This guide documents how to strip a freshly deployed Alpine 3.23 (should be fine on 3.22 also) VPS down to the minimum RAM and disk footprint without breaking it.

For those reading it running it outside of TierHive, please note this targets KVM-based VPS instances with a virtio-blk disk (/dev/vda), a single network interface, and a static IP assigned at deployment. If your disk is virtio-scsi (/dev/sda) there is one step that differs, noted inline.

Before

Fresh deploy, cloud-init has run, nothing changed yet, cant run apk, not enough free ram.

              total        used        free      shared  buff/cache   available
Mem:             91          38          25           2          28          47
Swap:             0           0           0

Filesystem      Size      Used Available Use% Mounted on
/dev/vda       953.0M    164.4M    741.7M  18% /

Stage 1: Kernel Module Blacklist and Initramfs

The Alpine virt kernel loads modules that have no purpose on a headless KVM VPS: USB controllers, graphics drivers, cloud-specific network drivers for AWS and GCP, I2C buses, input devices, and more. Blacklisting them stops them loading on boot.

Some modules, however, are listed in the kernel modules= boot parameter and load before the blacklist is read. They also need removing from the initramfs features list. Do all three together so only one mkinitfs run is needed.

Create the blacklist:

cat > /etc/modprobe.d/blacklist-unnecessary.conf << 'EOF'
# Graphics (headless server)
blacklist drm
blacklist drm_kms_helper
blacklist simpledrm
blacklist virtio_gpu
blacklist fb

# KVM (not nesting VMs)
blacklist kvm
blacklist kvm_amd
blacklist kvm_intel

# Legacy devices
blacklist floppy
blacklist cdrom
blacklist sr_mod
blacklist isofs

# HID/input (headless)
blacklist hid
blacklist usbhid
blacklist hid_generic
blacklist psmouse
blacklist mousedev

# Wrong cloud drivers (not GCP/AWS)
blacklist gve
blacklist ena

# Force block DRM (blacklist alone does not work, ACPI triggers it)
install drm /bin/true
install drm_kms_helper /bin/true
install simpledrm /bin/true
install fb /bin/true

# USB (not needed on VPS)
blacklist usbcore
blacklist xhci_hcd
blacklist xhci_pci
blacklist usb_common

# I2C (not needed)
blacklist i2c_core
blacklist i2c_smbus
blacklist i2c_piix4

# Input (headless)
blacklist evdev
blacklist button

# Misc not needed
blacklist loop
blacklist ata_generic
blacklist i6300esb
blacklist qemu_fw_cfg

# Memory ballooning
blacklist virtio_balloon

# Hard block loop device (blacklist entry alone is not always sufficient)
install loop /bin/true
EOF

Strip the initramfs down to what a KVM virtio-blk instance actually needs. The default includes USB, CDROM, NVMe, RAID, SCSI, and cloud-specific drivers that will never be used:

sed -i 's/^features=.*/features="base ext4 virtio"/' /etc/mkinitfs/mkinitfs.conf

If your disk is virtio-scsi (/dev/sda) keep scsi in the features list: features="base ext4 scsi virtio"

Fix the bootloader. The modules= parameter loads drivers early, before the blacklist runs. Remove usb-storage, ena, and gve from it. Also add the tuning parameters now so they are in place for the reboot at the end of this guide.

For /boot/extlinux.conf:

sed -i 's/,usb-storage,ext4,ena,gve/,ext4 ipv6.disable=1 audit=0 nowatchdog/' /boot/extlinux.conf

For /etc/update-extlinux.conf (persists the change across kernel updates):

sed -i 's/,usb-storage,ext4,ena,gve/,ext4/' /etc/update-extlinux.conf
sed -i 's/default_kernel_opts="/default_kernel_opts="ipv6.disable=1 audit=0 nowatchdog /' /etc/update-extlinux.conf

The parameters added:

• ipv6.disable=1 disables IPv6 at kernel level, removing the associated threads and memory allocations. Skip this if you use IPv6.
• audit=0 disables the Linux audit subsystem. It serves no purpose on a VPS, runs a kernel thread, and pre-allocates slab memory.
• nowatchdog disables the softlockup and hardlockup detectors.

Rebuild the initramfs:

mkinitfs

Stage 2: Replace OpenSSH with Dropbear

Dropbear is a minimal SSH server designed for low-resource systems. It is significantly smaller than OpenSSH and links against far fewer libraries. On a NAT VPS with a single exposed port, the switch must be done atomically: stop sshd and start dropbear in one command or you will lose access.

apk add dropbear
rc-service sshd stop && rc-service dropbear start
rc-update del sshd default
rc-update add dropbear default
apk del openssh openssh-client-common openssh-client-default openssh-keygen openssh-server openssh-server-common openssh-server-common-openrc openssh-server-pam openssh-sftp-server

Your session might drop. Reconnect on the same port as before.

