How Stedhold works
- What you can host
- Supported apps
- Python dependencies
- Node apps
- Sign-in and access
- Who is signed in (for your app)
- Sleep, wake and rollback
- The sandbox
- Protect an existing server
- What Stedhold refuses
What you can host
An app comes from one of three sources.
| Source | What Stedhold needs | Limits |
|---|---|---|
| Git repository | A public GitHub repository, written as owner/repo | Private repositories are planned |
| Zip | A zip of the project folder | 50 MB upload, 500 MB and 20,000 files unpacked |
| Existing server | The https or http address of a server you run | The address must be public, not a private or internal network |
Leave node_modules, virtual environments and build output out of a zip. Stedhold installs dependencies itself.
Supported apps
Stedhold reads the project and picks a start command. You do not write a Dockerfile.
| App type | Detected by | Starts with |
|---|---|---|
| Streamlit | streamlit in requirements.txt, or a streamlit_app.py file | streamlit run on port 8501 |
| Gradio | gradio in requirements.txt | python app.py (or main.py) on port 7860 |
| FastAPI | fastapi or uvicorn in requirements.txt | uvicorn main:app on port 8000 (the app object must be named app in main.py) |
| Next.js | next in package.json, or a next.config file | npm run start on port 3000 |
| Vite (Lovable, Bolt, v0) | vite in package.json, or a vite.config file | vite preview on port 5173 |
If the project has a Dockerfile, Stedhold reads its CMD and EXPOSE lines to start the app. It does not run the Dockerfile's other steps.
Python dependencies
- List dependencies in requirements.txt, one package per line, with optional version pins (for example pandas==2.2.3).
- Stedhold installs prebuilt wheels only, for CPython 3.12 on Linux x86_64. It never runs setup.py or compiles code.
- Lines that point to URLs, local paths or extra package indexes are ignored.
- If a package has no prebuilt wheel, the build stops and says which package. Pin a version that ships a wheel.
Dependencies are installed once, when you import the app. Waking the app starts that build; it does not reinstall.
Node apps
- Include package.json and a lockfile (package-lock.json) so installs are repeatable.
- If package.json has a build script, Stedhold runs it.
- Environment variables your build needs (for example a public Supabase URL) must be in the project today. Per-app settings are planned.
Sign-in and access
Stedhold is invite-only. The workspace owner or an admin invites people by email, and they receive a sign-in invitation. Each app has one of three access settings:
| Setting | Who can open the app |
|---|---|
| Entire workspace | Everyone invited to the workspace |
| Specific people | Only the people you pick |
| 24-hour guest pass | Anyone with a guest link, for 24 hours, without an account |
- Only the owner can turn on guest passes. Creating a new pass key ends every earlier guest link.
- Members who are not admins see only the apps shared with them.
- Removing a person or changing an app's access takes effect on their next request.
Who is signed in (for your app)
Stedhold tells your app who opened it. Every request from a signed-in person carries these headers, signed by Stedhold:
- X-Stedhold-Authenticated
- X-Stedhold-User-Email
- X-Stedhold-Access-Mode (member or guest_pass)
- X-Stedhold-Session-Expires
- X-Stedhold-Signature
Guest-pass visitors carry no email. Stedhold removes any X-Stedhold header a visitor tries to send.
Sleep, wake and rollback
- An app sleeps after 15 minutes without requests. The next visitor who passes the sign-in gate wakes it. Waking takes longer than a normal page load.
- Up to 2 apps in a workspace can be awake at once.
- A failed build never replaces a working one. The private link keeps serving the last good build.
- Rollback switches the app back to an earlier build. The link stays the same.
The sandbox
- Each app runs as its own task with 0.25 vCPU, 512 MB of memory and at most 64 processes.
- The app's files are not kept between wakes. Store data in your own database or storage service.
- Apps can reach the public internet. They cannot reach Stedhold's database, internal network, or cloud metadata, and outgoing email ports are blocked.
- Apps run in the AWS US East (Ohio) region.
Protect an existing server
Give Stedhold your server's address. Stedhold serves it at a private link behind the sign-in gate and forwards each allowed request to your server.
- The address is checked every time Stedhold connects, so it cannot be redirected to a private or internal network later.
- Stedhold does not close other ways in. Your server stays reachable at its own address unless you restrict it yourself, for example by binding the app to a port your firewall only opens to Stedhold.
What Stedhold refuses
Every import is scanned before it is built. Stedhold refuses:
- Crypto-mining software and connections to mining pools
- Phishing kits, including Telegram-bot credential collectors
- Compiled programs (executables and native binaries)
If you think a legitimate project was refused by mistake, write to hello@stedhold.com.