Bare Metal

This guide walks you through provisioning and connecting to a Targon Bare Metal server.

What is Bare Metal?

A Bare Metal server on Targon is an entire physical machine dedicated to your organization—no hypervisor, no container runtime, no noisy neighbors. You choose a hardware class and a region, Targon images the server with a managed OS, injects your SSH keys, and hands you direct SSH access to the whole machine.

Bare Metal is ideal when you need:

• Full control of the host: kernel, drivers, firmware-level GPU settings
• Maximum, uncontended GPU and CPU performance
• Long-lived capacity in a specific region, optionally backed by a reservation

Preview: Bare Metal is currently in limited availability. Capacity is region-scoped and may be out of stock. Contact Targon for reserved capacity.

Bare Metal vs Virtual Machines vs Rentals

	Bare Metal	Virtual Machine	Rental
Runtime	Dedicated physical server	Full VM (TVM)	Dedicated container
Images	Managed OS images	Pre-configured VM images	Docker images and templates
Region	Required at creation	Auto-placed	Auto-placed
SSH	ssh -p <port> <user>@<public_ip>	ssh -p <port> ubuntu@<public_ip>	ssh <rental-id>@ssh.deployments.targon.com
Sudo password	Not required	Required at creation	Not required
Volumes	Not supported	Not supported	Supported
Ports / env / commands	Not supported	Ports only	Supported
Reservations	Supported	Supported	Not supported

For container workloads with persistent storage, use Rentals. For confidential compute with hardware attestation, use Virtual Machines. For the whole box, use Bare Metal.

Before you begin

To get the most out of Bare Metal, you should be familiar with:

• The command-line terminal: Basic shell commands and navigation.
• SSH: At least one SSH key is required to create a Bare Metal server. Add one under your account settings first.
• Regions: Bare Metal capacity is tied to a region. List active regions before choosing a hardware class.

Choosing a region and hardware class

Bare Metal inventory is reported per region. Query the public inventory endpoint with type=bm:

curl -X GET "https://api.targon.com/tha/v3/inventory?type=bm&gpu=true"

Each entry includes a region object (uid, display_name, country, continent) and an available count for that region. Narrow to one region with region=<region-uid>:

curl -X GET "https://api.targon.com/tha/v3/inventory?type=bm&region=us-ord-1"

List all active regions:

curl -X GET https://api.targon.com/tha/v3/region

Pricing for Bare Metal may differ by region; the cost_per_hour shown in inventory is already region-specific.

Choosing an image

Bare Metal servers boot from a Targon-managed OS image. List images available to your organization:

curl -X GET https://api.targon.com/tha/v3/orgs/{org_slug}/workloads/bm-images \
  -H "Authorization: Bearer <YOUR_API_TOKEN>"

Each image returns name, display_name, and os_family. Pass name as the image field when creating the workload.

Creating a Bare Metal server

Bare Metal follows the same register-then-deploy flow as other workloads. Set type to BM, supply a region, and attach at least one SSH key.

1. Register the workload:

   curl -X POST https://api.targon.com/tha/v3/orgs/{org_slug}/workloads \
     -H "Authorization: Bearer <YOUR_API_TOKEN>" \
     -H "Content-Type: application/json" \
     -d '{
       "name": "my-bare-metal",
       "type": "BM",
       "image": "<bm-image-name>",
       "resource_name": "<hardware-class>",
       "region": "us-ord-1",
       "ssh_keys": ["shk-def456ghi789"],
       "bm_config": {
         "hostname": "gpu-node-01"
       }
     }'

   • region — required. Lowercase slug, max 32 characters, must be an active region.
   • resource_name — the hardware class shown in inventory for that region.
   • ssh_keys — required. At least one SSH key UID.
   • bm_config.hostname — optional. RFC 1123 hostname (lowercase letters, digits, hyphens, dots; max 63 characters). Defaults to the workload name.
   • reservation_uid — optional. Bind to an ACTIVE BM-plane reservation in the same region for the same hardware class.

   Container fields (envs, ports, commands, args, registry_auth, volumes, experiments) are rejected for BM workloads.

2. Deploy:

   curl -X POST https://api.targon.com/tha/v3/orgs/{org_slug}/workloads/{workload_uid}/deploy \
     -H "Authorization: Bearer <YOUR_API_TOKEN>"

   Targon checks credits and region inventory, then claims a physical server. Deploy is a single attempt: a 409 means no capacity matched the request in that region and nothing was claimed.

3. Wait for running: Poll GET /tha/v3/orgs/{org_slug}/workloads/{workload_uid}/state until status is running. Imaging a physical server takes longer than starting a container—expect several minutes.

Connecting to your Bare Metal server

Once the server is running, connect over SSH.

1. Fetch connection details: Read public_ip and ssh_port from the workload state:

   curl -X GET https://api.targon.com/tha/v3/orgs/{org_slug}/workloads/{workload_uid}/state \
     -H "Authorization: Bearer <YOUR_API_TOKEN>"

2. Open your terminal on your local machine.

3. Connect using the key you attached at creation:

   ssh -p <SSH_PORT> <USER>@<PUBLIC_IP>

   If your private key is not the default, add -i /path/to/your/key:

   ssh -i ~/.ssh/id_ed25519 -p <SSH_PORT> <USER>@<PUBLIC_IP>

The login user is determined by the image's os_family (for example ubuntu on Ubuntu images). The server's hostname is the bm_config.hostname you supplied, or the workload name if omitted.

Managing your Bare Metal server

• View state and events: GET .../workloads/{workload_uid}/state and GET .../workloads/{workload_uid}/events show provisioning progress and hardware status.
• Attach or detach SSH keys: PUT / DELETE .../workloads/{workload_uid}/ssh-keys/{ssh_key_uid}.
• Delete: DELETE .../workloads/{workload_uid} releases the server back to the pool and soft-deletes the workload. Data on the server's local disks is not preserved—copy anything you need off first. This action cannot be undone.

Suspend, reboot, exec, volumes, and port edits are not available for Bare Metal.

Reservations

Reserved Bare Metal capacity guarantees a specific machine for your organization over a contracted window. To deploy onto a reservation, pass its UID at creation:

curl -X POST https://api.targon.com/tha/v3/orgs/{org_slug}/workloads \
  -H "Authorization: Bearer <YOUR_API_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "reserved-node",
    "type": "BM",
    "image": "<bm-image-name>",
    "resource_name": "<hardware-class>",
    "region": "us-ord-1",
    "reservation_uid": "rsv-abc123def456",
    "ssh_keys": ["shk-def456ghi789"]
  }'

The reservation must be ACTIVE, on the BM plane, cover the current time, match resource_name, and be in the same region. One workload may occupy a reservation at a time; delete the existing workload before reusing it. Reserved capacity appears in GET /tha/v3/orgs/{org_slug}/inventory under the reserved field.

Related reading

• Workloads API for the full BM request and response schema
• Inventory API for region-scoped availability and the regions endpoint
• Virtual Machines guide for confidential GPU VMs
• Compute resources for tier selection