Installing Software on Your Managed VPS

Your server is fully managed, and the simplest way to keep it that way is this: when you need software installed, ask us to install it. What we install, we manage. That covers updates, monitoring, firewall rules, backups, and support if it ever breaks.

You still have full root access and you are free to install whatever you like. This page explains what changes when you do, so you can decide which path you want for each piece of software.

The short version

	Installed by us	Installed by you
Security updates and patching	We handle it	You handle it
Monitoring and alerting	Included	Not monitored
Firewall rules and port exposure	Configured and reviewed	Your responsibility
Hardening and service accounts	Done to our standard	Your responsibility
Support when it breaks	Covered by your plan	Best effort, not covered
Included in our documentation of your server	Yes	We may not know it exists

Nothing here is a penalty. It is simply that we cannot maintain, monitor or secure something we do not know is running.

The preferred path: ask us first

1. Open a support ticket from manager.remarkablecloud.com and tell us what you want to run.
2. Describe the goal rather than the package if you are not sure what you need. “I need a way to reach my desktop remotely” is enough for us to recommend something appropriate.
3. We confirm whether it fits your plan and your server’s resources, then install and configure it.
4. We set it up with a service account, sensible firewall exposure, logging into our central monitoring, and inclusion in your backups where it makes sense.
5. From that point it is managed software: we patch it, watch it, and support it.

Most common requests are straightforward and handled as part of your management. If something falls outside standard management, needs licensing, or would put the server’s stability at risk, we will tell you before anything is installed rather than after.

Ask early, not after: Telling us what you need before it is installed usually costs one ticket. Untangling a self installed service that has started causing problems takes considerably longer, and it happens at the worst possible moment.

If you install something yourself

You are allowed to. Root access is yours. Please just tell us it is there.

Software you install without telling us sits outside managed scope. In practice that means:

• We do not patch it, so it stays on whatever version you installed until you update it
• It is not in our monitoring, so nothing alerts when it stops, hangs, or starts misbehaving
• It is not in our central logging, so if something goes wrong there may be no record of what happened
• Our support team may not be able to help, because the first we hear of it is your ticket
• If it conflicts with a managed component, a routine update on our side can break it without warning

Tell us anyway: Even if you want to keep managing something yourself, a quick ticket saying “I have installed X on port Y, I will maintain it” costs you nothing and prevents most of the surprises above.

Why this matters for security

The most common problem we see is not badly written software. It is software installed quickly, exposed to the internet, and then forgotten.

A service that listens on a public port and is left unauthenticated or unpatched does not only affect itself. It affects the whole server, because:

• Your websites, your mail, and that service all share one IP address
• Traffic generated through a service that strangers can use appears to come from your server
• If that traffic draws an abuse report or gets the IP listed, your email deliverability is usually the first casualty
• A compromise in one service can reach everything else on the same machine

This is why we ask about port exposure and authentication when we install something for you, and why a self installed service is worth mentioning even when you are confident in it.

What we do if a self installed service causes a problem

We will always try to contact you first and let you decide how to proceed. Typical options are restricting the service at our perimeter firewall to addresses you nominate, closing the port entirely, securing the service, or handing it over to us to manage.

If a service is actively being abused or is putting the server or the platform at risk, we may need to restrict access to it immediately to protect your other services and our network. If that happens, we will tell you straight away and explain exactly what we changed.

We will not delete your data or uninstall your software to resolve this. Restricting network access is reversible, and the decision about the software itself stays yours.

Handing software over to us

If you have already installed something and would like it brought into management, open a ticket and tell us what it is and where. We will review it, tell you what needs to change to bring it up to our standard, and take it on from there if it fits your plan.

There is no fault attached to this. Servers accumulate software over the years, and a tidy handover is far better than an untracked service nobody remembers installing.

Related

• Welcome to RemarkableCloud: what fully managed covers
• Migrations policy: how custom software is handled when we move your server
• Firewall rules and IP blocking: how port exposure is controlled