before choosing.
Keycloak: An identity and access management server, available as a OneClick app; it handles sign-in, where Cerbos decides what a signed-in user may do.

Simple Pricing. Everything Included.

Dedicated Cloud VPS sizes, pre-configured for Cerbos hosting. Pick the one that fits, and resize any time.

Cloud VPS 6 GB

Cloud VPS 16 GB

Room for Cerbos beside the services that call it.

$59.99per month

16 GB RAM
6 vCPU cores
200 GB NVMe SSD
30 TB
Unlimited

Get started

Every size is a dedicated Cloud VPS we provision, patch, monitor and restore. Billed monthly with no lock-in — delete the server and the unused balance comes back to your account. Cerbos itself is released under the Apache-2.0 licence.

Docker hosting

Already Have a Server? Bring Your Own

Connect any VPS — DigitalOcean, Vultr, Linode, AWS, Hetzner or bare metal — and deploy Cerbos on it through the same panel, for a per-server management fee instead of a Cloud VPS rental.

Free

Start your journey without cost.

$0forever

1 server
10 sites

Start free

Starter

Professional

The same platform, discounted at 6–10 servers.

$4per server / month

6–10 servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Agency

The same platform, discounted at 11+ servers.

$3per server / month

11+ servers
Unlimited sites
All features included
Bring any VPS provider

Get started

Priced per connected server, so your rate adjusts automatically as you add or remove servers. You pay your own provider for the server itself.

Self-managed hosting

Ready To Run Your Own Authorization Service?

Cerbos on xCloud runs on a dedicated Cloud VPS that we provision, patch, monitor and restore. Deploy faster. Own your data. Stay in control.

Fast Provisioning
Deploy faster using an xCloud Managed Server built with optimized stacks and high-speed SSDs.
Enterprise-grade security
Protect your infrastructure with a free SSL certificate and more advanced security features at no additional cost.
Intuitive Control Panel
From Server creation to application deployment, everything can be managed from our intuitive control panel.

Hear what people are saying about us

See why agencies, developers, startups, and growing businesses choose xCloud to power their projects.

xCloud works really well, I am surprised by its performance being this the release version, I have tried many paid platforms such as runcloud, cloudpages or serveravatar, as well as free platforms such as CyberPanel, CloudPanel or Hestia Control Panel and direct competitors such as SpinupWP and FlyWP. Of all those that I have tried, the platform that works best for WordPress is SpinupWP and I believe that xCloud can reach and surpass that development, its roadmap is promising. Congratulations to the xCloud team, I hope they become the leading platform in the segment, it has all the potential to achieve it!

Brian Geovanny

I've been with runcloud for the last 3 years. However, after trying xcloud for the last month, I'm switching over. They are on a roll with their setup.

Kevin Pineda

I'm moving my servers to xCloud, a cloud control panel by M Asif Rahman and the WPDeveloper team. Their roadmap looks interesting and no, there are no team mates nor API limits with xCloud! #xCloud #wordpress #hosting

Leo Koo

How Cloud Nine Web Elevated Client Experience While Streamlining Hosting Operations using xCloud

Ed Ellingham

xCloud is like having an expert server team on call — without the big agency costs. It's given me back my time and given my clients peace of mind. Highly recommended for freelancers and small teams who want reliable performance and security.

Dumitru Butucel

xCloud isn't just a solution. It's like one of that friend who got your back when you screw things up pretty bad.

Waqar Ahmed

Trust me when I say, once people explore the potential of xCloud they gonna switch from other panels, just keep delivering the best tech, lots of love for the team 😍😍

Rahul Singh

So far my experience has been smooth like silk. I didn't imagine that configuring and managing a VPS would be so easy. As of today, I have deployed 8 sites. The support is good, and they treat users with respect, even if they ask stupid questions (myself included). For the future, I hope for greater flexibility in scheduled backups and more comprehensive and consistent documentation. I'm sure that within a few months, xCloud will become the leader in its segment. This community is amazing, and the Staff here is super helpful.

Massimo Villa

Came from cloudways then to runcloud then to xcloud. Looks like I'm staying here.

Gerson El

I've recently taken all of my Vultr-hosted sites and gotten rid of cPanel for them to substitute it with xCloud. I have to say, I'm really impressed with xCloud so far! The interface is definitely the standout feature for me.

Tony Lewis

I came from Cloudways and won't go back. Highly impressed with xCloud. Glad I gave them a chance.

