ZeroLog
Private preview
Back to Newsroom

Product

23 October: one-click Tailscale and Connect, a wider key proxy, a new look

Containers connect to Tailscale, drive and SSH in one click. The key proxy has 93 provider templates and Microsoft 365, and BYOK asks for consent on third-country providers.

User impact: Not reviewed

Live on 23 October 2026. Further releases today are added here after they deploy.

One request through the key proxyAn agent sends a request that carries a placeholder instead of your key. The egress broker hands it to the key service with a signed preamble naming the user and container. The key service rejects ambiguous requests, chooses the provider profile by destination host, checks that the placeholder is yours, classifies the operation and compares it with the key's rule. Allowed operations continue; known but disallowed ones get 403; unknown operations and payments wait for your approval. After a rate brake the real key is inserted and sent only to the profile's host, and the response is redacted before it returns to the agent.Key service (separate VM)allowedneeds younot allowedapproved once1. Agent sends a requestwith a placeholderinstead of the key2. Egress broker handsover with a signedpreamble (user, container)3. Reject ambiguousrequests: path tricks,duplicate headers4. Pick the profile byhost. Placeholder mustbe yours, same container5. Classify the operation,check the key's rule6. Rate brakeper risk class7. Insert the real key9. Redact your key values,swap new secrets forplaceholders, send back403 refusedYou approve unknownoperations, payments(60 s, then 403)8. Provider APIprofile host onlyno redirects
One request through the key proxy. Diagram from the docs.
Text version

The agent sends a placeholder. The key service checks host and operation against your rule, then inserts the real key.

New

  • Tailscale in one click from the container overview. Owner only, and no auth key is accepted.
  • Connect: drive and SSH over HTTPS for the owner, with one-time codes (5 minutes, single use), a key per device and a helper with a published SHA-256.
  • Key proxy: 93 provider templates with search and categories, tabs for AI keys and services, 63 more listed as coming soon. Microsoft 365 works through Graph with 25 actions; sending and deleting need your confirmation.
  • BYOK: the top 20 plus Swiss and international zero-data-retention providers, fixed hosts, keys encrypted. BYOK never falls back to the shared pool. DeepSeek, Moonshot (region Singapore, operator in China) and Qwen show a third-country notice, and the server enforces the consent checkbox.
  • New look on the start page, pricing, status, waitlist, investors, agents, legal frame and 404, with page changes that do not flash. Legal texts are unchanged. Docs pages were checked against the code and most gained a diagram.

Fixed

  • Paused is its own container state on every route, and a paused container no longer keeps an agent runtime.
  • Tailscale failed on worker containers: the CPU pin came from the wrong node's pool, and worker workspaces were owned by root. Both fixed.
  • Paths like mit%20Leer.txt crashed the front-door proxy. Also, the blue/green proxy switch had never run in production, because a test wrote the new hash as if it were live. The deploy now asks the running proxy.
  • SMB host and share names are shown to admins only, and smbd listens on loopback. Users get WebDAV over HTTPS.

Corrections belong here too. Feed · Docs · X · Legal & privacy