Google Cloud Free VPS and Hosting Server Setup Guide

You can build a free VPS or free hosting server with Google Cloud Free Tier, but Google limits free usage through a narrow combination of region, machine type, disk, networking, and traffic rules. This guide prepares an e2-micro Debian 13 server from scratch without a paid public IPv4 address, connects through external IPv6 and Google IAP SSH, installs Docker and Docker Compose, and enables VS Code Remote SSH access.

Important: Do not skip steps or casually replace settings that appear similar. The Free Tier region, e2-micro machine, pd-standard disk, absence of a public IPv4 address, and disabled billable add-ons are especially important. Google Cloud offers and prices can change, so confirm the current Free Tier terms before starting and monitor Billing reports after deployment.

The target setup uses an e2-micro VM covered by Google Cloud Free Tier, avoids public IPv4, uses external IPv6, routes SSH through Google IAP, installs Docker with Docker Compose, and leaves the free server ready for publishing an application through Cloudflare Tunnel later.

1. Create an IPv6-enabled custom VPC

Create an IPv6-capable custom VPC instead of using the default VPC. In Google Cloud Console, follow:

VPC Network
→ VPC networks
→ Create VPC network

Name: shserv-vpc
MTU: 1460
Subnet creation mode: Custom
Private IPv6 ULA: Off

New subnet settings

Name: shserv-us-central1
Region: us-central1 (Iowa)
IP stack type: IPv4 and IPv6 (dual-stack)
Primary IPv4 range: 10.10.0.0/24
IPv6 access type: External
Private Google Access: Off
Flow logs: Off
Hybrid Subnets: Off

Leave Allow IPv6 custom, Allow IPv6 ICMP, Allow IPv6 RDP, and Allow IPv6 SSH set to OFF in the firewall section. Select Regional for Dynamic routing mode and Legacy for Best path selection, then choose Create.

2. Configure the basic VM settings

Compute Engine
→ VM instances
→ Create instance

Name: shserv-test
Region: us-central1 (Iowa)
Zone: us-central1-a
Series: E2
Machine type: e2-micro
Provisioning model: Standard

The interface may show a list price of roughly $6.11/month. The Free Tier discount may not appear in the estimate on the Create page; verify the actual result later under Billing → Reports.

3. Choose the operating system and disk

OS and storage
→ Change

Operating system: Debian
Version: Debian GNU/Linux 13 (trixie)
Boot disk type: Standard persistent disk
Size: 30 GB
Deletion rule: Delete boot disk
Encryption: Google-managed encryption key

Critical: Do not choose Balanced persistent disk. Use Standard persistent disk for this Free Tier configuration.

4. Disable Data Protection backups

Under Data protection, set Snapshot schedule to None / No backups. Do not create automatic snapshots.

5. Configure the VM network interface

Return to the VM creation page and edit the network interface:

Networking
→ Network interfaces
→ Edit network interface

Network: shserv-vpc
Subnetwork: shserv-us-central1
IP stack type: IPv4 and IPv6 (dual-stack)
Primary internal IPv4: Ephemeral (Automatic)
External IPv4: None
External IPv6: Ephemeral (Automatic)
HTTP traffic: OFF
HTTPS traffic: OFF
Load Balancer Health Checks: OFF
IP forwarding: OFF

It is normal for Network Service Tier to disappear after you set External IPv4 to None. This is not a problem while external IPv6 remains enabled.

6. Disable Observability extras

Install Ops Agent for Monitoring and Logging: OFF
Enable display device: OFF

7. Complete the security settings

Service account: No service account
Managed workload identity: OFF
Confidential VM: OFF
Secure Boot: ON
vTPM: ON
Integrity Monitoring: ON

Leave VM access at its defaults and do not add a manual SSH key.

8. Review Advanced settings and create the VM

Deletion protection: OFF
Reservations: Don't use a reservation
Startup script: Empty
Metadata: Empty
Data encryption: Google-managed encryption key
Cloud KMS: Do not use

After the final review, select Create to provision the VM.

9. Create the SSH firewall rule for IAP

Because the VM has no public IPv4 address, SSH access will travel through Google IAP:

VPC Network
→ Firewall
→ Create firewall rule

Name: allow-iap-ssh
Logs: Off
Network: shserv-vpc
Priority: 1000
Direction: Ingress
Action: Allow
Targets: All instances in the network
Source filter: IPv4 ranges
Source IPv4 ranges: 35.235.240.0/20
Second source filter: None
Destination filter: None
Protocols and ports: Specified protocols and ports
TCP: 22

Select Create to save the rule.

10. Test SSH in the browser

Compute Engine
→ VM instances
→ shserv-test
→ SSH

Run these checks after the terminal opens:

whoami
hostname
free -h
df -h

You should see approximately 964 MiB of RAM and a roughly 30 GB /dev/sda1 disk.

11. Test IPv6 internet access

Check the external IPv6 address, Cloudflare connectivity, and the global IPv6 interface:

curl -6 https://ifconfig.co
curl -6 -I https://cloudflare.com
ip -6 addr show scope global

The first command should return an IPv6 address similar to 2600:....

