ASCS Cloud’s micro tier is a Proxmox LXC container with one public IPv6 address, 1–4 GB of RAM, and a monthly price starting at $3.08 CAD. Fourteen of the fifteen paid plans are under $5 CAD per month. The fifteenth is the i9 Max at $5.57. That is the factual version of “PVE containers in the cloud powered by IPv6 for under $5 CAD.”
This guide covers what the container actually is, what the price includes, where IPv6 works and where it does not, when the shared IPv4 NAT add-on is mandatory, and which workloads should skip micro instances entirely.
What a Proxmox LXC container is — and what it is not
The micro tier runs on Proxmox VE (PVE) using LXC. LXC is operating-system-level virtualization. The container shares the host’s Linux kernel, but gets its own process tree, filesystem, network namespace, cgroups limits, and root account. It behaves like a small Linux server for almost everything you install inside it.
That architecture explains both the price and the limits.
| You can | You cannot |
|---|---|
| Get root and install any Linux userspace package | Run a custom kernel or load arbitrary kernel modules |
| Run Docker and other container-friendly workloads | Run Windows, macOS, or a hypervisor inside the container |
| Use systemd, nftables, WireGuard, Nginx, databases, and language runtimes | Get a dedicated physical CPU core |
| Rebuild or reinstall the container from the panel | Expect hardware-level isolation equal to a KVM VM |
The “1 vCPU” on most plans is a CPU quota on a shared host, not a core reserved for you. The i7 and i9 plans list 1 vCPU; the Xeon E5 plans list 2 vCPUs. For a DNS resolver, a WireGuard peer, a bot, or a small API, that is enough. For a compile farm or a busy database, it is not.
Plans and prices: the exact ladder
All prices below are monthly CAD. Yearly billing takes 5% off the monthly rate across twelve months. Storage is SSD; the Max plans add a 300 GB HDD for cold data. The i7 and i9 plans use DDR4; the E5 plans use DDR4 ECC.
| Family | Plan | vCPU | RAM | Storage | Monthly | Yearly |
|---|---|---|---|---|---|---|
| i7 12700KF | Nano | 1 | 1 GB | 16 GB SSD | $3.08 | $35.01 |
| Mini | 1 | 2 GB | 16 GB SSD | $3.50 | $39.84 | |
| Base | 1 | 4 GB | 16 GB SSD | $3.82 | $43.47 | |
| Plus | 1 | 4 GB | 32 GB SSD | $4.14 | $47.10 | |
| Max | 1 | 4 GB | 32 GB SSD + 300 GB HDD | $4.65 | $53.13 | |
| i9 14900KF | Nano | 1 | 1 GB | 16 GB SSD | $3.69 | $41.90 |
| Mini | 1 | 2 GB | 16 GB SSD | $4.19 | $47.69 | |
| Base | 1 | 4 GB | 16 GB SSD | $4.57 | $52.04 | |
| Plus | 1 | 4 GB | 32 GB SSD | $4.97 | $56.38 | |
| Max | 1 | 4 GB | 32 GB SSD + 300 GB HDD | $5.57 | $63.59 | |
| Xeon E5 2680v4 | Nano | 2 | 1 GB ECC | 32 GB SSD | $3.17 | $36.23 |
| Mini | 2 | 2 GB ECC | 32 GB SSD | $3.48 | $39.68 | |
| Base | 2 | 4 GB ECC | 32 GB SSD | $3.86 | $43.99 | |
| Plus | 2 | 4 GB ECC | 64 GB SSD | $4.23 | $48.30 | |
| Max | 2 | 4 GB ECC | 64 GB SSD + 300 GB HDD | $4.69 | $53.48 |
The cheapest RAM is not the cheapest plan. The Base plans put 4 GB in the $3.82–$4.57 range. The Nano plans are for services that need an address and a process, not memory. If you are choosing only by “most RAM per dollar,” the Base tier wins. If you are choosing by “fastest single-thread CPU for a small service,” the i9 Nano and Mini are the relevant entries.
Which plan fits which workload
DNS resolver, WireGuard peer, Uptime Kuma, a single bot, a tiny webhook receiver. Keep the OS lean; 1 GB disappears quickly under Docker plus a database.
A small API, Caddy or Nginx with a static site, Gitea, a lightweight database, or one Docker Compose stack. This is the first plan with real breathing room.
Multiple services on one container: reverse proxy, app, Redis, and a small Postgres. The best value if you need RAM more than disk.
Docker images, logs, and a little data. The E5 Plus gives 64 GB of SSD for $4.23, which is the storage-heavy pick.
Media libraries, archives, backup targets, and low-CPU storage services. The HDD is for capacity, not for databases or heavy random I/O.
