The reason we put so much effort into exposing these publicly is for sharing with a heterogeneous team without imposing a client agent requirement. The web interface should be easy to make public, easy to share with friends with a Google Docs-style link, and ssh should be easy to share with teammates.

That said, nothing wrong with installing tunneling software on the VM, I do it!

I certainly wish we simply had more addresses. But v4 works.

We are not running out of IPv4 space because NAT works. The price of IPv4 addresses has been dropping for the last year.

I know this because I just bought another /22 for exe.dev for the exact thing described in this blog post: to get our business customers another 1012 VMs.

IPv6 does not work on the only ISP in my neighborhood that provides gigabit links. I will not build a product I cannot use.

Even when IPv6 is rolled out, it is only tested for consumer links by Happy Eyeballs. Links between DCs are entirely IPv4 even when dual stacked. We just discovered 20 of our machines in an LAX DC have broken IPv6 (because we tried to use Tailscale to move data to them, which defaults to happy eyeballs). Apparently the upstream switch configuration has been broken for months for hundreds of machines and we are the first to notice.

I am a big believer in: first make it work. On the internet today, you first make it work with IPv4. Then you have the luxury of playing with IPv6.

We believe the fix here is to mount the base image as a read-only block device, then mount a read-write block device overlay. We have not rolled it out yet because there are some edge cases we are working through, and we convinced ourselves we could rework images after the fact onto a base image.

Right now our big win from copy-on-write is cloning VMs. You can `ssh exe.dev cp curvm newvm` in about a second to split your computer into a new one. It enables a lot of great workflows.

That said, I have seen several use cases where people want a VM for something minimal, like a python interpreter, and this is absolutely the sort of approach they should be using. Lot of promise here, excited to see how far you can push it!

Support Engineer - If you want to use Claude or Codex (or Shelley!) to trawl through our code base, augmented with (carefully scoped) API keys to make our customers lives better, we are hiring.

Designer - If you want to use Claude or Codex (or Shelley!) to make our product functional and beautiful, we are hiring. You do not ship mocks or assets to other teams. There is no other team. You ship by pushing to production. Don't worry, we've got your back.

Software Engineer - If you see a pattern here, we are hiring. Expect to design, build, and run entire subsystems. What matters is attention to product detail and overall architecture, we have agents for writing code.

With significant industry experience, pay will be over $200,000 with meaningful equity.

We are a small team and going to stay one. The focus is building a high-trust environment. Success for us is if you say "I'm going to fix the load balancer" we all sigh with relief, because you are on it and we can rely on you to take on and solve large projects.

A general problem for Google products is that everything is mixed together.

That said, we (exe.dev) have a couple more things planned on the VM side that we think agents need that no cloud provider is currently providing. Just don't call it a sandbox.

We have built two of them now, and clearly the state of the art here can be improved. But it is hard to push too much on this while the models keep improving.

  ssh servername@exe.dev

I built jumpbox support into our proxy on a branch to get -J working. I have not shipped it (but probably will in the future). The reason we did not use it for default access is we do not want our proxies to complicate the experience of using VMs. We want to be as close to “just a computer” as possible. Jumpboxes are not unheard of but they are still a relatively uncommon ssh feature.

It gets even nicer if you setup a CNAME for your box, then you can:

  ssh myserver.com

Another way of saying it: we are willing to take on a lot of complexity internally to remove a little bit of complexity for our users. This was my standard of operation at Tailscale and it is how I like to program.

It also says that if you can find an audience to build a new ad platform, the incumbents have created enormous margin for the new platform.