Pre-installed OpenBSD 7.5 and 7.6 on every tier, with W^X, KARL, pledge/unveil and syspatch on by default. No systemd, no telemetry, no NordBastion patches — close to a fresh install(8) of openbsd.org sources.
Pre-installed OpenBSD 7.5 and 7.6 on every tier — Sentinel to Citadel, no surcharge, no licence cost.
W^X, KARL, pledge(2) and unveil(2) on out of the box — security primitives baked into the base, not a hardening checklist you have to follow.
Pinned to one of four Nordic constitutional jurisdictions — Sweden, Finland, Norway or Iceland — paid in Bitcoin or Monero.
W^X (no page is both writable and executable), KARL (kernel re-randomised every boot), pledge(2) (a syscall whitelist a daemon declares about itself), unveil(2) (filesystem visibility shrunk to declared paths) — all in the base system, on by default, no checklist required. A class of bugs that would be exploitable on stock Linux are simply not reachable.
Two releases per year, exactly on schedule, with syspatch(8) for errata between them. No "rolling stable", no LTS years-in-the-making, no surprise headline CVE that needs an out-of-band patch. The release calendar is one of the most predictable in operating-system history.
rc.d shell scripts for service supervision, cron(8) for scheduling, doas(1) instead of sudo, ksh as /bin/sh — every component is small, written to a single well-defined contract, and you can read its source. There is no PID 1 that grew to subsume DNS, mounts and timers.
| Image | Slug | Use case |
|---|---|---|
| OpenBSD 7.6 (-current) | openbsd-7.6 |
Current release — the default pick for a new OpenBSD server in 2026, with the latest pledge/unveil coverage across base. |
| OpenBSD 7.5 (-stable) | openbsd-7.5 |
Previous release, still in -stable with errata patches — for runbooks that have not yet been re-validated against 7.6. |
| OpenBSD 7.6 + httpd | openbsd-7.6-httpd |
Base httpd(8) and acme-client(1) pre-configured — a static site or reverse proxy with auto-renewing certificates, under 60 MB resident. |
| OpenBSD 7.6 + relayd | openbsd-7.6-relayd |
relayd(8) pre-wired as a TLS-terminating L4/L7 proxy — useful in front of an application stack you want sandboxed away from the public TLS layer. |
Custom ISO mount available for any other OpenBSD release or for the install76.img workflow on request — ticket-free via the panel.
Security primitives built into the base. Smaller package set, deliberate two-release-a-year cadence, no systemd, no container stack. The right pick for a single-purpose internet-facing daemon you want sandboxed.
Containers, Kubernetes, vendor binaries, the modern observability stack — all of it assumes Linux. Pick /debian-vps/ for stability or /ubuntu-vps/ for the broadest ecosystem.
The other BSD pairing — first-class ZFS, jails, bhyve. Less security-paranoid than OpenBSD, but with a much richer ports tree and a permissive licence. See /freebsd-vps/.
2 vCPU, 4 GB RAM, 120 GB NVMe. OpenBSD's base footprint is so small that this tier comfortably runs httpd + relayd + unbound, a WireGuard endpoint, or an OpenSMTPd mail relay with all sandboxes active.
4 vCPU, 8 GB RAM, 240 GB NVMe. The sweet spot for an OpenBSD-hosted authoritative DNS (nsd + unbound + dnsmasq), or a small Gemini/Gopher capsule, or an audited application written against pledge/unveil.
8 vCPU, 16 GB RAM, 480 GB NVMe. Comfortable for an OpenBSD edge-router replacement (pf + relayd + iked + dhcpd) hosting half a dozen sandboxed daemons.
Full tier line — Sentinel · Garrison · Ravelin · Bulwark · Citadel — on /vps/.
For an internet-facing daemon — a reverse proxy, an authoritative DNS, a mail relay, a small static site behind acme-client — OpenBSD on NordBastion gives you W^X, KARL, pledge and unveil without a hardening checklist. The pairing with a Nordic KYC-free host is consistent: two organisations that have made security and free software written commitments rather than marketing claims.
Pick a Linux distribution (see /debian-vps/, /ubuntu-vps/, /arch-linux-vps/) when you genuinely need the container ecosystem. Pick OpenBSD when you genuinely need the base system to be the trusted boundary.
The questions operators actually ask before deploying a security-first BSD on a privacy-first host.
OpenBSD 7.6 as the current release (-current rebased to the latest snapshot at image build time), and 7.5 as the previous release still receiving errata patches via syspatch. Older releases are not in the panel — OpenBSD's upstream stance is that you should run a supported release — but custom-ISO mount is available for anyone deliberately running 7.4 or earlier for a known reason.
Because OpenBSD makes different defaults. The base system runs binaries under W^X, the kernel is re-randomised at boot (KARL), syscalls in audited daemons are restricted by pledge(2) and filesystem access by unveil(2), and the result is that a class of bugs that would be exploitable on a stock Linux system are simply not reachable. None of this requires you to remember to enable it.
No — stock OpenBSD GENERIC.MP. We do not patch the kernel, we do not strip drivers, we do not pre-compile a custom kernel for the virtio paths. KARL reshuffles the kernel link order on every boot anyway, so even the binary on disk is intentionally different from the next operator's.
Yes. /etc/installurl on the default image points at cdn.openbsd.org, which resolves to a Nordic mirror (typically ftp.eu.openbsd.org or one of the Swedish university mirrors) from any of the four bastions. pkg_add and the ports tree work without extra configuration; the firewall permits OpenBSD mirror traffic in both clear and Tor-onion form.
Yes, and it is the canonical update path on NordBastion OpenBSD images. syspatch applies signed errata for the running release without a full source build. The image enables the standard daily cron(8) entries; you can opt in to automatic syspatch by editing /etc/daily.local. We do not auto-apply syspatch ourselves — that is your decision.
No — OpenBSD has no native container runtime in that style, and the project has deliberately not chased the Linux container ecosystem. If your workload is fundamentally a stack of OCI containers, run it on Debian (see /debian-vps/) or Ubuntu (see /ubuntu-vps/). OpenBSD is the right choice for daemons that live directly on the host — relayd, httpd, OpenSMTPd, unbound — and benefit from pledge/unveil sandboxing.
A base install with OpenSSH, doas, vi, sysmerge, syspatch, the standard cron tables and acme-client. No third-party packages by default; you choose your own with pkg_add. The image is intentionally close to a fresh install(8) of the official release.
OpenBSD has solid virtio-net, virtio-blk and virtio-rng support on KVM, and NordBastion uses the upstream-recommended machine type (q35, virtio-scsi for storage). The one thing to know: OpenBSD prefers MBR or GPT with the default install layout, and the installer's automatic disk allocation is fine on virtio devices — there is no special partitioning ritual to remember.
Private hosting, built in the North.