Two CPU shares, ECC memory, and more baseline SSD. Older per-core performance than i7/i9, but better for a few light parallel jobs.
What public IPv6 actually gives you
Every micro plan includes a public IPv6 address. There is no NAT between your container and the IPv6 internet. Inbound connections arrive at the container; outbound IPv6 connections leave it. If you add an AAAA record, the service is reachable over IPv6 without port forwarding.
# Confirm the address and the default route
ip -6 addr show scope global
ip -6 route
# Test outbound IPv6
curl -6 -sS https://ifconfig.co
# SSH over IPv6
ssh root@2600:70ff:b8c1:1::exampleIPv6-only means IPv6-only
The micro tier does not include IPv4 by default. There is no transparent NAT64 or DNS64 translation on the micro network. A container with only an IPv6 address cannot reach an IPv4-only endpoint, and an IPv4-only visitor cannot reach your service. This is a routing fact, not a configuration preference.
If your application calls an IPv4-only API, installs from an IPv4-only mirror, or serves users on IPv4-only networks, you need the shared IPv4 add-on or a VPS with IPv4. “IPv6 works for Google” is not a test of your dependency chain.
Practical checks:
getent ahosts api.example.com— does the dependency return an IPv6 address?curl -6andcurl -4— do both paths work from the container?dig AAAA your-domain— does your DNS actually publish IPv6?ss -6 -lntup— are your services listening on IPv6, not only0.0.0.0?
Public IPv6 is public
There is no NAT firewall protecting a misconfigured service. A default Ubuntu container with SSH exposed is reachable from the IPv6 internet. Set a default-deny firewall before you install the application, not after.
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 80,443/tcp
ufw enable
# Or with nftables, keep the input policy drop and allow only the ports you use.If you run Docker, remember that published container ports can bypass UFW. Verify the actual listening sockets with ss -lntup and test from outside the host.
The shared IPv4 NAT add-on: +$4/month, eight forwarded ports
This is the add-on that makes the micro tier usable for mixed IPv4/IPv6 audiences. It adds a shared IPv4 address with eight forwarded ports. On micro instances it is an add-on, not a discount: +$4 CAD per month. On VPS and dedicated plans the same toggle is a $6/month discount because those plans already include a dedicated IPv4.
- One shared public IPv4 address
- Eight forwarded ports
- Inbound IPv4 for the services you map
- Outbound IPv4 through the shared address
- A dedicated IPv4 address
- All 65,535 ports
- Clean IP reputation for mail
- Unlimited port mappings or a second IPv4
The cost math is simple. i7 Nano at $3.08 plus $4 is $7.08/month. i9 Nano is $7.69. E5 Nano is $7.17. That is still cheaper than most dedicated-IPv4 VPS plans, but it is a shared address with a fixed port budget. Treat the eight ports as a design constraint, not an unlimited router.
The add-on catalog is what makes the tier versatile. Start at $3.08 for an IPv6-only container, add the $4 shared IPv4 NAT when IPv4 becomes a requirement, then move up the RAM and disk ladder without changing providers. A $7.08 i7 Nano with NAT is still a complete IPv4+IPv6 service with eight forwarded ports.
Example allocation only. The order page is the source of truth for the ports assigned to your instance.
When the NAT add-on is the right choice
- You are serving IPv4-only visitors or clients, but you do not need a dedicated IP.
- You need outbound IPv4 package installs or API calls from an otherwise IPv6-only container.
- You need a small number of inbound services: SSH, HTTP/HTTPS, one app port, one VPN or game port.
- You want to keep the bill under $8/month while adding IPv4 reachability.
When it is the wrong choice
- You need all inbound ports, a dedicated IP, or a clean sending reputation for email.
- You need multiple IPv4 addresses or 1:1 NAT.
- You are running a high-volume service where shared-IP rate limits or port collisions are a risk.
- You need a full router with two independent networks. That is a VPS or dedicated job.
Upgrades and add-ons: the part that makes the tier versatile
The micro tier supports plan changes, OS or app reinstalls, console access, and add-ons. The exact available add-ons and stock change with the catalog, so check the order page before promising a customer a specific add-on.
| Move | What it changes | When to use it |
|---|---|---|
| Nano → Mini → Base | More RAM, same CPU quota on i7/i9 | Docker plus a database starts swapping on 1 GB |
| Base → Plus → Max | More SSD, then a 300 GB HDD on Max | Images, logs, media, or backup targets outgrow the OS disk |
| i7/i9 → E5 | 2 vCPUs, ECC memory, more baseline SSD | A few parallel light jobs; not a single-thread speed upgrade |
| Shared IPv4 NAT | +$4/month, shared IPv4, eight ports | IPv4-only clients or IPv4-only dependencies |
| Additional IPv6 address | Another public IPv6 address, per catalog | Separate services or migration without rebuilding |
| GPU add-on | Dedicated GPU where stock allows | Only when the workload actually uses the GPU; check availability |
Plan changes may restart the container. Treat a resize as maintenance: stop non-critical writes, take an off-box backup, then resize.
