To keep an AI agent running while your laptop is off, deploy it to a Linux VPS, run it under a dedicated non-root account, keep credentials and state in protected persistent storage, and manage the process with systemd or Docker Compose. Enable automatic restart and boot startup, expose only the ports you need, and monitor both the VPS and the upstream model API.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Agents that call a hosted model generally need modest server resources because inference happens at the API provider. An agent running a local model is a different workload: CPU, memory, disk and possibly GPU requirements can be much higher.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
What a 24/7 VPS deployment actually does
A VPS is an always-on Linux computer in a data centre. Your agent process, its scheduler or queue, tool integrations and stored memory run there instead of on a desktop that may sleep, lose power or disconnect from the internet. You administer the machine over SSH and pay separately for the server, model API calls, storage, backups, domains and monitoring.
A reliable deployment has several layers:
- Runtime: Python, Node.js, Go or another environment, plus the agent and pinned dependencies.
- Process supervision: systemd for one worker, or Docker Compose when several services belong together.
- Persistent state: explicit directories or Docker volumes for databases, queues, memory and generated files.
- Network edge: a firewall and, for public HTTP or webhook traffic, a reverse proxy such as Caddy, nginx or Traefik with TLS.
- Operations: logs, health checks, resource alerts, backups and a tested recovery procedure.
If the agent only runs a periodic batch, a scheduled job may be enough. Cron plus a script is not a replacement for a persistent chat service, webhook receiver or queue worker: it does not keep a process continuously connected or provide the same restart and dependency controls.
#1 Best Overall
Choose the hosting model before installing anything
| Option | Best fit | Important behavior | Trade-offs |
|---|---|---|---|
| systemd on a VPS | One Python, Node or Go worker | Starts at boot, restarts failures and integrates with Linux logs | Simple and efficient, but you manage the host and every dependency |
| Docker Compose on a VPS | An agent plus a database, queue, browser or dashboard | Coordinates multiple containers and restart policies; data needs explicit volumes | Cleaner isolation and repeatability, with more container and secret-management work |
| Cron and a script | Periodic checks or finite batch jobs | Runs on a schedule rather than maintaining a resident worker | Unsuitable for always-connected chat, webhook or queue workloads |
| Managed service | Business-critical workflows where support and handoff outweigh host control | Provider controls deployment and recovery; some products scale to zero | Confirm that the service remains continuously available, and review its limits, observability and pricing |
For a small long-running agent, systemd is usually the simplest reliable process manager, according to Hassan Tahir in the VoxFor guide (last edited July 10, 2026). Docker Compose becomes more attractive when the deployment is a small application rather than a single process.
Size the VPS without treating examples as universal rules
First determine where inference occurs. With a hosted-model agent, the VPS mainly handles orchestration, tool calls, network connections, logs and state. With a local model, the model weights and inference workload become the dominant sizing factors and may require a GPU.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems| Reference | Published capacity | How to interpret it |
|---|---|---|
| Moltis documentation (2026) | At least 1 GB RAM and 10 GB disk for its example VPS deployment | An application-specific minimum, not a general AI-agent standard |
| SIS Argentina guide (2026) | 2 vCPU and 2 GB RAM for one agent | A provider-specific sizing example, not a universal requirement |
Use those figures as starting reference points, then measure your own workload. A browser automation tool, local embedding index, large conversation history, database, queue or several concurrent jobs can need more memory and disk than a simple API orchestrator. Leave disk headroom for logs, updates and temporary files; a full filesystem can stop both the agent and the operating system.
Questions to answer before ordering
- How many jobs or conversations can run at the same time?
- Will a browser, headless desktop, database, vector index or queue run on the same machine?
- Does the agent download files or generate media that must be retained?
- Is a local model required for latency, privacy or offline operation?
- Where should the VPS be located for latency and data-residency requirements?
- What uptime, support and recovery time does the workflow require?
Prepare the VPS securely
- Select a Linux region and plan. Choose a provider and region appropriate for latency, data residency and provider reliability. Keep the VPS charge separate from model API, backup, storage, domain and monitoring costs. Promotional prices and renewals change, so verify the current recurring price before committing.
- Connect over SSH and update the system. Use the provider’s current Linux image, apply security updates, and install only the packages the agent needs.
- Create a service account. Make a dedicated user with no routine root privileges. Give it ownership of the application directory and only the data directories it must write.
- Restrict administration. Prefer key-based SSH, limit administrative access with a firewall, and allow inbound ports only for SSH from trusted networks and the public services you intentionally publish.
- Create explicit directories. Separate application code, environment files, logs and persistent state. A predictable layout makes backups and rollback safer.
- Install and pin the runtime. Install Python, Node.js or Go and the agent’s system libraries. Pin dependency versions where reproducibility matters; record the runtime and agent version used for each deployment.