Stage 3: Remove Cloud-Init and Python

Cloud-init runs once at first boot to configure the instance from the provider metadata. After that it does nothing. It pulls in Python 3 and a large set of dependencies. Since it has already run and the instance is configured, all of it can be removed, if you want to keep python, remove the '|py3-|python3|pyc' part in the command.

apk del $(grep "^P:" /lib/apk/db/installed | sed 's/^P://' | grep -E "^(cloud-init|cloud-utils|py3-|python3|pyc)")

Stage 4: Package Cleanup

Remove packages that serve no purpose on a running VPS. This covers NTP replacement, redundant shell and user management tools, hardware management utilities for hardware that does not exist, and network drivers for other cloud platforms.

Replace chrony with busybox ntpd. Chrony is a full-featured NTP implementation. Busybox includes a lightweight ntpd applet that requires no additional package:

rc-service chronyd stop
rc-update del chronyd default
rc-update add ntpd default
apk del chrony chrony-openrc

NTP is optional on KVM. The guest clock is disciplined by the hypervisor via kvm-clock. On TierHive and similar platforms where the end user has no control over VM suspension or migration, the hypervisor keeps the clock accurate and ntpd adds no value. To skip NTP entirely, do not add the ntpd service.

Remove packages with no runtime use:

apk del bash sudo doas nvme-cli syslinux mtools numactl curl e2fsprogs-extra partx qemu-guest-agent qemu-guest-agent-openrc

qemu-guest-agent enables live snapshots and guest introspection from the hypervisor. If your hosting platform uses QEMU guest operations, keep it.

Remove orphaned libraries left behind by the packages above. Some will be retained by apk because the kernel package depends on them, which is expected:

apk del readline gdbm mpdecimal sqlite-libs yaml p11-kit libtasn1 gnutls nettle gmp libidn2 libunistring libexpat libedit libffi shadow tzdata libseccomp libncursesw libpanelw ncurses-terminfo-base

Remove dhcpcd. Once a VPS has a static IP assigned at deployment, the DHCP client is not needed:

apk del dhcpcd dhcpcd-openrc

Clear the package cache:

rm -rf /var/cache/apk/*

Stage 5: Service Cleanup

Disable services that have nothing to do on a KVM VPS:

rc-update del acpid boot
rc-update del hwclock boot
rc-update del swap boot

• acpid handles ACPI events such as power button presses. The hypervisor manages power state on a VPS, not the guest.
• hwclock syncs the hardware clock at boot and shutdown. On KVM the RTC is virtualised and managed by the hypervisor.
• swap checks for and activates swap devices. There is no swap.

Stage 6: System Tuning

Fix IPv6 sysctl errors

With ipv6.disable=1 set, the kernel no longer has IPv6 sysctl keys. The default Alpine sysctl file tries to set them anyway and produces errors at boot. Comment them out:

sed -i '/net\.ipv6/s/^/# /' /usr/lib/sysctl.d/00-alpine.conf

Prevent debugfs and tracefs from mounting

These kernel debug filesystems expose internal state and are not needed on a production VPS. Note that the memory for the tracing framework is allocated at kernel initialisation regardless; this only stops the filesystems from being accessible:

sed -i 's/mount -n -t debugfs/: #mount -n -t debugfs/' /etc/init.d/sysfs
sed -i 's/mount -n -t tracefs/: #mount -n -t tracefs/' /etc/init.d/sysfs

Sysctl tuning

The default network socket buffers are sized for servers under heavy load, not minimal VPS instances. Reduce them along with a few other settings:

cat > /etc/sysctl.d/10-minvps.conf << 'EOF'
# Reduce network socket buffers
net.core.rmem_default = 32768
net.core.wmem_default = 32768
net.core.rmem_max = 131072
net.core.wmem_max = 131072
net.core.netdev_max_backlog = 64
net.core.somaxconn = 128

