1. Connect a machine
ZeroTerm works with any Linux VPS or dedicated server with Docker, and with Windows or macOS computers running Docker Desktop.
- In the panel, choose Add machine and copy the install command.
- Run it on the machine. The installer verifies the agent's SHA-256 checksum, enrolls with a single-use token and starts the agent as a service.
- The machine appears online within a few seconds. The agent only connects outward over HTTPS, so you do not open any inbound port for ZeroTerm.
To update the agent, open the machine's settings and choose Update. The agent installs only releases signed with ZeroTerm's release key, keeps your services running, and returns to the previous version by itself if the new one does not reconnect within three minutes. Agents older than 0.8.0 need the upgrade command shown there once.
2. Deploy a service
Open a machine and choose Add service. Ready-made templates cover PostgreSQL, MySQL, MariaDB, MongoDB, Redis, a Minecraft Paper server, Node.js and Python apps and static sites. Passwords are generated for you and stored encrypted.
For anything else, use an installation script: a Docker image, start command, environment, ports and limits. Each service gets its own folder on the machine, which survives updates and redeploys.
Pterodactyl eggs. Choose Import egg in the template gallery and upload an egg export (egg-*.json). Give it a category such as "Modded" or "Source engine"; each category gets its own tab. Eggs run like on Wings: the installation script fills the server folder, then the egg's startup command runs in its yolk image with SERVER_PORT, SERVER_MEMORY and your variables set. Eggs with a stop command (such as stop) get up to a minute to save before the server is stopped.
3. Docker Compose stacks
Choose Docker Compose stack in the template gallery, paste a docker-compose.yml and pick the main service. The whole stack is one ZeroTerm service: power buttons apply to every container, while the console, logs, statistics, Databases and Players pages show the main service. Edit the file later on the Stack page; Check file validates it without changing anything.
To keep the machine safe, stacks cannot use privileged mode, host networking or namespaces, devices, or extra capabilities beyond common ones, and every bind mount, env file and build folder must be inside the service folder. Named volumes are stored in the service folder, so backups and SFTP include them. Variables like ${NAME} come from a .env file in the service folder. The machine needs the Docker Compose plugin.
4. Live console and SFTP
A service's Console page streams its output live with colours, accepts commands with history (arrow keys), and shows CPU, memory and network graphs. Start, Restart, Stop and Kill control the process; Kill stops it immediately without a graceful shutdown.
For large uploads, connect any SFTP client (FileZilla, WinSCP, Cyberduck) to the machine on port 2022. The username is shown on the service's Files page; sign in with an SFTP password created there or with an SSH key added under Account. Each session sees only that service's folder, viewers are read-only, and the disk limit applies. Set ZEROTERM_SFTP_PORT=0 on a machine to turn SFTP off.
5. Resource limits
Every service has its own limits, set on its Resources page and applied by the agent without a restart:
- Memory in MB, plus optional swap (none, a fixed amount or unlimited).
- CPU as a percentage of one thread: 100% is one thread, 250% is two and a half. Optionally pin the service to specific threads, such as
0-1. - Disk quota for the service folder and its volumes. At the limit, uploads and edits are refused and a running service is stopped until you free space or raise the limit.
- Block I/O weight (10–1000), a process limit and an option to disable the out-of-memory killer, which recreates the container but keeps its files.
A machine's Resources page shows how much of its memory, CPU and disk the service limits add up to. Set an overallocation percentage to stop new limits from exceeding the machine, as on game server hosts.
6. Domains and HTTPS
- Create an A record for your domain pointing to the machine's public IP address, shown on the service's Domains page.
- Open ports 80 and 443 on the machine's firewall.
- Add the domain and the port your service listens on. The agent starts a small Caddy proxy that obtains and renews a Let's Encrypt certificate.
- Use Check to confirm DNS and HTTPS. With Cloudflare's proxy turned on, set SSL mode to Full (strict).
7. Backups and off-site copies
Backups are compressed archives of the service folder, signed by the agent and verified before every restore. Restoring first saves a safety backup of the current files. Schedule backups hourly, daily or weekly from the Schedules page.
