Infrastructure Architecture

Under the hood.

We don't use proprietary black-box clouds. We run on high-performance OVH instances in London and Paris, backed by a custom-hardened Windows kernel.

1. The Hardware

⚡ WE DO NOT SHARE CPUs.

Whitehirst instances exclusively run on OVH General Purpose Compute (b3) nodes. Unlike standard Azure B-Series or AWS T-Series, these are not burstable. The AMD EPYC vCores assigned to your VM are guaranteed and 100% exclusive to you, entirely eliminating "noisy neighbor" compilation latency.

CPU Architecture

AMD EPYC™ with Nested Virtualization

Hypervisor

OpenStack KVM

Disk I/O

Local Ephemeral NVMe

Network Uplink

2 Gbit/s Interface

2. The Operating System

We use Windows Server 2022 as the base. It uses the stable Windows 10 Enterprise kernel but comes without consumer bloat. We then apply over 50 specific modifications to transform it into a high-performance workstation.

A. Kernel & CPU Optimization

A standard server is tuned to prioritize background services (SQL, Web). A workstation needs to prioritize foreground apps (VS Code, Browser). We've baked this into the image.

Win32PrioritySeparation: Set to 38 (0x26). This forces short, variable quantums, giving the foreground application instant CPU priority.
Power Plan: We force the High Performance plan and set CPU Minimum State to 100%. This disables "Core Parking" and C-States, ensuring your compiler has 8 cores ready at max frequency instantly.

B. "De-Serverification" (UX Restoration)

We restore the "Human" features that Server 2022 disables by default.

Audio & Media: We enable the Audiosrv service and install Server-Media-Foundation and qWave. This allows Spotify, browser audio, and game streaming to function normally.
Visuals: We enforce "Best Performance" (removing animations) but force ClearType font smoothing back on for crisp code rendering.
Dark Mode: Enabled system-wide by default.
Server Friction: We remove the "Shutdown Event Tracker", disable "Ctrl+Alt+Del" login requirements, and apply 40+ registry tweaks to make the OS feel like a fast desktop.

// Actual snippets from our build pipeline
Set-ItemProperty -Path "HKLM:\...\PriorityControl" -Name
            "Win32PrioritySeparation" -Value 38
        
# Optimizes CPU scheduling for foreground applications.

powercfg /setacvalueindex scheme_current sub_processor CPMINCORES 100
# Prevents CPU cores from "parking" or sleeping.

3. The "Batteries Included" Toolchain

We don't just give you a blank OS. We pre-install and configure the modern developer stack so you are ready to code in ~10 minutes, saving you hours of setup time.

💜

VS 2026 Community

📝

VS Code

📝

Notepad++

⚡

.NET 8, 9, 10

🦀

Rust & Cargo

⚙️

C++ MSVC & CMake

🟢

Node.js (NVM)

🐍

Python 3

🐳

Docker CE (Native)

🦭

Podman, Portainer & Lazydocker

🐧

WSL 2

🐱

Git & OpenSSH

⚒️

Windows Terminal

🚀

Postman

🎁

Winget Package Manager

🎁

Chocolatey Package Manager

☀️

Sunshine Stream

🔒

Tailscale

🌐

Firefox & Chrome

📦

7-Zip

4. The "Zero Telemetry" Architecture

We aggressively strip out Microsoft tracking services. We do not just disable them; we remove the binaries and nuke the scheduled tasks from orbit - It's the only way to be sure.

Azure Arc Removed: We uninstall the AzureArcSetup capability and block the system tray agent.
Telemetry Disabled: We set AllowTelemetry to 0 (Security Level) and kill the Compatibility Appraiser tasks that scan your disk.
Defender Optimized: We pre-configure Windows Defender to exclude developer folders (node_modules, .git, Docker volumes, Visual Studio IDE) to prevent AV from slowing down your builds.

5. Network & Security Policy

To maintain our high-reputation IP pool and keep your instance invisible to brute-force scanners, we enforce a strict edge security model.

Default Inbound Access

Randomized RDP + NLA

Standard port 3389 is permanently blocked. Each VM assigns a randomized high-range port protected by Network Level Authentication (NLA) and high-entropy, 24-hour disposable credentials for instant connection via any native RDP client.

Stealth Mode (COMING SOON!)

Zero-Inbound via Tailscale

For developers requiring zero public exposure, supply an ephemeral Tailscale auth key at launch. 100% of public inbound ports are dropped at the edge firewall, routing your desktop session exclusively through an encrypted private mesh.

Outbound Blocklist

SMTP, SMB & P2P

To maintain network reputation and prevent abuse, the following ports are strictly blocked at the data center edge:

TCP 25, 465, 587: Mail / SMTP (Anti-Spam)
TCP 135-139, 445: NetBIOS / SMB (Anti-Malware Propagation)
TCP 23, 6667-6669: Telnet & IRC (Botnet C2 / IoT Scanning)
TCP 3333, 4444, 5555, 7777, 9009: Stratum (Known Mining Pools)
TCP 6881-6969: BitTorrent & P2P (DMCA Compliance)
TCP 9001, 9030: Tor Relay / Exit Nodes
UDP 17, 19, 161, 389, 1900, 11211: DDoS Amplification Protocols

🚨 ZERO TOLERANCE ABUSE POLICY

Whitehirst is built for software engineers, not bad actors. If our automated network heuristics detect port scanning, crypto-mining, DDoS participation, or any malicious egress traffic, your VM will be instantly destroyed and your account permanently banned.
No warnings. No refunds. No exceptions.