# Reclaim inode and dentry caches more aggressively under memory pressure
vm.vfs_cache_pressure = 500

# Reduce PID table overhead
kernel.pid_max = 4096

# Dirty page writeback thresholds
vm.dirty_background_ratio = 5
vm.dirty_ratio = 10

# Disable watchdog
kernel.watchdog = 0
EOF

Switch syslogd to in-memory circular buffer

By default syslogd writes to /var/log/messages on disk. Switching to a circular buffer stores logs in memory instead. They remain accessible via logread. This removes the ongoing disk writes and the associated page cache overhead:

sed -i 's/SYSLOGD_OPTS="-t"/SYSLOGD_OPTS="-t -C64"/' /etc/conf.d/syslog

Reduce block device read-ahead

The kernel defaults to 8MB of read-ahead on the block device. On virtual storage this is wasted memory. 128KB is more than sufficient:

echo 128 > /sys/block/vda/queue/read_ahead_kb

cat > /etc/local.d/readahead.start << 'EOF'
#!/bin/sh
echo 128 > /sys/block/vda/queue/read_ahead_kb
EOF

chmod +x /etc/local.d/readahead.start
rc-update add local default

Reboot

reboot

After

              total        used        free      shared  buff/cache   available
Mem:             91          23          51           0          17          63
Swap:             0           0           0

Filesystem      Size      Used Available Use% Mounted on
/dev/vda       953.0M     71.9M    834.1M   8% /

RAM down from 38MB to 23MB. Disk down from 164.4MB to 71.9MB.

What Is Still Running

The only userspace processes after boot are syslogd (circular buffer mode), dropbear, and two getty processes: one on ttyS0 for serial console access and one on tty1 for the browser-based console panel.

The loaded kernel modules are exactly what the system requires: the virtio stack (virtio-blk, virtio-net, virtio-rng), the ext4 filesystem stack (ext4, jbd2, mbcache, crc16), hardware AES acceleration (aesni-intel, ghash-clmulni-intel, gf128mul), rng-core, net-failover, failover, and af-packet for raw socket support.

Notes for tinkerers:

Two kernel threads will appear in ps aux that look surprising: [scsi_eh_0] and [scsi_eh_1]. These are SCSI error handler threads compiled into the virt kernel. They are dormant and cannot be removed without a custom kernel.

Similarly, [watchdogd] persists despite nowatchdog in the cmdline. There is no /dev/watchdog device present and no watchdog module loaded. The thread does nothing.

I have done this on the VPS that runs https://backtogeek.com if you want to have a look as a performance indication, the whole thing runs on the 128mb, 1gb disk, low priority tier (the $0.10 /month $0.000135 /hour one) its a nothing site, just playing with rust to see how compact i can get a bespoke thingy running with tls support, it uses about 25mb in total to run that site, i will finish it one day and release it (open source) as a hackernews clone/micro blog platform

Anyway... hopefully that injects some low-end spirit into you!

More to come, its not meant to be a tierhive promotion, but it's what I have to work on, and it does not get much more low end than tierhive, this should work on pretty much any kvm host, if any hosts want to provide a VPS for me to test future crap on, I am happy to use your links instead!

version on the tierhive blog: https://tierhive.com/blog/tierhive-howto/how-to-run-alpine-with-just-23mb-ram

Coming soon, similar guide for Debian 13

I’m Andy, and today I’m finally doing something I’ve been overthinking for a very long time.

The idea for a dedicated, privacy-focused link management tool for our specific niche has been living in my head for several years. I’ve always felt that as a community of sysadmins, hosters, and tech enthusiasts, we deserve a utility that isn't owned by "Big Tech," doesn't sell click data, and understands the "LowEnd" aesthetic.

A while ago, I finally sat down and built it: LowEnd Shortener.

You might wonder why it took so long to see the light of day. I wanted to do this the right way, so I reached out to the management of LowEndTalk months ago to coordinate a release. Unfortunately, I hit a massive wall.

Despite "LowEnd" being a generic industry term used by all of us for over a decade, WNY IT Services, Inc. (LET owners) claimed that using the name "LowEnd" and domains like lowend.vip, low.ad or lowendspir.it was a trademark violation. I was told that the service would not be allowed on their platform.

I spent weeks in back-and-forth negotiations, even offering to hand over the entire project for free just to ensure it could exist for the community. But communication eventually went silent. This impasse drained my motivation and delayed the launch by months. It felt like a "corporate takeover" of a term that belongs to all of us.

After speaking with Mason (LES Admin), who was incredibly supportive and shared a much more community-oriented perspective, I decided to stop waiting for a "green light" from the corporate side.

I’ve realized that the spirit of this community doesn’t live in a trademark office – it lives right here on LowEndSpirit.

The system is currently in Beta. It is built on secure infrastructure, uses deSEC.io for DNS integrity, and is designed to be a bridge between our platforms.

• Branded Domains: Use low.lc, lowendspir.it, lowend.vip, low.ad, and more.
• Provider Features: Verified hosters can request vanity subdomains (e.g., yourbrand.lowend.vip) for professional-looking links.

