We’re building VHSP — the Virtual Hosting Service Platform — a self-hosted alternative to traditional hosting control panels, designed from the ground up around a single priority: keeping every customer’s site and mailbox genuinely isolated from every other customer’s.
The hosting industry has largely settled on shared-daemon architectures, where every tenant’s web and mail traffic flows through the same PHP process pool, the same mail server, the same database engine. It’s efficient, and it’s what most panels — cPanel, Plesk, and newer entrants alike — are built on. It’s also a single point of failure: when one tenant’s site is compromised, the blast radius is defined by how well that shared daemon happens to be hardened, not by any wall between customers.
VHSP takes a different approach. Every tenant gets their own containers — their own web process, their own mail service, their own database — running in isolation from every other tenant on the platform. If one site is compromised, the damage stops at that container’s edge.
What that looks like in practice
A few of the ideas driving the build:
- Per-tenant everything. Web, mail, and database each run in their own container per customer, rather than sharing a single multi-tenant engine.
- Self-service, without a shared attack surface. Customers manage their own mail users, files, and site settings through their own container’s admin tools — not through a shared control panel that, if breached, would expose every tenant at once.
- Defense in depth by default. Hardened-by-default configurations, with customers able to opt into more permissive settings for specific needs, deliberately and with clear tradeoffs — not the other way around.
- Centralized detection, decentralized blast radius. Security monitoring and abuse detection operate at the shared edge of the platform, so suspicious activity can be caught platform-wide — without requiring tenants to trust each other or share a runtime.
None of this is about chasing the cheapest possible hosting density. It’s a deliberate tradeoff: more isolation, at the cost of some efficiency, because the cost of a shared-tenant breach is so much higher than the cost of a few extra containers.
Where things stand
VHSP is currently in active development, being built and tested against real workloads to validate the approach before it goes anywhere near production traffic. This site is one of the environments we’re using to do exactly that.
More to come as the platform matures.
Leave a Reply