Keep API keys and state out of fragile places
Never commit provider keys to Git, embed them in source code or print them in logs. Put them in an environment file readable only by the service account, or use a secret store supplied by your infrastructure.
sudo install -d -m 750 /etc/myagent
sudo install -m 640 -o root -g myagent /dev/null /etc/myagent/agent.env
Populate the file with the variables your agent expects, for example MODEL_API_KEY, endpoint settings and database credentials. The exact names depend on the agent. Keep the file out of the application repository and rotate or revoke credentials if exposure is suspected.
State must be deliberate. Store conversation memory, queue data, databases and generated files in a persistent directory such as /var/lib/myagent, or in named Docker volumes. Do not assume a container’s writable layer, a temporary directory or an ephemeral disk survives replacement. Decide which data is disposable, which must be backed up, and how long it should be retained.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Run one agent with systemd
systemd is a good default for a single long-running worker. The following pattern assumes the service account is myagent, the application is in /opt/myagent, and the executable starts a worker. Replace paths and arguments with those for your project.
- Create the account and application directories, then install the code and dependencies as that account.
- Create
/etc/systemd/system/myagent.servicewith a unit similar to this:
[Unit]
Description=AI agent worker
Wants=network-online.target
After=network-online.target
[Service]
Type=simple
User=myagent
Group=myagent
WorkingDirectory=/opt/myagent
EnvironmentFile=/etc/myagent/agent.env
ExecStart=/opt/myagent/.venv/bin/python -m myagent
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
[Install]
WantedBy=multi-user.target
- Reload units, enable boot startup and start the service:
sudo systemctl daemon-reload
sudo systemctl enable --now myagent.service
- Check the result and follow logs:
sudo systemctl status myagent.service
sudo journalctl -u myagent.service -f
Restart=on-failure recovers from crashes, while enable registers the service for boot. It does not fix an application that starts successfully but is unusable, so add an application-level health check and alerting as well. If the process exits repeatedly because of a bad configuration, inspect the journal before increasing restart delays or changing the command.
Dependencies and graceful shutdown
Use After=network-online.target when the worker needs a network connection at startup, but remember that a target is not proof that a particular API is healthy. If the agent depends on a local database or queue, express that relationship with the appropriate systemd units or run the cooperating services under Compose. Configure the application to stop accepting new work and finish or requeue active jobs on SIGTERM so a reboot does not lose tasks.
Use Docker Compose for a multi-service agent
Compose is appropriate when the agent, database, queue, browser and dashboard need coordinated lifecycle management. Keep configuration in an environment file or secret mechanism, and mount only the directories that must persist.
services:
agent:
image: registry.example/agent:1.4.2
restart: unless-stopped
env_file:
- ./agent.env
volumes:
- agent_state:/var/lib/agent
depends_on:
- database
database:
image: postgres:16
restart: unless-stopped
environment:
POSTGRES_DB: agent
POSTGRES_USER: agent
POSTGRES_PASSWORD: change-this-in-a-secret-store
volumes:
- database_data:/var/lib/postgresql/data
volumes:
agent_state:
database_data:
Pin image tags rather than silently tracking an unbounded latest tag. A named volume preserves data across container replacement, but it is not an off-machine backup. Back up the database and state to storage outside the VPS, test restoration, and protect the backup credentials. Compose’s depends_on controls startup order; add health checks and application retries when readiness matters.
Publish webhooks or dashboards safely
Do not expose an agent’s development port directly to the internet. Put Caddy, nginx or Traefik at the edge when you need a domain, TLS termination, routing or WebSocket upgrades. The proxy should forward only to the internal service, while the firewall leaves the application port closed to the public network.
- Obtain a domain and configure its DNS to the VPS address.
- Terminate HTTPS at the reverse proxy and renew certificates automatically.
- Require authentication for dashboards and administrative endpoints.
- Validate webhook signatures, timestamps and replay protection when the sender supports them.
- Set request size, timeout and rate limits appropriate to the workload.
- Keep health endpoints free of secrets, prompts and private customer data.
WebSocket or streaming clients need proxy settings that preserve the upgrade request and sufficiently long idle timeouts. If the agent has no public endpoint, avoid opening HTTP ports at all and use outbound connections or a private network path.
Build monitoring, logging and backups before calling it 24/7
Uptime alone does not prove that an agent is working. Monitor process health and the dependencies that can silently fail.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Service: running state, restart count and health-check result.
- Resources: CPU, memory, disk usage, inode usage and, for local inference, accelerator utilization.
- Work: queue depth, oldest job age, successful and failed jobs, and stuck conversations.
- External APIs: latency, rate-limit responses, authentication failures and error rates.
- Security: failed SSH logins, unexpected listening ports and certificate expiry.
- Logs: structured events with rotation and retention so logs cannot fill the disk.