12. Create 2 GB of swap

An e2-micro VM provides only about 1 GB of RAM, so add 2 GB of swap:

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

Keep it active after a restart:

echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

Verify it:

free -h

Expected values are approximately Mem: 964 MiB and Swap: 2.0 GiB.

13. Install Docker and Docker Compose

Update the system and install the prerequisites:

sudo apt update
sudo apt upgrade -y
sudo apt install -y ca-certificates curl

Prepare the Docker keyring:

sudo install -m 0755 -d /etc/apt/keyrings

sudo curl -fsSL https://download.docker.com/linux/debian/gpg \
  -o /etc/apt/keyrings/docker.asc

sudo chmod a+r /etc/apt/keyrings/docker.asc

Add the Docker repository:

sudo tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/debian
Suites: trixie
Components: stable
Architectures: amd64
Signed-By: /etc/apt/keyrings/docker.asc
EOF

Refresh the repository list and install Docker with the Compose plugin:

sudo apt update

sudo apt install -y \
  docker-ce \
  docker-ce-cli \
  containerd.io \
  docker-buildx-plugin \
  docker-compose-plugin

Add your user to the docker group, leave the SSH session, and reconnect:

sudo usermod -aG docker $USER
exit

14. Test Docker

docker --version
docker compose version
docker run --rm hello-world

If you see Hello from Docker!, the Docker installation is complete.

15. Install Google Cloud CLI on Windows

Use PowerShell to download and launch the installer:

(New-Object Net.WebClient).DownloadFile("https://dl.google.com/dl/cloudsdk/channels/rapid/GoogleCloudSDKInstaller.exe", "$env:Temp\GoogleCloudSDKInstaller.exe")
& "$env:Temp\GoogleCloudSDKInstaller.exe"

Open a new PowerShell window after installation, then verify the version, login, and selected project:

gcloud --version
gcloud auth list
gcloud config set project shserv-test
gcloud config list

16. Connect through IAP SSH from Windows

Start the first connection with:

gcloud compute ssh shserv-test --zone=us-central1-a --tunnel-through-iap

Google may create an SSH key on first use. After connecting, identify and note the user name, then exit:

whoami
exit

An example user name is serda.

17. Check Windows OpenSSH and generated keys

In PowerShell, inspect OpenSSH and the keys created by Google:

ssh -V
Get-ChildItem $env:USERPROFILE\.ssh

You should see an OpenSSH_for_Windows-style version string and the files google_compute_engine, google_compute_engine.pub, and google_compute_engine.ppk.

18. Configure the Windows SSH config file

Edit this file:

C:\Users\<WINDOWS_USER>\.ssh\config

Inspect any existing configuration first and do not delete its current entries:

Get-Content $env:USERPROFILE\.ssh\config

Add the following block and replace User with the account returned by whoami:

Host shserv-test
    HostName shserv-test
    User <USER_FOUND_WITH_WHOAMI>
    IdentityFile ~/.ssh/google_compute_engine
    ProxyCommand gcloud.cmd compute start-iap-tunnel %h %p --listen-on-stdin --project=shserv-test --zone=us-central1-a --verbosity=warning

If the user name is serda, the complete example is:

Host shserv-test
    HostName shserv-test
    User serda
    IdentityFile ~/.ssh/google_compute_engine
    ProxyCommand gcloud.cmd compute start-iap-tunnel %h %p --listen-on-stdin --project=shserv-test --zone=us-central1-a --verbosity=warning

Test the shortcut:

ssh shserv-test

The configuration works if the prompt resembles serda@shserv-test:~$.

19. Connect with VS Code Remote SSH

Install the Remote - SSH extension in VS Code, then run:

Ctrl + Shift + P
Remote-SSH: Connect to Host
shserv-test

Choose Linux if VS Code asks for the operating system on first connection. VS Code now runs against the Google Cloud VM. Verify it in the integrated terminal:

hostname

The expected output is shserv-test.

20. Verify the cost-critical settings

For this free VPS/hosting configuration, use e2-micro in a Free Tier region with 30 GB pd-standard. Do not use public IPv4, snapshots, Cloud NAT, a Load Balancer, Ops Agent, or KMS. Avoiding public IPv4 removes its hourly address charge.

Internet outbound traffic remains subject to separate usage limits. Monitor external IPv6 traffic here:

Billing
→ Reports

Filter:
Project: shserv-test
Service: Compute Engine
Group by: SKU

The Free Tier discount may appear as savings or credits in Billing reports rather than on the VM Create page. For extra protection, create a low-value budget alert under Billing → Budgets & alerts.

Final server configuration

Google Cloud
└── shserv-test
    ├── us-central1-a
    ├── e2-micro
    ├── Debian 13
    ├── 30 GB pd-standard
    ├── 1 GB RAM
    ├── 2 GB Swap
    ├── External IPv4: NONE
    ├── External IPv6: ENABLED
    ├── SSH: Google IAP
    ├── Docker Engine
    ├── Docker Compose
    └── VS Code Remote SSH ready

You now have a Google Cloud free VPS designed to minimize billable resources, with IPv6 internet access and secure IAP administration. Next, you can run an application with Docker Compose and publish it through Cloudflare Tunnel as a free hosting-style setup without adding a public IPv4 address or load balancer.