A server base that's ready to run software
Standing up a server usually means a first hour of installing Docker, a Kubernetes toolchain, OpenTofu, monitoring and a firewall, then hardening SSH before anything runs. Sysible Server ships all of it on a Debian-stable base and boots straight to a console — no desktop, no bloat. Reach it over hardened SSH and start deploying.
No GUI, nothing wasted
Boots to a console — no GNOME, no display manager, no desktop apps. Every megabyte and cycle goes to your workloads.
The server toolchain, already there
Containers, Kubernetes, infrastructure-as-code, networking and observability tools are baked in — deploy on first boot.
A base you can trust
Debian stable — apt, systemd and the whole ecosystem, unchanged — with automatic security updates on by default.
Secure from first boot
SSH enabled but locked down (no root login), fail2ban, auditd, AppArmor, a sysctl profile and a password-quality floor.
Everything to run server software
Docker CE & Podman
Docker Engine + Compose/buildx and containerd, plus rootless podman/buildah/skopeo — build and run containers on first boot.
kubectl · Helm · k9s
The everyday Kubernetes toolchain, so a cluster is one kubeconfig away.
OpenTofu & Ansible
OpenTofu (the open, Terraform-compatible fork) and Ansible + ansible-lint — provision and configure from the box.
SOPS
Encrypt and manage secrets in git with sops, preinstalled.
nftables & the toolkit
nftables, tcpdump, nmap, mtr, iperf3, socat and the iproute2 suite.
Know what it's doing
btop, htop, iotop, sysstat, ncdu, smartmontools and strace.
A shell that's a joy
jq, ripgrep, fd, bat, fzf, tmux and Python 3 with pip/venv/pipx.
Unattended security updates
Debian's unattended-upgrades is enabled out of the box, so security fixes land without you babysitting the box.
Reachable, but locked down
Enabled & hardened
Unlike the Workstation image, a server is meant to be reached — so ssh is on, with root login disabled and a tightened login surface. Password auth is left on so a fresh box is reachable before your keys are in place; flip one line to go key-only once they are.
Manage it with Controller
Enrol a Sysible Server into Sysible Controller and manage users, services, packages, storage, firewall and live terminals across your whole fleet from one console.
Get Sysible Server
A headless, hardened Debian-based server base — boots to a console, SSH ready.
amd64 · Intel / AMD
arm64 · Apple Silicon / ARM
Build it from source
- Clone the repo:
git clone https://github.com/sysiblesoftware/Sysible-Server - Build on a Debian host or
debian:bookwormcontainer:cd live-build && sudo ./build.sh(orSYSIBLE_ARCH=arm64 sudo ./build.sh). - The finished .iso lands in live-build/. Or run the ISO GitHub Actions workflow to build in CI and, optionally, publish a signed release.
A server base, ready to deploy
Boot it, SSH in, and the container, Kubernetes and IaC tooling is already there — hardened, headless, out of your way.