Free tier

The free tier is a full Kubernetes namespace with fixed quotas.

Quotas

Resource	Quota
CPU	200 mCPU
Memory	512 MiB
Storage (nfs-rwx)	1 GiB
Pods	5
Persistent volume claims	1
Egress	10 GiB per month

No block storage

hcloud-volumes is not available on the free tier. The only storage you can request is nfs-rwx.

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: data
spec:
  accessModes:
    - ReadWriteMany
  storageClassName: nfs-rwx
  resources:
    requests:
      storage: 1Gi

Outbound traffic is limited to the web

This is the restriction most likely to catch you out, because nothing warns you until a connection hangs.

A free namespace may open outbound connections only on HTTP (80) and HTTPS (443), plus DNS. Everything else is dropped. In practice that means:

• Calling an external HTTP API works.
• Pulling a public image works.
• Connecting to a database, cache or message broker outside the cluster does not work. There is no way to open port 5432, 3306, 6379, or anything else.
• Sending mail directly does not work, on any tier.

Anything your application talks to on a non-web port has to run inside your own namespace, where pods reach each other freely. If your architecture needs an outside connection on another port, that needs a paid or pay-as-you-go plan; the pricing calculator shows what that costs for your workload.

No custom domains

A free namespace serves names under <your-namespace>.itsh-apps.dev only. You cannot add a domain of your own, see Gateway API. Routes on the free-tier domain are also served with an X-Robots-Tag: noindex, nofollow header, so search engines will not index them.

One namespace per account

Each account gets exactly one free namespace, once, ever. Delete it and you do not get a second one.

Moving to a paid plan

You can convert the free namespace to pay-as-you-go from the portal. It happens in place: your workloads keep running, the quota is raised, and nothing needs redeploying.

The fixed sizes are a different route. Those are ordered through the shop like any other product, and you get an additional namespace rather than a converted one. The difference is not visible from the product, so it is worth knowing which one you want before you start.

Converting also lifts the free-tier restrictions: block storage becomes available, outbound traffic is no longer limited to the web, and you can add your own domain.

When the namespace is suspended

• Egress cap exceeded: the namespace is suspended and resumes automatically on the 1st of the following month.
• 30 days of zero egress: the namespace is suspended as well.

Verification

Phone verification is always required. On top of that, a zero-euro card confirmation can be required when risk signals fire.

What's next

• Your first deployment to use the namespace
• Outbound connections fail if something cannot connect