Private per-user “mini VPS” containers. No public ports, no subdomains — all access flows through this control plane via SSH/Docker.