To keep copies outside the machine, add an S3-compatible destination (Amazon S3, Cloudflare R2, Backblaze B2, MinIO) on the Backups page. After each backup the agent uploads it directly to your bucket, signs the request with your key, verifies the checksum and removes copies beyond your retention count. Use a key limited to that bucket. Download to machine brings a copy back for restoring.
8. Git deployments
Connect an HTTPS repository on a service's Git deploy page and choose how to deploy it. Copy files fetches the branch into the service folder, keeps untracked files such as local configuration and can restart the service. Build an image builds the repository's Dockerfile, or detects a Node.js (package.json), Python (requirements.txt), Go (go.mod) or static (index.html) project and uses a Procfile web: command when present, then recreates the service with the new image. Ports, variables, limits and domains stay as they are.
Add the webhook to GitHub, GitLab, Gitea or Forgejo to deploy on every push. The deployment history lists every sync and build with its commit, trigger, image, build time and build log. Roll back deploys an earlier commit again; built images of the last five commits are kept, so rollbacks are instant.
After a build, ZeroTerm watches the new version for 45 seconds. If it crashes, keeps restarting or reports itself unhealthy, ZeroTerm starts the previous image again and shows the reason with the last lines of output in the deployment history.
9. Databases
PostgreSQL, MySQL and MariaDB services have a Databases page. Create a database with its own login and a generated password, set a new password, delete a database (type its name to confirm) and copy connection strings. Viewing a password is recorded in the activity log.
Services on the same machine share a private network and reach a database at zt-<service id> on its normal port, without publishing the port to the internet.
Database backups on the same page take a consistent dump (pg_dump, or mysqldump/mariadb-dump in one transaction) while the database keeps running. Back up one database or all of them, download a dump, or schedule daily dumps from the Schedules page. Restoring checks the dump's signed checksum, asks you to type the database name and first saves a safety dump of the current data.
10. Logs
The Logs page searches everything a service printed, across restarts. Choose a period, filter errors or warnings, stdout or stderr, and download the result as a .log file. The chart shows when warnings and errors happened; click a bar to see those lines. Each service keeps up to 50 MB of compressed, rotated log history.
11. Plugins and mods
Minecraft servers have a Plugins & mods page that searches Modrinth for add-ons that work with your server software (Paper, Purpur, Spigot, Fabric, Quilt, Forge, NeoForge, Velocity and others) and Minecraft version. The agent downloads the file only from Modrinth's CDN and checks its SHA-512 checksum and size before placing it in plugins/ or mods/. The page shows when an update is available, updates in one click and removes add-ons. Restart the server to load changes.
12. Players, TPS and MSPT
Game servers have a Players page with who is online, the server version and message of the day, and charts of players over up to 30 days. Minecraft Java, Minecraft Bedrock and Steam games that answer the Source query (A2S) are supported. Minecraft servers from the Paper template or the itzg image also report TPS over 1, 5 and 15 minutes and milliseconds per tick through RCON. Turn statistics on for other servers from the same page. On Minecraft servers you can kick, ban and op online players and manage the whitelist, operators and bans from the same page.
13. Uptime monitors and status pages
Monitors check a website, API or TCP port such as a game server from outside your machine. A monitor is down after two failed checks in a row, and you are alerted by email, Discord, Slack, Telegram or webhook on paid plans. HTTP monitors can require a status code or a word in the response.
Mark monitors public and choose an address to publish a status page at panel.zeroterm.dev/status/your-name with 90 days of history. Status pages never show monitored addresses.
14. Account security
Turn on two-factor authentication in Account settings and scan the QR code with any authenticator app. Save the ten recovery codes: each signs you in once if you lose your phone. New sessions ask for a code before showing your workspace.
Share access per machine or per service as operator or viewer, or choose permissions one by one: console and logs, console commands, power, reading, editing and deleting files, SFTP, backups and databases. A moderator can, for example, use the console without touching files.
Teams share machines with a group: invite people once, share a machine with the team and everyone gets the access you chose. Admins manage members; leaving a team removes its access. See Security for how ZeroTerm protects your machines.
15. Getting help
Write to [email protected]. Include the machine or service name and what you expected to happen. Never send passwords or tokens.