Core Compute & Identity
KVM & Bare-Metal GPUs
Standard instances use KVM hypervisors. Paperspace provides bare-metal GPUs, bypassing the hypervisor layer entirely and minimizing the attack surface by eliminating the host OS intermediary.
Zero Security Tax
DigitalOcean radically disrupted the market by completely eliminating the SSO security tax. Enterprise-grade Single Sign-On (SAML/OIDC) is included for all customers at no additional cost.
Under the Hood Architecture
Networking Limitations
Provides fundamental VPC isolation, but critically lacks native network visibility tools (no VPC Flow Logs). Engineers must manually deploy host-based agents like Zeek or Suricata.
Air-Gapped Lab Networks
Paperspace Pro/Enterprise tiers support fully private, air-gapped environments with static IP assignments and strict network isolation over 802.1q VLANs — ideal for detonating malware or fencing off a red-team range.
Real-World Attack Surface
Droplet Agent RCE
CVE-2026-24516 revealed a severe root-level remote code execution flaw in the Droplet Agent, allowing metadata spoofing to bypass validation checks and execute OS commands.
Metadata SSRF Exploits
Instances remain vulnerable to Server-Side Request Forgery (SSRF) attacks targeting the Instance Metadata Service if application-layer code is not strictly sanitized.
Mandatory Hardening Baseline
- Iptables Metadata Block: Immediately implement strict iptables firewall rules to restrict output traffic to the metadata service (169.254.169.254) exclusively to the root user.
- Deploy Network Sensors: Since DO lacks native flow logs, enterprise deployments must manually integrate Zeek or Suricata on routing droplets for forensic visibility.
Architecture Comparison
| Component | DigitalOcean | AWS |
|---|---|---|
| Isolation Architecture | KVM & Bare-Metal GPUs | Nitro System (Hardware) |
| Network Visibility | None natively (Deploy Zeek/Suricata) | VPC Flow Logs |
| Identity Security Tax | Zero (SAML/OIDC Free for all) | Moderate (AD costs) |
| GPU Cracking Nodes | Paperspace bare-metal (on-demand) | EC2 P5 / G6 instances |
