Bring your own box

If you already hold a multi-month or multi-year lease on a box - your own datacenter capacity, or a long-term rental somewhere else - you don't have to migrate off it to get pods, snapshots, and version history. Point aq at it directly, in one of two modes.

• Detached - your box, no control plane, no Aquanode account required. aq talks to it over SSH; capture, restore, versions, and run/logs/ssh/sync all work against storage you provide.
• Attached - your box, joined to Aquanode's control plane. It shows up in the console next to your rented machines and gets teams, sharing, and jobs.

Detached needs nothing from us but the CLI. Attached is one more command on top of it, never a re-capture - the same pod you built detached is the pod you see once you attach.

What works where

Everything in the "Detached" column needs no account, no credentials, and makes no call to the Aquanode API at all - it's aq and ogre talking to your box directly. Everything that requires the control plane needs the box attached first.

Detached: your box, nothing else

aq host add <alias> --ssh root@1.2.3.4 --identity ~/.ssh/id_ed25519

This installs ogre on the box over SSH and records it as a local host alias - it never touches the Aquanode API. Every box-facing command accepts the same target a rented deployment would:

aq ssh host:<alias>
aq run host:<alias> -- python train.py
aq save host:<alias>

--dry-run on aq host add surveys the box and prints what it would do without installing anything, the same as aq import --dry-run.

By default a detached pod's snapshots go to storage you configure yourself (OGRE_S3_* or --to against any S3-compatible bucket). You can run detached indefinitely this way and never create an Aquanode account.

Attached: joins the console, keeps the lease

aq attach <alias>

Attaching registers the box as a deployment we never provisioned. It shows up in the console and aq ls next to boxes you rented from us, and gets the version history, sharing, and job machinery every pod gets. The lease is still yours - we never take over billing for the hardware, and we never contact the provider you rented it from.

aq attach --dry-run prints the plan - what gets installed, what credentials get minted - without writing anything.

Connectivity is direct, or it's detached

An attached box is reachable exactly one way: a public IP, a port reachable from Aquanode's infrastructure, and TLS pinned to the box's own certificate. aq attach checks this before it records the box as attached - a box that fails the check is never marked reachable, and attaching fails loudly rather than half-succeeding. By default that port is TCP 8444, ogre's control API. If you also want the console's browser terminal, TCP 8443 must be reachable inbound too - that's ogre's own fixed terminal-proxy port, separate from the control API, and attach works without it (you just won't get a Terminal tab).

If your box can't take an inbound connection - it's behind a NAT you don't control, or firewalled off from the outside - that's not a dead end. Stay in detached mode. It needs zero inbound connectivity by design, and every capture/restore/run/logs/ssh/sync command above works exactly the same either way. You lose the console and the other control-plane features; you don't lose the ability to use the box.

Port-mapped boxes can't attach at all, on any port. aq attach dials the same port ogre's control API listens on - there's no separate "external" port to configure. Most container-pool marketplace listings (simplepod, vast.ai, and similar) remap every port: the control API's 8444 inside the container is reachable from the outside only as some other port entirely (say, 14017), so nothing you pass to --ogre-port can make listen-port and dial-port the same value. This is a scope decision, not a missing flag - attach is built for boxes with a real public IP and a direct inbound path (bare metal, most VM-pool providers). A port-mapped box stays fully usable in detached mode; it just never attaches.

Release, not terminate

Detaching a box back out is aq release <alias>. It revokes the credentials we issued and removes the deployment from the console. On the box itself, it stops the ogre daemon aq attach started and removes the credential file it wrote (/etc/aquanode/ogre.env) - the box keeps running otherwise, and we never contact the provider you lease it from. That's different from what "terminate" means everywhere else in Aquanode: on a rented machine, terminate tears the box down at the provider. On an attached box, release only ever un-registers it from us.

Billing on an attached box

We bill nothing for hardware we didn't rent - there's no hourly or per-second charge for an attached box, ever. The only thing that can bill is storage: if a pod's snapshots land in an Aquanode-provided bucket, that storage meters the same as any other pod's. Point the pod at your own bucket instead and nothing bills at all.

Jobs on your own box are fixed capacity

An attached box can serve a job the same way a rented one can, but maxInstances is bounded by what the box actually has - a lease has the GPUs it has, and a job on it can't scale past that. A job pinned to your box stays on it: when the queue is deeper than the box can serve, the queue drains rather than renting anything, and there is no setting that makes it spill onto marketplace providers. Run a second, unpinned job if you want marketplace capacity.

Which mode should you use

Start detached if you're not sure you want an account yet, or the box can't take an inbound connection - it's the complete version of "use your own hardware with Aquanode's tooling," not a trial of attached mode. Attach when you want the console, sharing, teams, or jobs on top of it. Moving from detached to attached is one command (aq attach) against a box you already added with aq host add - it never re-captures anything you already have saved.