Redact full prompts, access tokens, private customer data and tool outputs that contain secrets. Record a request or job identifier, status and timing instead, so failures can be investigated without creating a second data-leak channel.
Back up important state somewhere other than the same VPS. For a database, use consistent database-aware backups; for file-based memory, quiesce or snapshot it according to the application’s instructions. Document the restore command, required credentials and acceptable recovery point. A backup that has never been restored is an assumption, not a recovery plan.
Test reboot and failure recovery deliberately
- Record the expected service name, ports, data directories, image or code version and rollback command.
- Confirm the agent is processing a harmless test job and that its state is visible in the persistent store.
- Reboot during a maintenance window:
sudo reboot. - After reconnecting, check
systemctl statusordocker compose ps, inspect logs, and verify that the test state remains. - Stop the process or inject a controlled failure, then confirm the restart policy brings it back without creating duplicate work.
- Simulate an upstream API error and a full or nearly full disk in a safe environment. Verify that alerts fire and that retries use bounded backoff.
- Practice revoking a test credential and rolling back to the last known-good application version.
This is an operational check you perform on your deployment, not a guarantee that any particular agent or provider has been tested by the sources cited here.
Recommended Free Tools
Security boundaries for agents that can take actions
An agent that can execute commands, send messages, alter files or call production APIs needs narrower permissions than a read-only chatbot.
- Run it as a least-privilege user and do not grant unrestricted root or host-wide credentials.
- Allow only the tools, directories, network destinations and API scopes required for its job.
- Require human approval for destructive, financial, publishing or production-changing actions.
- Separate development, staging and production credentials and endpoints.
- Define a rollback path before enabling autonomous changes.
- Rotate credentials and maintain a revocation procedure that does not depend on the agent itself.
Containerization reduces accidental interference but is not a complete security boundary. The host kernel, mounted volumes, Docker socket, credentials and network policy still determine what a compromised process can reach.
Estimate the total recurring cost
The VPS invoice is only one line item. Budget for:
- VPS compute and included or metered bandwidth
- Model API usage, which can vary with token volume, tool calls and concurrency
- Block storage, snapshots and off-site backups
- Domain registration and certificate-related services if applicable
- Monitoring, log retention and alert delivery
- Optional managed databases, queues or container platforms
Compare hosting choices using always-on behavior (including scale-to-zero defaults), single-process versus multi-service support, persistence and backups, secret handling, restart controls, TLS and network exposure, observability, geographic latency and data residency, operator effort, and the combined recurring cost including model usage. A cheap plan that sleeps, drops storage or lacks recovery controls may cost less on paper while failing the 24/7 requirement.
Troubleshoot the failures you are most likely to see
The agent stops when you close your laptop
The process is still running on the laptop rather than the VPS. SSH into the VPS and verify the service there. For systemd, check systemctl is-enabled myagent.service and systemctl status myagent.service; for Compose, check docker compose ps.
It did not restart after a reboot
For systemd, confirm the unit is enabled, the command path exists and the service account can read its environment file and state directory. For Compose, confirm the Docker service starts at boot and the containers have a restart policy. Read the boot-time logs rather than assuming the process failed for the same reason as an interactive launch.
It restarts continuously
Inspect the last journal or container logs for missing variables, dependency errors, permission failures or an invalid working directory. Run the exact command as the service account in a controlled shell. Fix the underlying error; a longer restart delay only reduces noise.
Memory or disk usage keeps growing
Check whether conversation history, browser sessions, queues or logs have unbounded retention. Set application limits, rotate logs, remove disposable artifacts and increase the plan only after identifying what is consuming resources. If using a local model, include model weights and cache directories in the accounting.
Webhooks time out or duplicate work
Verify DNS, TLS, proxy timeout and firewall rules. Return a prompt acknowledgement where the sender expects one, enqueue work idempotently, and use an event identifier to deduplicate retries. Inspect both proxy access logs and the agent’s application logs.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCalls to the model API fail intermittently
Check outbound connectivity, DNS, API authentication, provider status, rate limits and clock accuracy. Use bounded exponential backoff with jitter, classify permanent errors separately from transient ones, and alert when the queue or oldest job age crosses a useful threshold.
Quick Recap
A practical go-live checklist
- Linux VPS region, plan and renewal cost selected
- Non-root service account created
- SSH keys and firewall rules restricted
- Runtime and dependency versions recorded
- Secrets stored outside source code with restrictive permissions
- State and generated files mapped to persistent storage
- systemd unit or Compose restart policy enabled at boot
- Public endpoints protected by TLS and authentication
- Logs rotated and sensitive content redacted
- CPU, memory, disk, queue and API alerts configured
- Off-machine backups completed and restoration practiced
- Reboot, crash, API-error and credential-revocation tests passed
- Rollback and emergency shutdown instructions documented
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
