We've found a different, simpler way to route IP addresses into VPSes without transit networks.
Staging VPSes now have no transit addresses, only public ones. The current VPS networking setup is described in the documentation.
For staging VPSes, vpsAdmin distinguishes network addresses, which are routed into the VPS, from host addresses assigned to an interface. IP address management is therefore split between two forms in the web interface. For now, this is just a foundation we'll build on later.
Removing transit addresses makes iptables masquerading work, along with Docker's default network, which uses it. You don't need to create your own network. Installing Docker now needs no extra steps. We still need to sort out delegating ZFS datasets into VPSes so Docker can use its ZFS driver.
If you wanted to try vpsAdminOS but didn't want to install Nix and figure out how to build it, sorki has prepared a vpsAdminOS ISO you can download and boot straight away. It's a live system and includes an installer if you want to install it to disk or try declarative configuration with Nix.
Since Friday, staging VPSes have been backed up so we don't have to worry about our data. Restoring VPSes from backups works, but you can't yet mount those backups on staging. You will be able to mount them on production VPSes. We haven't finished NFS support yet; it will come with the NAS.
At the end of August, we hit an unexpected limit: did you know the maximum number of memory cgroups is 65536? A few members had already exhausted them, so we looked at raising the limit. snajpa wrote a kernel patch raising the maximum to 2147483648, though swap doesn't work with it yet. That doesn't bother us, since we don't use swap.
We also needed to limit how many cgroups individual VPSes can create, so nobody could exhaust all of them and affect others. For this, snajpa created the cglimit cgroup controller. You can see and use it inside your VPS too. cglimit.all.max sets the limit for all cgroups, and cglimit.memory.max for memory cgroups only.
Thanks for help with testing (IRC nicknames): ppar, somm, domogled, pdostal, etnyx and everyone else who contacts support. If you find a bug, please let us know; we'll be happy to fix it.