Jared McDowell

I like xCloud better than RunCloud, but one thing I'll point out is that some years ago RunCloud was hungry for business, the support was outstanding, and the community was active and helped each other. Maybe it was sold, there was a change in management, or they stopped being hungry, but the quality of the RunCloud offering declined and it hasn't been moving forward quickly. My point is that currently the xCloud team has the edge and it is theirs to keep or lose

David McCan

How Kevin Heinrichs Cut Hosting Costs by 84% While Running WooCommerce & Node.js Sites Efficiently

Kevin Heinrichs

I had 150 sites on cloudways and am in the process of moving them to xcloud. Much faster and better priced.

Dan Spinoza

Dear xCloud Team, I have been using xCloud for some time now and am genuinely impressed with its capabilities and the flexibility it offers by allowing users to bring their own VPS for management. It's a fantastic service, and my experience so far has been very positive. Successful migrated 5 sites on a single server. Xcloud migration tool worked great. There were few hiccups with security plugin like MalCare but disabling the plugin prior to migration worked just fine.

Rahil Maknojia

Came from runcloud. Tried xcloud and never came back.

Karl Fanega

How Advanced Web Strategies Saved Over $2,000 & Recovered 56 Hours per Month Managing 70+ Client Websites

Gary Moody

xCloud gave me what no other hosting platform could: the flexibility of a VPS with the convenience of managed WordPress. As a solo founder running an entire business on one server, that combination is an important unfair advantage.

Jorge de los Reyes Martínez

I use Server Avatar and xCloud and I'll sooner use xCloud than Server Avatar personally.

Jay Pagano

How Newman Web Solutions Ensured Perfect Uptime and Seamless Scaling For 120+ WordPress Sites with xCloud

Lori Newman

I too have moved over to xCloud. It's pretty sweet. One click n8n and uptime Kuma apps

John Aperture

I went from Cloudways to xCloud. No intention on switching in the foreseeable future.

Blaine Moore

Frequently Asked Questions

Feel free to contact us with any questions or concerns you may have.

Can I run Cerbos in Docker?

Yes, and this template is Cerbos Docker hosting without the setup: ghcr.io/cerbos/cerbos 0.56.0 pinned by digest, one container, the cerbos_policies volume at /policies, a generated server config and an HTTPS route to the HTTP API. Upstream describes running the PDP as a separate service.

What is a Policy Decision Point?

It is the stateless service where policies are executed and decisions are made. Your application sends it a principal, an action and a resource, and it answers allow or deny from the YAML policies. Cerbos runs as that separate process.

How much RAM does Cerbos need?

The template baseline is 256 MB of RAM, 1 CPU core and 1 GB of disk, since there is no database and policies are small files. Even the 6 GB plan sits well above that figure.

How do I add policies to Cerbos?

The policy volume starts empty, so every request is denied. Copy YAML files in over SSH with docker cp ./policies/. into /policies, and Cerbos loads added, changed and removed files without a restart. Invalid files are logged and skipped, so validate first.

Does Cerbos have authentication?

Not in this template. There are no user accounts, logins or API keys, so anyone who can reach the domain can send check and query-plan requests and see decisions. Put your own Basic Auth or IP restriction in front if the API should not be public.

Is the Cerbos gRPC port secure?

No. It is plain HTTP/2 with no TLS and no authentication, and it is published on the server's public address. xCloud does not open your firewall, so open it only for your application servers, or leave it closed and use the HTTP API.

What is the difference between CheckResources and PlanResources?

CheckResources asks whether a principal can access a resource. PlanResources asks which resources of a kind a principal can access. Query-plan responses can reveal conditions in your policies, so do not rely on policy secrecy.

Is Cerbos free?

Yes. Cerbos is released under the Apache-2.0 licence, so the decision point has no licence fee and spending is limited to the dedicated Cloud VPS. Cerbos Hub is a separate cloud service from the vendor and is not included.

How do I back up Cerbos?

Everything lives in the cerbos_policies volume at /policies. Back up that volume, or keep your policies in version control and copy them in again after a rebuild. You must schedule this yourself, and a restore test is wise.

Backup and restore Docker apps

How do I upgrade Cerbos?

Nothing upgrades itself: 0.56.0 is pinned by digest, so a running install keeps it. To move up, back up the cerbos_policies volume or keep policies in Git, then adopt a newer template version when one is published; do not edit the image tag or digest yourself.

Is this a Cerbos cloud service?

It is Cerbos on a dedicated Cloud VPS under your xCloud login, a Cerbos cloud of your own at your domain, separate from Cerbos Hub. Browser calls are allowed only from your own domain unless you add one extra origin.

Can I cancel anytime?

Yes. There is no lock-in — cancel any time. Hosting is billed monthly and charged for what you actually use, so when you delete the server the unused balance is refunded to your account, less up to 10% in payment-processing fees.