From project folder to shared app.

Dashboard quickstart

1. ZIP the whole project folder. You do not need to identify an entry point.
2. Create an app and add any environment variables it needs.
3. Open Deploy, review the automatic settings, and follow the live progress.
4. Open Share to make the link public, invite several emails, or allow *@company.com.

Connect an AI coding agent

Open Workspace settings → Personal API keys. Generate a key, copy it once, then expose it to the agent process:

export SMALLCLOUD_TOKEN=sc_live_...
npm install -g https://18-234-38-204.sslip.io/downloads/smallcloud-0.1.0.tgz
cd your-project
smallcloud init

Run smallcloud init once per project. It adds getsmall guidance to AGENTS.md for Codex and imports it from CLAUDE.md for Claude Code without overwriting existing instructions. After that, a prompt can simply say: “Build this, deploy it to getsmall, and make it public.”

Workspace — $29/month flat

Free plan safeguards

CLI commands

Teach agents about getsmall

smallcloud init [path]
INITIALIZED: /project/AGENTS.md CLAUDE: /project/CLAUDE.md

This needs no API key and is safe to repeat. Codex automatically loads applicable AGENTS.md; Claude Code automatically loads CLAUDE.md. The remote /llms.txt is a compact reference for other tooling, not guaranteed automatic local project configuration.

Deploy the current folder

smallcloud deploy .
DEPLOYED: https://my-app-abc123.18-234-38-204.sslip.io APP_ID: 6f7b...

The CLI excludes dependencies, Git history, Python caches, virtual environments, and build output; uploads a ZIP; starts the same static-generator/Nixpacks pipeline as the dashboard; waits; and prints one parseable result line containing both the URL and app ID.

Share an app

smallcloud share APP_ID --with sam@company.com
SHARED: APP_ID sam@company.com

smallcloud share APP_ID --public
SHARED: APP_ID PUBLIC

Set SMALLCLOUD_URL only when using another getsmall installation.

Packaging your app for getsmall

Checklist for an AI coding agent immediately before deployment:

• Bind the server to 0.0.0.0 and read its port from $PORT. Never hardcode a port or bind to localhost.
• Include a real language manifest: for example, package.json with a start script, requirements.txt, Gemfile, or go.mod. The build system uses these files to detect the runtime.
• Put local data in DATA_DIR or SQLITE_PATH, or use the supplied DATABASE_URL. These point into durable /data; writes elsewhere are not durable.
• Handle SIGTERM and close files and database connections cleanly when the app auto-sleeps.
• For plain HTML, Jekyll, Hugo, and Docusaurus sites, keep each page as a real output file. Add SPA fallback only when the source actually depends on a client-side router such as React Router or Vue Router.
• Run one long-lived process on one port. Do not start several servers and expect getsmall to route among them.

smallcloud deploy .

Persistent storage

Every app receives a private persistent mount at /data. On startup, getsmall supplies DATA_DIR=/data, SQLITE_PATH=/data/app.db, and a default SQLite DATABASE_URL pointing to that database. An app's own environment-variable settings can override these defaults.

The free tier provides 400 MB total per workspace; Workspace provides 5 GB total. Each app sees only its own directory mounted at /data, but there is no per-app split inside that shared allowance. Files under /data survive auto-sleep, wake, container restart, redeploy, and host reboot. The rest of the app filesystem is read-only; temporary files under /tmp are bounded and do not persist.

Sharing and permissions

Restricted apps require a signed-in email matching an invitation. Add several people with commas or new lines, add a domain wildcard, and remove access individually. “Anyone with the link” does not require an account. The owner always retains access.

Account verification

New accounts must verify their email before logging in. The link expires after 24 hours and works once. If it expires, return to the login dialog and choose Resend verification. Delivery uses Amazon SES; check spam or filtered-mail folders if it does not arrive within a few minutes.

What gets built

A manifest-free folder with a root index.html uses the plain static builder. Jekyll is detected before the general build system and compiled into a static-only runtime. Hugo and Docusaurus markers are recognized but currently stop with a clear unsupported builder message instead of being misclassified. Projects with normal language manifests go to Nixpacks, which detects Node, Python, Ruby, Go, Rust, Java, PHP, .NET, and other common ecosystems.

Every new container must answer an HTTP health request before its deployment becomes live. Failures include the container's actual stdout/stderr in the expandable build-log panel. An AI-assisted Dockerfile fallback is used only when the operator has configured model access; it is not enabled on the current public MVP.

Free workspace limits

Sleeping time does not consume compute. The next request wakes the app automatically. Limits reset at midnight UTC. Persistent files survive sleep, restart, redeploy, and host reboot. Flask apps can use the supplied SQLITE_PATH or DATABASE_URL; relative files outside /data remain read-only by design. Paid plans omit the badge automatically. API and other non-HTML responses are never modified.

Security model

User workloads run as non-root in gVisor, with no Linux capabilities, CPU/RAM/PID limits, filtered private-network access, and platform credentials stripped at the proxy. The application filesystem is read-only except for bounded temporary storage and the app's private, 400 MB persistent /data mount. Writes under /data survive sleep, restart, and redeploy; writes anywhere else do not persist. No sandbox can honestly promise zero risk; these independent layers materially reduce it.