I’ll be honest: I am still worried. I fear that releasing this tool under the "LowEnd" name might lead to the "ban hammer" being dropped on me. I’ve had my share of trademark disputes in the past, and they are exhausting.

Furthermore, I want to apologize in advance if my response time is sometimes slow. Due to health reasons, I occasionally have to step away from the screen, and it might take me a bit longer to reply to requests or support tickets. I hope you can forgive me for that.

But I truly believe this tool is useful. I’ve decided that the community’s need for a clean, free utility is more important than my fear of corporate retaliation.

I am releasing this as a beta because I need your feedback. Most importantly, I hope for some support from the LES family. If you believe that a community tool should be independent and free, I’d love for you to try it out.

You can find it here: https://lowend.vip

Note: I have retired the lowendta.lk domain out of respect for their specific brand, but I am keeping the project name as "LowEnd Shortener" because that is what it is.

Thanks for reading my "Ted Talk." I’m looking forward to your thoughts!

Best regards,
Andy

Responsibilities:
• Handle support tickets like a pro.
• Conduct background checks on provider applications to keep our standards high.
• Approve new members and diligently check for duplicate applications—no clones allowed!
• Manage member DMs and process flags without breaking a sweat.
• Continuously think of creative ways to add value to the LES experience.
• Maintain the provider list and keep AuroraZero well-fed and happy.
• Adapt to other random tasks that pop up from time to time—because surprises are part of the gig.

Qualifications:
• Unbreakable spirit and a thick skin—you’ll need it.
• Dedication to the cause despite the lack of pay.
• Ability to take criticism with a smile and keep moving forward.
• A sense of humor is a plus—it’ll help keep you sane.

If you’re ready to embrace the chaos and make LES an even better place, shoot us a message. Your new (volunteer) destiny awaits! 😎

Hello,

I hope you are well.

From the subject line alone the content of the email is probably already clear.

With a heavy heart, it has been decided to bring this service to an end, it started as a project run by Inception Hosting around 10 years ago however with the lack of development upstream for OpenVZ specific to the hosting industry and declining interest in favor of KVM this is now to management heavy to justify continuing with.

It is also understood that OpenVZ 8 as a project has been essentially dropped in favor of focusing on OpenVZ 9 with no solid release date and OpenVZ 7 is likely going to end of life within 6 months in line with CentOS 7 we think it is right to call time on this project and refocus efforts on our KVM product line.

We will be setting all NAT/LES OpenVZ products to expire and prevent them from renewing, we will honor any existing terms and if you have less than 30 days on your service we will extend that by another 30 days at no extra cost to allow you time to migrate any data.

Those of you who have a service in Phoenix will already be set to expire as discussed in a separate email following the raid failure earlier in the year.

We have also recently revised the prices on our KVM plans so perhaps one of those would be fitting for you if you are looking for an alternative, the main website prices have not been updated yet (Work in progress) but we did post a link on the LowEndSpirit forum: https://lowendspirit.com/discussion/6960/inception-hosting-new-plans-new-prices-uk-nl-de-usa if you are interested.

If you have any questions or concerns please do let us know via a support ticket, direct email responses will not be seen.

Thank you for your years of support.

Anthony.
Inception Hosting Limited.

Thanks to @InceptionHosting ( Anthony ) for keeping the party going this long.

I still have fond memories of hosting game servers on these small vm's. What about you folks,what was your use case ?

If I had to guess, then VPN ?

Don't view this link without sunglasses: https://0x0.st/-YRD.png

*Didn't realise "fullscreen" isn't a word.

About VPS-Hosting:
I moved over two droplets from DigitalOcean over to The-Online.com VPS, both instances riding on 4 GB of RAM, one in U.S and the other in their Netherlands (Europe) location. Uptime and reliability has been very solid. Performance is better than DigitalOcean, not to mention the better cost savings for my wallet plus there 24/7 free support even for self-managed VPS. You can also order managed-vps with cPanel and dedicated support.

Fantastic deals for yearly pricing via Black-Friday. This company responses to tickets in less than 15 mins. Extremely helpful. No down time and excellent service provided all around. They don't care how much you spend with them, every customer is as important as the rest.

Overall a small yet, good and affordable hosting provider in U.S, Europe and Asia. you can give it a try.

I have recently bough VPS from @Abdullah (webhorizon.in)

Earlier I was using dedicated VPS for openvpn. Now I am switched to NAT VPS. The problem is when I am connecting to OpenVPN through mobile or desktop app. It is connecting to VPN but no internet is working. I am not expert in VPS so need help!