Performance and latency in Alberta
The fleet runs on Intel Core i7 12700KF, Intel Core i9 14900KF, and Xeon E5 2680v4 hosts in Onoway, Alberta. The i9 plans have the highest single-thread ceiling; the E5 plans trade per-core speed for two vCPUs, ECC memory, and more baseline SSD. All are shared hosts, so a noisy neighbor can affect tail latency. There is no dedicated-core guarantee on this tier.
Typical network latency from the Onoway facility, as published on the product page:
These are typical figures, not an SLA. If your users are in Asia or Europe, the round trip to Alberta is part of the design; choose a region closer to them if that dominates.
Deployment path: from order to a reachable service
- Choose the OS or app. The order flow exposes Linux distributions and pre-installed app images. A minimal image leaves more RAM for your service.
- Choose the plan. Start at Nano only if the workload is genuinely tiny. Mini or Base avoids an immediate resize.
- Decide on IPv4 before checkout. If any dependency or audience is IPv4-only, enable the shared IPv4 add-on. Adding it later is possible, but the port budget is easier to plan up front.
- Boot and secure it. Open the console, set SSH keys, enable the firewall, and disable password logins.
- Publish DNS. Add an
AAAArecord for IPv6. Add anArecord only when the NAT IPv4 add-on is active and the port mapping is known. - Test from outside. Test IPv6 and IPv4 separately. A service that works on one stack can still be invisible on the other.
# Minimal first-boot hardening
adduser deploy
usermod -aG sudo deploy
mkdir -p /home/deploy/.ssh
# paste your public key into /home/deploy/.ssh/authorized_keys
chmod 700 /home/deploy/.ssh
chmod 600 /home/deploy/.ssh/authorized_keys
chown -R deploy:deploy /home/deploy/.ssh
# Verify what is actually listening
ss -lntup
# Verify IPv6 reachability from another network
curl -6 -I https://your-domain.exampleLimits that decide the purchase
| Requirement | Micro container | What to use instead |
|---|---|---|
| Windows or a custom kernel | No | VPS / dedicated server |
| Dedicated CPU core | No | VPS with dedicated resources |
| IPv4-only audience without an add-on | No | Micro + shared IPv4 NAT, or VPS with IPv4 |
| All inbound ports / dedicated IPv4 | No | VPS with dedicated IPv4 |
| Large game server or heavy transcoding | Usually no | Game server or GPU/dedicated plan |
| Small bot, DNS, VPN, API, static site | Yes | — |
| Docker and a small database | Yes, with enough RAM | Mini/Base or larger |
| Staging and personal projects | Yes | — |
FAQ
Is a micro instance a VPS?
No. It is an LXC container on a shared Proxmox host, not a KVM virtual machine. You get root inside the container, but you share the host kernel.
Do I get IPv4 by default?
No. Every plan includes public IPv6. IPv4 is the shared NAT add-on at +$4 CAD/month with eight forwarded ports, or a separate VPS with dedicated IPv4.
Can I run Docker?
Yes, Docker generally works inside the container. Budget RAM for the daemon and images; 1 GB is tight once Docker and a database are both running.
Can I run Windows?
No. Windows requires a KVM virtual machine, which is a VPS or dedicated plan, not an LXC container.
Is the IPv6 address public and dedicated?
Yes, each container gets a public IPv6 address. It is not behind NAT. That also means you must firewall it.
Can I upgrade later?
Yes. Plan changes are available from the dashboard. A resize may restart the container, so take a backup first.
Is there a free tier?
There is a free i5 3470 tier with a 30-day renewal requirement and no formal uptime agreement. Availability changes; check the order page for current stock.
Where are the containers hosted?
Onoway, Alberta, Canada, on ASCS Cloud’s own hardware.
The verdict
If you need a small, always-on Linux service with public IPv6 and a bill under $5 CAD, the micro tier is a precise fit. The Base plans are the value point for RAM; the i9 Nano and Mini are the single-thread picks; the E5 plans are the two-vCPU/ECC/storage picks.
If you need IPv4-only clients, add the $4 NAT add-on and design around eight ports. If you need a dedicated IPv4, all ports, a custom kernel, Windows, or a dedicated core, stop shopping in the micro tier and use a VPS.
Compare current micro plans and stock → See VPS plans with dedicated IPv4 →
Prices, included resources, and add-on availability are taken from the ASCS Cloud catalog and product page. The order page is authoritative; stock and prices can change.