Core Compute & Identity
KVM & Bare-Metal GPUs
Standard droplets are plain KVM — no custom silicon, no proprietary offload, just a well-understood hypervisor that has been audited by everyone for a decade. Paperspace adds bare metal for GPU work, which removes the hypervisor from the picture entirely and is the right answer for detonating anything you would not want sharing a host. What you give up relative to Nitro or Google's VMM is the deep, purpose-built isolation engineering; what you get back is a stack whose failure modes are public knowledge.
Zero Security Tax
SAML and OIDC single sign-on are included at every tier rather than gated behind an enterprise plan. This deserves more credit than it gets: charging extra for SSO means small teams run shared credentials, and shared credentials are how small teams get breached. DigitalOcean simply does not do that. The honest caveat is that free SSO is not the same as a mature identity platform — the role model is coarse, and if you need fine-grained least privilege across dozens of engineers, this is the wrong cloud.
Under the Hood Architecture
Networking Limitations
VPC isolation works and there are no flow logs. That is the single most important sentence on this page for anyone planning to respond to an incident here: when something goes wrong, there is no platform record of what talked to what, and no way to obtain one retroactively. You bring your own visibility — Zeek or Suricata on a routing droplet, decided before you need it, because after the fact is too late.
Air-Gapped Lab Networks
Paperspace's higher tiers support genuinely private environments — static addressing, VLAN-level isolation, no shared path out — which makes them usable for malware detonation or a fenced-off range. Verify the isolation yourself before you trust it with a live sample; a configuration that is private in the console and reachable in practice is the failure that matters, and it does not announce itself.
Real-World Attack Surface
The Droplet Agent Is Root
The agent that powers browser console access runs as root and trusts what the platform tells it. That is an acceptable design and it is also a component you did not choose, running with full privilege, on every droplet by default. If you do not use the web console, remove it — the surface you delete is the surface that cannot be exploited, and the feature you lose is one you were not using.
Metadata SSRF Exploits
The metadata service at 169.254.169.254 is unauthenticated and answers any process on the droplet, including a web application tricked into fetching a URL. There is no IMDSv2 equivalent here to fall back on — AWS's session-token defence has no counterpart, so the only control is refusing the request at the host. Anything you put in droplet user-data is readable by that same path, which is why cloud-init scripts are a bad place for secrets.
Mandatory Hardening Baseline
- Block Metadata Egress: an
iptablesowner-match rule limiting traffic to169.254.169.254to root is the practical substitute for IMDSv2. Test it after every image rebuild — the rule lives outside your application, nothing references it, and a droplet rebuilt from a base image comes back without it and behaves entirely normally. - Deploy Network Sensors: with no flow logs, a Zeek or Suricata droplet in the routing path is the only network evidence you will ever have. Budget a droplet, the storage and the tuning time, and stand it up on day one rather than during the incident.
Architecture Comparison
| Component | DigitalOcean | AWS |
|---|---|---|
| Isolation Architecture | KVM & Bare-Metal GPUs | Nitro System (Hardware) |
| Network Visibility | None natively (Deploy Zeek/Suricata) | VPC Flow Logs |
| Identity Security Tax | Zero (SAML/OIDC Free for all) | Moderate (AD costs) |
| GPU Cracking Nodes | Paperspace bare-metal (on-demand) | EC2 P5 / G6 instances |
