Zero VPNs • Zero SSH Key Management • Zero Inbound Firewall Ports

Instant Multi-Tenant Linux Sandboxes
Provisioned via Email

r3e turns any Linux server behind NAT into a secure, multi-tenant sandbox platform. Grant isolated container access to dozens of users with zero client onboarding—users simply send an email to execute commands in their personal sandboxed environment.

Compare vs SSH & K8s
✓ Zero Client Setup (Email Native)
✓ Automatic Per-Email Docker Containers
✓ Outbound TLS Only (NAT Traversal)
✓ Automatic 48h Container Reaping
✓ Resource Quotas (CPU / RAM / Disk)
Comparison

Traditional Multi-Tenancy vs. R3e

Why set up heavy Kubernetes clusters, OAuth portals, and SSH Bastion hosts when you can manage multi-tenant access with a single config file?

Traditional Multi-Tenancy

SSH / VPN / Kubernetes / Web Portals
  • ✕
    Heavy Client Onboarding: Requires distributing SSH keys, VPN client software, and user credentials.
  • ✕
    Inbound Attack Surface: Requires open SSH ports (22), reverse proxies, Bastion hosts, or public IPs.
  • ✕
    Complex IAM & Setup: Needs LDAP, OAuth2/OIDC portals, or complex Kubernetes namespace RBAC policies.
  • ✕
    High Infrastructure Overhead: Running control planes, ingress controllers, and identity services consumes significant RAM and maintenance time.

R3e Email Sandboxing

Zero-Infrastructure Multi-Tenant Engine
  • ✓
    Zero Client Software: Users onboard by simply receiving permission via email. Works on phones, laptops, or webmail.
  • ✓
    100% NAT Safe (Outbound Only): Polls email server via TLS. Zero inbound ports open; works behind strict corporate firewalls.
  • ✓
    1-Line Whitelist Onboarding: Add tenant emails to `user_whitelist` in `config.toml`. Identity is verified via email server transport.
  • ✓
    Automatic Dynamic Container Lifecycle: Dedicated isolated Docker container created per email sender with auto-reaping after 48h idle.
Security Architecture

Built-In Multi-Tenant Isolation

How r3e guarantees complete security separation between different email senders on the same underlying host server.

Per-Email Container Allocation

Every whitelisted email sender (`user1@org`, `user2@org`) gets a dedicated, isolated Docker container mapped to their email identity in state.json.

Hardened Security Profile

Containers execute with stripped Linux capabilities (--cap-drop=ALL), process caps (--pids-limit 20), and bridge network isolation.

Automated 48h Garbage Collection

Containers inactive for more than 48 hours are automatically destroyed and reaped, preventing disk bloat while allowing temporary state preservation during active work sessions.

Deployment

Deploy Multi-Tenant Engine in 3 Minutes

Run r3e as a background service on any Linux server to start receiving and executing tenant commands.

# 1. Download precompiled release binary curl -L https://r3e.dev/r3e -o r3e # 2. Make executable & copy to local PATH chmod +x r3e sudo cp r3e /usr/local/bin/ # 3. Verify installation r3e --help
# Save as ~/.config/r3e/config.toml email_or_t3e_account = "multitenant-daemon" admin_host_whitelist = ["sysadmin@infra.net"] user_whitelist = [ "alice@lab.org", "bob@dev.com", "student1@univ.edu" ] poll_interval_secs = 10 docker_image = "ubuntu:24.04" docker_memory_limit = "512m"
# Save to ~/.config/systemd/user/r3e.service [Unit] Description=r3e Multi-Tenant Sandbox Daemon After=network.target [Service] ExecStart=/usr/local/bin/r3e Restart=always RestartSec=10 [Install] WantedBy=default.target
# From any whitelisted tenant email client: To: multitenant-daemon@company.com Subject: r3e# echo "Hello Sandbox" > ~/test.txt Body: Blank (ignored) # Reply received within seconds: [r3e] Executed on r3e-sandbox-alice (ubuntu:24.04) Exit Code: 0 Output: (Empty)