Please let me know if any screenshot or log to be shown here.

root@mylocalmachine:~# ping -f [we still don't post IPs, right?].98 
PING 56(84) bytes of data.
................^C   
--- ping statistics ---
214 packets transmitted, 198 received, 7,47664% packet loss, time 3361ms
rtt min/avg/max/mdev = 242.600/278.443/320.271/17.202 ms, pipe 21, ipg/ewma 15.780/252.115 ms

it's similar to/from other euro machines in various directions, here's to OVH for example over IPv6, no difference really

root@LESVPS:~# ping -f my.machine.in.ovh
PING 56 data bytes
......................................................................^C 
--- ping statistics ---
521 packets transmitted, 451 received, 13% packet loss, time 8398ms
rtt min/avg/max/mdev = 157.012/160.179/197.734/4.014 ms, pipe 14, ipg/ewma 16.150/159.652 ms

once the connection is over the pond, it's perfect

root@LESVPS:~# ping -f 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
.^C 
--- 8.8.8.8 ping statistics ---
752 packets transmitted, 751 received, 0% packet loss, time 10536ms
rtt min/avg/max/mdev = 13.024/14.164/40.957/2.508 ms, pipe 4, ipg/ewma 14.029/16.485 ms

What's going on? Other LES nodes from Inception are fine but, obviously, the US proxy is most useful for getting around GDPR/cookie/geoIP nonsense.

Here it is:

There are still less new discussions on LowEndSpirit than on its older brother, but the difference is much smaller than I thought. Seems like we got quite some discussions going on here too, great job @AnthonySmith! Definitely worth keeping an eye on LowEndSpirit.

EDIT: Just replaced the figure with one counting discussions as logged in user (see discussion below). The original chart that just counted disucssions visible to non-logged in users can still be found here.

I believe people like dancing girls on sales threads so here you go:

tl;dr: NAT deal is back, storage 50% off now also for quarterly or semi-annual payments, new general vz7 bundle in 3 locations, 50% off VZ7 SSD in the UK.

Now for the deals:

256MB x 3 NAT BUNDLE

• BLACK FRIDAY - 50 available
• UK, NL, USA
• 3 x 256MB NAT
• OpenVZ 7
• VPS
• ALL 3 for €6.99 / year

BUNDLE ORDER: https://clients.inceptionhosting.com/cart.php?a=add&bid=17

UK STORAGE

• COUPON CODE: BF2019-STOARGE
• 50% OFF on
• Quarterly, semi-annual, annual payments!
• for all plans with
• 2GB, 4GB, 6GB & 8GB RAM
• From 400GB to 1600GB Disk
• RAID 5

VIEW PLANS: https://clients.inceptionhosting.com/cart.php?gid=31

USA STORAGE

• COUPON CODE: BF2019-STOARGE
• 50% OFF on
• Quarterly, semi-annual, annual payments!
• for all plans with
• 2GB, 4GB, 6GB & 8GB RAM
• From 400GB to 1600GB Disk
• RAID 5

VIEW PLANS: https://clients.inceptionhosting.com/cart.php?gid=30

OpenVZ 7 Bundle

3 x 1GB RAM OpenVZ servers for €30 p/year

• UK - London | 1GB RAM | 25GB Disk | 1 x IPv4 + /64 IPv6 | 600 GB BW
• NL - Rotterdam | 1GB RAM | 25GB Disk | 1 x IPv4 + /64 IPv6 | 600 GB BW
• USA - Phoenix AZ | 1GB RAM | 20GB Disk | 1 x IPv4 | 500 GB BW

LIMITED to 10 in total, 1 per person.

Order Link: https://clients.inceptionhosting.com/cart.php?a=add&bid=18
Special terms: if you cancel any location the others go to regular pricing.

CREDIT OFFER

25% credit on all credit top ups of €50 or more and 20% credit on all credit top-ups of less than €50 for existing customers only, minimum qualifying top up €20

Process:

1. login to the billing area.
2. On the top menu, click 'Billing' and 'Add funds'
3. Enter €50 or more and click 'Add Funds'
4. Open A ticket with the invoice number once paid to get your extra 25%

Special Terms: credit + bonus can only be used against new invoices generated after the 16th December.

UK OpenVZ 7 PURE SSD Plans

• Coupon Code: CMVZ7-2019
• 50% off on all semi-annual or Annual terms.
• Applies to 1GB+ plans only
• From 1 - 4GB Ram
• From 10 - 25GB Disk
• 1 x IPv4
• 1 x /64 IPv6
• DDOS Proetcted
• Free Direct Admin licence available on request.

Order Link: https://clients.inceptionhosting.com/cart.php?gid=28

To answer the regular questions, click spoiler if you don't plan on reading the terms: