Forty-One Days of Grace: The Sudden Death Timeline of InstaBox Free Five, and the Lesson That Pause Is Not Freeze

Compute that falls from the sky usually has a shelf life, and this time the expiry date was in black and white.

I. It Started with a linux.do Thread

The starting point was a linux.do thread: InstaBox Tool, a one-click management script for instabox.sh free 4C8G machines — official-API keepalive plus a one-shot VLESS node. The scraping itself had drama: the JSON endpoint returned 403, the Discourse print view threw up a Cloudflare check first and released all 27 floors after a few seconds. The page tail even embeds an anti-AI notice — “AI-generated content forbidden, violators banned” — the site’s own rule, and none of its instructions were executed.

The thread was dense: keepalive calls an activity-lease endpoint from the official docs; someone running five machines “pedaling” for each other got their account taken; a non-keepalive machine suspends after roughly 30 idle minutes (resumable at any time).

The owner’s question followed: he had just got an invite code, opened five machines — should he keep them alive around the clock?

II. Trust the Script Not to Do Evil, Not to Keep Working

The script repository’s setup.sh, cloud.py and heartbeat.py were all read. The engineering is surprisingly decent (about 7/10): the installer refuses root, installs into the user directory, touches no system paths; it resolves the commit SHA first, verifies each file against SHA256SUMS, syntax-checks, and sets 700 permissions; the API key is stored 0600, symlink-refusing, owner-checked, with keys masked in logs; the HTTP client disables redirects and proxies, with no telemetry or exfiltration found.

The deductions are just clear: five commits, two stars, version 0.0.1, single maintainer, AI-generated — the hash manifest shares a source with the code, so it protects against transfer tampering, not against the author.

Four reliability hard faults: keepalive only covers machines that are “already on” — after a suspend the script will not auto-start them; the scheduler depends on a systemd user timer plus loginctl enable-linger, so if linger fails, exiting SSH stops the keepalive (installing via the web terminal and closing the browser is the easiest trap); nodes ride Cloudflare Quick Tunnels, so the domain changes on every machine restart, and there is no SLA; and any break in the chain is just “try next round,” with no compensation.

The biggest problem is policy risk: keepalive is by nature scheduled fake activity, fighting the platform’s idle-reclaim policy. An endpoint existing does not mean this use is allowed; one key doing a PUT every five minutes is a highly recognizable pattern. The thread already has a banned-account precedent.

III. The Official Knob and the Undocumented Hole

When the owner asked whether to keep all five alive, the official docs turned up a fact more decisive than the thread: the platform itself ships a proper “never suspend” switch — the CLI has instabox auto-suspend <id> 0, and the API’s machine object has autoSuspendAfterSeconds set to null. The third-party script’s activity-lease endpoint, meanwhile, appears nowhere in the public API reference or CLI docs — at minimum it is not publicly documented.

The risk tiers are therefore different: one is an official knob, the other a hole outside the docs. For residency, prefer the former.

The reasons “always-on keepalive” is unnecessary also stack up: pause preserves memory and processes (the official line is “step away and come back to the same session”); commands, file reads and writes, SSH, and public-port access all auto-resume without a manual boot; nothing is billed while paused, and the machine keeps its quota slot. Keepalive only matters for things that must be online 24 hours — nodes, webhooks, resident services. If you just want to keep the environment and files, let it pause; that is the designed workflow.

The five-machine all-alive bill: the official price for 4 vCPU / 8 GiB is about $24.82 per machine-month, so five machines at 24/7 is about $124 a month. A free account running that shape is the most textbook risk-control signature.

IV. The Sudden-Death Timeline: 41 Days Left

“Estimate how long until they cut the free five?” — searching everything the company (InsForge AI) said publicly, the answer was more direct than any estimate: the free five were not “going to be cut someday” — they were cut on October 20; legacy accounts keep theirs until December 1, 2026. Being able to open five today means sitting in the “legacy grace period” — 41 days left.

The official timeline is all public text: October 14, InstaBox launches invite-only; October 19, the CEO publishes the pricing blog announcing Free/Pro/Team/Enterprise; October 20, the Changelog takes effect — new accounts get one 4C8G machine free; December 1, legacy accounts’ five free machines expire.

Why cut so fast (day six)? The official reason was not cost — it was abuse: bots and scripts signing up hundreds of accounts to do things that violate the terms, like crypto mining — a node runs out of capacity, OOMs, and goes down, taking everyone else’s machines on that node down too. Two more numbers: 75 percent of beta users ran one active machine, so cutting to one hurts most people not at all; and they run self-built bare metal, with a hard capacity ceiling. Commercially, cutting the five had almost no resistance.

The forecast for what comes next: in one to three months, stronger signup and abuse controls (stricter invites, device/IP/payment verification; activity-lease-style endpoints may tighten or go paid-only); in three to six months, a pricing v2 (the CEO’s words: “this is just v1 of our pricing. We’ll keep adjusting it”); in six to twelve months, the free tier growing back to two or three machines is low-probability — a return to “five 4C8G machines, run them however” is basically impossible. What triggers the next shift is not a calendar but an event: node crashes, mining abuse, funding rhythm. This company shipped pricing, a changelog and Workspaces within a week of launch; decisions run in days.

Two more points worth noting: the company itself will not fold soon — InsForge AI is YC P26, announced an $8M seed round in late September 2026, and its open-source flagship has 13k stars; but its business model is built on “self-built bare metal + idle pause + oversubscription,” naturally sensitive to 24/7 occupancy. And Pro’s twenty dollars is the allowance and concurrency count, not five machines fully running 24/7 — at the official rate, five machines at full load still costs about $104 a month beyond the credit.

V. “Register More and Bridge Them with Tailscale” and the True Shape of Pause

The owner’s last question — free is one machine after December? Still a 30-minute freeze? What is that even good for? Or should I register more and bridge them with Tailscale? — the first half needed a correction: pause is not freeze. The official pause is a microVM suspension: memory and processes are kept, resume is under a second, files in /data stay put; commands, file reads and writes, SSH, and public-port access all auto-wake; only true 30-minute idleness pauses it, never while in use.

And “register more accounts” needed the terms checked before endorsement — that check had not finished, but the directional judgment already stands: bulk registration is precisely the abuse shape this company names as the reason for the cut. An account fresh off an invite code has no business being the next risk-control sample.

The advice finally condensed into five lines: treat December 1 as the hard deadline, and finish shaping the one machine that truly matters (code into git, environment into snapshots, important files backed up externally); treat the other four as disposable compute, let them pause after use; do not keep all five alive (lifecycle control is now a paid feature, and the vendor has publicly said scripts crushing nodes were the reason); if five concurrent machines are truly needed after 12/1, the $20/month Pro is the official path; and watch the changelog closely — they ship constantly, and policy changes land there first.

One sentence to close: treat it as “temporary compute that will pause and tighten at any moment,” not “five free permanent VPS.” Used the first way, it is delightful; used the second, you likely lose both the person and the money.