Published: 24 September 2026
Some work should never touch a machine you care about. Reversing a suspicious binary, following a security course, practising on a capture-the-flag box, running a scanner against infrastructure you have been contracted to test, or just trying a tool whose install script you have not read — all of it belongs on a computer you are willing to throw away.
A laptop VM is the usual answer and it is a poor one. It shares your home IP address, your filesystem is a clipboard mistake away, and "throw it away" means remembering to. A VPS you destroy at the end of the session is a cleaner boundary, and on hourly billing it costs less than the coffee you drink while using it.
Ground rule first, because everything below depends on it: test only what you own or what you have written permission to test. A signed engagement, your own infrastructure, or a platform that exists to be attacked. Pointing tools at somebody else's systems is illegal in every jurisdiction we operate in and is a straightforward way to lose your server, so be sure which side of that line you are on before you start.
What a session costs
Lab work happens in sittings, which is exactly the shape hourly billing suits. Against our hourly VPS plans, in Bucharest:
| Plan | RAM / vCPU / SSD | Per hour | A 4-hour session | A 40-hour month |
|---|---|---|---|---|
| VPS II KVM | 4 GB / 2 / 40 GB | €0.0083 | €0.03 | €0.33 |
| VPS III KVM | 8 GB / 2 / 60 GB | €0.0139 | €0.06 | €0.56 |
| VPS IV KVM | 16 GB / 4 / 80 GB | €0.0222 | €0.09 | €0.89 |
| VPS VI KVM | 32 GB / 8 / 120 GB | €0.0806 | €0.32 | €3.22 |
Ten four-hour sessions a month on a 16 GB machine is 89 cents before VAT. The full per-country grid is in our location pricing post; Bucharest is our base price, and the other four countries add between €1.00 and €20.00 a month depending on the plan.
Sizing
Most course and CTF work fits in 4 GB. Go to 8 GB the moment you want to run a target and your tooling on the same box, and 16 GB if you are nesting containers or holding a large dataset in memory. The 32 GB plan is for the occasional job that genuinely wants eight cores — a long-running analysis rather than an interactive session.
Why a full KVM machine matters here
Every plan we sell is a KVM virtual machine with its own kernel, not a container sharing the host's. For this kind of work that is not a detail:
- You can load kernel modules, change sysctls, and run tooling that wants raw sockets or a tun device — all of which a shared-kernel container refuses.
- You can run nested containers and virtual machines inside it for target environments.
- The machine's failure mode is its own. Wedging the kernel on a lab box is a reboot, not an incident.
Our KVM explainer covers the mechanism, and the in-browser console in the panel means a machine you have locked yourself out of over SSH is still reachable — which, on a box where you are deliberately breaking things, you will use.
Hygiene that makes the "disposable" part true
One machine per engagement, never a long-lived pet
A lab box that survives six months is no longer disposable; it is an undocumented server holding six months of other people's data. Build a fresh one per engagement or per course module.
Keep the results off the box
Whatever you are producing — notes, captures, a report — sync it somewhere else as you go. The machine is the workspace, not the archive. This also means you can destroy it the moment you are finished instead of negotiating with yourself about it.
Do not put client credentials on it if you can avoid it
And where you must, treat their lifetime as the machine's lifetime: issued for the engagement, revoked when it ends.
Lock down the front door anyway
Key-only SSH, no password login, and the firewall closed to everything you are not deliberately using. A lab machine is still a machine on the public internet, and it will be scanned within minutes of getting an address. Our note on how DDoS protection works covers what the network does for you and, more usefully, what it does not.
Destroy it — and understand what that means
Powering the server off does not stop the charges, and it does not end the exposure. A stopped virtual machine still holds its RAM allocation, its disk and its IP address on a node; it bills exactly as a running one does, and its disk still contains everything you put there. Destroying it is what stops the meter and releases the storage. On a lab box, teardown is a security control, not a billing one.
The billing mechanics, once
- The hourly rate is the plan's monthly price divided by 720 hours. Thirty days of uptime costs the monthly figure; four hours costs four hours.
- One deduction per clock hour, at the top of the hour, UTC, from prepaid account credit. No setup fee; prices are euro before VAT.
- If credit runs out there is one hour of grace before suspension and 48 hours before termination, with low-credit warnings first.
- A monthly summary invoice closes the period — useful if the lab time is billable to a client.
Choosing where to put it
For lab work the country rarely matters technically, so the deciding factors are usually cost and jurisdiction. Bucharest is our lowest price. If an engagement or an employer requires the work to stay in a named country, all five of our VPS locations are EU member states and the country is an explicit field on the order form — our post on EU data residency goes into what that does and does not settle.
Spin one up
Pick the 8 GB or 16 GB size on the hourly VPS page, choose a country and one of the 26 install images, and work until you are done. Then destroy it. Total cost, less than a euro a month for most people — and the machine that saw your session no longer exists.