# Fresh virtual computers

How dedicated physical hosts will deliver clean Linux and Windows desktops.

Status: Target architecture · Proxmox migration and desktop service pending


## A physical host, a fresh virtual desktop

Every company and partner rental machine must run Proxmox VE as its always-on host operating system. A rental receives a new virtual machine created from an approved clean template. Customers access that guest desktop through ComputerUse; they do not receive the hypervisor administrator account.

The initial dedicated offer reserves one physical host for one customer VM, with memory held back for Proxmox. Company ownership and partner hosting describe who owns the equipment. Both require Proxmox installation and the same customer isolation and cleanup checks.

## New rentals and saved work

A **new rental** must start with a fresh guest identity, disk and access credentials. A **returning customer using the same rental** keeps their files. Finishing an agent task does not cancel the rental or erase its work.

| Action | What happens to files? |
| --- | --- |
| Agent finishes | Files remain in the same rental |
| Reboot or stop | Disk remains; running processes are not retained |
| Explicit reset | A clean guest replaces the existing desktop |
| Cancel/delete | Access is revoked and the chosen retention/deletion policy applies |

An optional ephemeral mode can discard its writable disk after each session. Persistent rentals can retain documents, browser profiles and installed applications for the same account. Sharing one rental across projects shares that desktop; separate computers provide separate environments.

## Provisioning through the API

The target flow is: reserve verified capacity, clone a versioned template, set guest resource limits and network isolation, create unique credentials, boot the guest, verify desktop controls and then expose the rental. Billing must not begin before readiness is confirmed.

Linux images can use cloud-init. Windows needs an appropriately licensed, generalized image and its own initialization process. Proxmox provides VM lifecycle management; the ComputerUse guest service must still provide screenshot, mouse, keyboard and other supported actions. [Proxmox cloud-init documentation](https://pve.proxmox.com/wiki/Cloud-Init_Support).

## Resource promises

Physical RAM and guest RAM are different. Proxmox requires host memory in addition to the memory assigned to guests. Guest allocations will be stated explicitly before checkout is enabled; there is no memory overselling in the proposed dedicated pool. The current 8 GB and 16 GB labels describe physical hardware tiers. [Proxmox requirements](https://proxmox.com/en/products/proxmox-virtual-environment/requirements).

Linux is the initial deployment target. Windows availability and any surcharge depend on the selected Windows product, hosting entitlements, hardware compatibility and tested image. A Windows surcharge has not been finalized. Light video editing requires workload benchmarks; installed RAM alone is not a performance guarantee.

## Cleanup and storage

Cleanup must cover guest disks, snapshots, credentials, temporary exports and any authorized backups. Formatting an SSD or clearing a browser history alone does not establish secure erasure. The target design uses per-rental encryption, explicit retention and verified cleanup before a host returns to available stock. This sanitization pipeline is not yet active in the reporting client.

Local SSDs will serve live desktops. A NAS or backup service can provide separately controlled recovery copies; S3-compatible storage can hold encrypted exports or archives. Neither is automatically a shared customer folder. Archived disk restoration and storage billing are separate features to implement and verify.

## Converting a host

The old Windows reporting installer is retired from public onboarding. The only supported host path uses bootable Proxmox media and **erases the selected target disk**. Preparation must identify that disk, record the recovery decision and require deliberate confirmation. The reusable image detects the exact disk at boot, obtains a unique credential after authenticated enrollment, and requires a local ERASE confirmation. A full virtual-machine installation and management rehearsal has passed; physical deployment remains to be verified.

A host remains unavailable for rentals until its VM controls, private networking, clean reset, deletion and power recovery checks pass. Partner hardware also completes qualification. [Required host setup](/docs/host-setup/) explains preparation, firmware settings, conversion and central management.