Pay for the RAM you use.
Snugbox measures what each Linux server really needs, trims the waste with changes you can undo, and shows the cheapest plan that fits.
In beta. Snugbox is running on test servers now. The first public release, 0.1.0, will bring signed packages for x86 and Arm servers and a one-line install on this page.
Once it's installed, sudo snugbox audit gives a first answer in a minute. It changes nothing and sends no data.
This box pays for 8 GiB and needs 3.4 GiB. A 4 GiB plan fits.
- No swap and no early out-of-memory protection
- 3 of 5 containers have no memory limit
- 4 fixes ready, each with an undo
Memory got expensive. Servers still waste it by default.
- About 500%
How much memory kit prices rose in twelve months, in Tom's Hardware's tracking.
Tom's Hardware - No limit
A Docker container gets no memory limit unless you set one, so one leak can take the whole server down.
Docker's documentation - 20 to 32%
The share of memory Meta saves across millions of servers by moving cold pages out. Snugbox reads the same kernel signals on a single server.
The TMO paper
Measure first. Then fix, with an undo.
Snugbox reads what the kernel already tracks, works out what each box needs, and only changes something when you say so.
Measure
Memory, pressure and out-of-memory kills for every container and service, read from cgroup files and pressure stall information. A one-minute audit gives a first estimate. The watcher keeps 30 days of history, and its confidence reaches medium after 7 days and high after 14.
$ sudo snugbox audit
This box pays for 8 GiB and needs 3.4 GiB.
A 4 GiB plan fits.Fix
Swap with zswap, early out-of-memory protection, limits for containers and services, Java heap caps, and timers moved so heavy jobs don't overlap. You see the exact change before it runs, and the watcher checks the box for 30 minutes after.
$ sudo snugbox fit container-limits
compose.override.yaml, new
+ services:
+ app:
+ mem_limit: 1792m
+ mem_reservation: 1152m
Applied as 20261115-091500-container-limits.
snugboxd watches it for 30 minutes and
undoes a limit that hurts.Undo
Every change is saved to a journal on the box before it's made. One command puts it back.
$ sudo snugbox undo --last
Put back. 20261115-091500-container-limits is undone.Pay less
The plan advisor compares the plans that fit at five providers and says when a move needs a new server, for example because a disk can't shrink.
$ sudo snugbox plan
Vultr vc2-2c-4gb $20.00 new server
Hetzner CPX22 $23.59 new server
DigitalOcean Basic 4 GiB $24.00 resize in placeExample output, shortened. Prices are the list prices in Snugbox's catalogue, checked on 31 October 2026.
Built for a tool that runs as root.
You should be able to read exactly what Snugbox can do on your server. Here it is.
- No remote control
- Snugbox takes no orders over the network. A change happens only when you run
snugbox fiton the server, and only from a fixed list of six kinds of fix. - Root without a network
- The watcher, which can reach the network, runs as its own unprivileged user. The helper that applies fixes runs as root and has no network access at all.
- An undo for every change
- Changes are journalled and checked, and a limit that hurts a workload in the first 30 minutes is undone on its own.
- Signed releases
- From 0.1.0, every release comes with a Sigstore signature, build provenance and a bill of materials, so you can check what you install.
- Nothing leaves without you
- The history stays on the server. Snugbox asks your cloud's metadata service which plan the box is on, which you can turn off, and sends warnings to a webhook only if you set one.
Questions
When can I install it?
When 0.1.0 is out. Each release has .deb and .rpm packages for x86 and Arm servers, and an install script that checks the release signature before it installs anything. Signed apt and dnf repositories come later.
Does Snugbox send my data anywhere?
No. Its history stays on the server. The only request it makes on its own goes to your cloud's metadata service, to learn the plan, and you can turn that off. Warnings go to a webhook only if you set one.
What if a fix breaks something?
Every fix saves the old values first, and the watcher checks the box for 30 minutes. If a limit hurts a workload, the watcher undoes it. You can put any fix back later with snugbox undo.
Why does it need root?
Reading every workload's memory and changing limits needs it. The watcher runs as its own user and only reads. A small helper with no network access makes the changes, and only the kinds on the published list.
Which Linux does it run on?
Linux with systemd and cgroup v2. It's tested on Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04, AlmaLinux and Rocky Linux 9 and 10, Fedora 44 and Amazon Linux 2023.
Which providers does the plan advisor know?
Hetzner, DigitalOcean, Vultr, Akamai Linode and AWS Lightsail. On any other cloud it still tells you how much memory the box needs.
Does it work with Kubernetes?
Not in version 1. Snugbox is for plain Linux servers running Docker Compose and systemd services.