← Back to catalog
Pangolin + Newt · on a Docker VPS New release · v1.26

Expose your private services without opening your firewalls

🔒 VPS only

A sovereign alternative to Cloudflare Tunnel powered by Pangolin and Newt, to be installed and maintained by you. Your traffic flows through encrypted WireGuard tunnels on our French servers — never through a US proxy.

View compatible offers →FAQ
Hosted in FranceEncrypted WireGuard tunnelsZero open portsGDPR CompliantOfficial publisher image
Overview

What is Pangolin + Newt?

Pangolin is a reverse proxy tunnel and identity-aware tool that allows you to securely expose private services behind a NAT or firewall, without opening a single incoming port. Installed on a public IP entry point, it routes traffic through WireGuard encrypted tunnels running in user space, and relies on Traefik for reverse proxying, load balancing, health checks, and automatic Let's Encrypt certificates.

Its companion Newt is a lightweight agent installed on each remote server or site: it establishes an outgoing tunnel to Pangolin, making internal machines invisible from the outside while making them publishable. Together, they form a credible self-hosted alternative to Cloudflare Tunnel and Tailscale Funnel.

Pangolin includes an admin dashboard, user and role management, and access control per resource (PIN, password, SSO/OIDC, IP rules). Developed by Fossorial, the ecosystem is actively maintained and designed for professional self-hosting.

Compatible offers

Host Pangolin + Newt at DINAO

No managed container for Pangolin + Newt: this application is installed on a VPS hosted in France (1 vCPU / 1 Go / 10 Go minimum).

Pangolin + Newt needs a level of access to the machine that the managed container, shared between several customers, does not give. Two VPS hosted in France: DINAO installs and manages it for you, or you administer it yourself.

Technical reason: bind mount of a host path (named volumes only in the managed offer) + privileged capability (NET_ADMIN) + privileged capability (SYS_MODULE) + host/container namespace sharing (network_mode=service:gerbil).

Option 2 The simplest

Managed VPS with Docker and the application pre-installed

from €28,70 /month excl. VAT

  • Pangolin + Newt installed by DINAO when you order
  • The machine is yours alone: the privileged access Pangolin + Newt requires affects no other customer
  • System and Docker managed by DINAO, monitoring included
  • Priority support included (2-hour response time, DINAO business days and hours)
  • Stated, capped resources (2 vCPU, 2 GB, 20 GB): beyond that, a larger size is offered
  • Application updates on request
  • Backups as an option (€20,00 excl. VAT/month)
  • No administrator access to the machine

To use Pangolin + Newt without installing or administering anything.

Order →

Option 3 100% self-managed

VPS Docker

from €11,00 /month excl. VAT

  • Your virtual machine, full administrator access
  • Docker pre-installed, control panel of your choice
  • Free to install Pangolin + Newt or any other application, including those that drive Docker
  • Delivered empty: you install and maintain Pangolin + Newt yourself (or DINAO installs it on quotation)
  • No backup by default (optional: €20,00 excl. VAT/month)
  • No management service by default (optional from €55,00 excl. VAT/month); monitoring as an option

By default you keep full control; but without an additional service, you handle everything: maintenance, configuration, deployment.

Discover the VPS Docker →
CriterionManaged VPS with Docker and the application pre-installedVPS Docker
Who installs Pangolin + NewtDINAO, when you orderNobody by default: VPS delivered with Docker and, at your choice, Portainer / Dockge, without the application. You install it, or DINAO on quotation
Application updatesDINAO, on requestYou
System and DockerDINAO, without a control panel: one VPS, one applicationYou: no management service by default (optional: €55,00 or €75,00 excl. VAT/month, business days)
BackupsOptional: €20,00 excl. VAT/month for 7 days (100 GB quota)None by default; optional: €20,00 excl. VAT/month for 7 days (100 GB quota)
MonitoringIncludedOptional: from €1,00 to €10,00 excl. VAT/month
SupportPriority handling included (2-hour response time, DINAO business days and hours, no guaranteed resolution time)Best effort
IsolationA virtual machine of your own, for this application onlyA virtual machine of your own
ResourcesSized for the OS, Docker and Pangolin + Newt: 2 vCPU, 2 GB, 20 GB, stated as a cap; beyond that, a larger size is offeredRecommended size for Pangolin + Newt: 2 vCPU, 4 GB, 50 GB; can be extended
Administrator access (root)NoYes
Applications that require privileged access to the machineYes: the machine is yours aloneYes
Starting price€28,70 excl. VAT/month€11,00 excl. VAT/month (VPS only, without the application)

Options 2 and 3 sized for Pangolin + Newt (application requirements plus the system and Docker): 2 vCPU, 2 GB, 20 GB for option 2, 2 vCPU, 4 GB, 50 GB for option 3, whose base is larger.

Under the hood

Technical details

vCPU
1 vCPU
ideal : 2 vCPU
Memory
1 Go
ideal : 2 Go
Disk
10 Go
ideal : 20 Go
Image : fosrl/pangolin:latest Registry : docker.io Services : pangolin, gerbil, traefik, newt (client distant) Ports : 80, 443, 51820/udp, 21820/udp
Frequently asked questions

You might be wondering…

About Pangolin + Newt 6 questions

How is this different from Cloudflare Tunnel?

The principle is similar — exposing a private service without opening a port — but here the entry point is your DINAO instance in France. Your traffic does not pass through a US network, keeping you in control of the chain.

Do I need to open ports on my firewall?

No. The Newt agent installed on your servers establishes an outgoing tunnel to Pangolin. No incoming ports are exposed on your machines, even behind a NAT.

Where are the data hosted?

On DINAO infrastructure in France, in one of the available datacenters. The entry point and routing metadata do not leave the territory.

Do I need technical skills?

For everyday use, no : the VPS is not managed by DINAO. You install and maintain Pangolin and Newt on your VPS. Installing the Newt agent on your servers is simple and documented.

Can I connect multiple sites or servers?

Yes. Newt can be deployed on as many servers and remote sites as needed (depending on your tier), each establishing its own tunnel to Pangolin.

Is this application tested before it is offered?

This application has not yet passed our automatic deployment test. It can still be installed, but we invite you to contact us before ordering: we will then test it as a priority. The deployment template used was last updated on 3 July 2026. Each new version released by the publisher triggers this test again: the date above therefore follows the version actually offered.

Option 2Option 3 On a VPS 7 questions

One answer per option: the two VPS offers do not cover the same things.

Who installs Pangolin + Newt on a VPS?

Managed VPSDINAO, when you order

VPS DockerNobody by default: the VPS is delivered with Docker, without the application. You install it, or DINAO on quotation

Who updates Pangolin + Newt on a VPS?

Managed VPSDINAO, on request

VPS DockerYou

Is the VPS managed?

Managed VPSYes: DINAO manages the system and Docker, without a control panel (one VPS, one application). Monitoring is included

VPS DockerNot by default: you manage the system and Docker. The management service and monitoring can be added as options when ordering

Is my data backed up on a VPS?

Managed VPSAs an option: backup is added when ordering

VPS DockerNone by default; backup can be added as an option when ordering

Do I get administrator (root) access to the VPS?

Managed VPSNo

VPS DockerYes

Do you provide on-call support outside business hours on a VPS?

Managed VPSNo: monitoring is included, interventions take place on business days

VPS DockerNo: monitoring is an option, support is best effort

In which data centre is my service hosted?

In France, in DINAO's private racks within two third-party data centres: Free Pro in Marseille (MAR02) and Euclyde DC1 in Sophia-Antipolis. The operator provides the building, power, cooling and physical security; DINAO operates everything inside its racks, entirely and independently.