Puter on Ubuntu 24.04

Why the cloudimg image

Upstream's own self hosting path is a six container stack, and its first start creates an administrator account with a temporary password it prints to the log and keeps in plain text in the database. cloudimg ships neither. The image is a single application service with an embedded database and object store behind one hardened reverse proxy, so there is no cluster of containers to babysit, and it contains no database, no accounts and no signing secrets at all. On first boot each machine generates its own token signing secrets, replaces that bootstrap administrator password with a random per machine one, erases the plain text copy upstream leaves behind, and only then opens the public port, so the temporary credential is never live on a reachable listener. Self registration is closed in the shipped configuration rather than switched off afterwards, and first boot proves it. cloudimg also fixes the defect that makes upstream's single node profile unusable on a server: file uploads are handed to the browser as presigned URLs pointing at the loopback address, so saving a file fails on every deployment that is not a laptop. Here the object store runs as its own service, is presigned against a browser reachable address, and is fenced to loopback by the kernel because it does no request signing of its own. Fully patched at build time, paired with a step by step deploy guide and 24/7 cloudimg support.