Running on VPS and Docker - No Fun at All
Running on VPS and Docker - No Fun at All
Every week someone posts their agent setup running on a VPS behind Nginx with Docker Compose, Cloudflare tunnels, and fail2ban rules. Port 8080 exposed. SSH key management. Certificate renewals. All to run a personal AI agent that controls their browser.
The question nobody asks is: why is this running on a remote server at all?
The Port Problem
When your agent runs on a VPS, it needs network access. That means exposed ports. Every exposed port is an attack surface. You end up spending more time on security hardening than on the actual agent workflows. Reverse proxies, rate limiting, authentication layers - none of this has anything to do with getting work done.
Docker adds another layer. Now you are debugging container networking, volume mounts for persistent state, and image builds that break when dependencies update. Your agent that is supposed to save you time is now a DevOps project.
Desktop Apps Have No Ports
A local desktop app runs on your machine. It talks to your screen, your keyboard, your file system. There is no port to expose. No SSH tunnel to maintain. No certificate to renew. The attack surface is your login password.
This is not a small difference. It is the difference between running a tool and maintaining infrastructure. A desktop agent does not need a Dockerfile. It does not need Nginx. It needs your Mac and five minutes to install.
The Real Cost
The real cost of the VPS approach is not the $20/month server bill. It is the weekend you spend debugging why your agent stopped responding because the Docker container ran out of memory at 3am. A local app crashes and you restart it. A remote server crashes and you are SSHing in from your phone.
If your agent needs to control your desktop, it should run on your desktop.
Fazm is an open source macOS AI agent. Open source on GitHub.