RAM-only VPN servers explained

A RAM-only or diskless server boots its operating system into memory over the network and never mounts a writable disk. Nothing persists. Power off, and the machine is a bare piece of hardware with no configuration, no keys and no data on it.

Several providers describe this as a cornerstone of their privacy architecture. It is a genuine engineering improvement and its benefits are narrower than the marketing implies.

What it protects against

Physical seizure of a powered-down server. The scenario where a machine is taken from a datacentre and examined. A conventional server's disk holds configuration, keys, and whatever was written; a diskless one holds nothing.

Accidental persistence. A process that writes a log file to disk on a diskless machine writes to a memory filesystem that disappears at reboot. The category of "we did not intend to keep that, but it was on the disk" is eliminated structurally rather than by policy.

Stale state across rebuilds. Every boot starts from a known image, so a server cannot drift from its intended configuration through a decade of manual changes.

That last one is an operational benefit as much as a privacy one, and it is probably the most valuable in practice.

What it does not protect against

A running server. Everything the machine currently knows is in memory, and memory is readable by anyone with sufficient access. A live seizure, a compromise, or a hypervisor-level capture on virtualised hardware all reach it.

Data sent elsewhere. If the provider ships logs to a central collector, it does not matter that the origin server had no disk. The records exist; they are merely somewhere else.

The hosting provider's own records. VPN servers are usually rented, and the host has network flow records at the infrastructure level. A diskless guest does not change what the host sees.

Legal compulsion going forward. An order to begin logging from tomorrow can be complied with on a diskless server as easily as on any other, by changing what the boot image does.

Cold boot attacks. Memory contents do not vanish instantly when power is removed. The Princeton research on this is old and the technique is well-documented; residual data can survive long enough to be recovered by someone prepared for it. This is a niche threat requiring physical access to a running machine, and it is a real limit on "power off means gone".

The question that matters more

A diskless architecture prevents accidental retention. It says nothing about deliberate retention, which is what a logging policy governs.

So the useful question is not "are your servers RAM-only" but "what do your servers send anywhere else, and what is kept there". A provider with diskless servers streaming full connection metadata to a central database has excellent architecture and the same data as everyone else.

What VPNmine does

VPNmine does not claim RAM-only infrastructure. The servers are rented hardware that VPNmine configures and monitors, and the privacy policy states what is recorded: which server a session used and when, and never browsing history, DNS queries or traffic content.

That is the claim that can be made honestly, and it is deliberately not dressed up as something else. A provider's architecture claims should match what it actually runs, and the ones on the server list are stated in the same spirit.

How to evaluate the claim elsewhere

If a provider advertises RAM-only servers, three follow-up questions are worth asking:

1. Is it every server, or the fleet in some locations? Rented capacity in smaller markets is often not diskless.
2. What leaves the server? Metrics, session records, abuse handling data. This is the question the architecture does not answer.
3. Is it verifiable? An audit that examined the boot process is evidence. A diagram on a marketing page is not.

None of that makes the claim worthless. A diskless fleet is better than a disk-based one, and it demonstrates that someone thought about the problem. It is one property among several, and it is not the one that determines what a provider could hand over if asked.

How it is actually built

The usual arrangement is network boot: the machine requests an image over the network at power-on, loads it into an in-memory filesystem, and runs from there. Configuration and keys are injected at boot from a management system rather than stored locally.

That has an operational consequence worth noting. The boot infrastructure becomes the sensitive component, because whoever controls the image controls every server that loads it. The security question moves rather than disappearing, which is a recurring pattern in this kind of architecture.

Diskless is not the same as stateless

A running diskless server holds a great deal of state in memory: active peers, their keys, their tunnel addresses and where they are connecting from. WireGuard in particular has to remember the mapping between a peer's public key and its current endpoint in order to route return traffic at all.

So the correct description of a RAM-only server is that its state is volatile, not that it has none. The distinction matters when reasoning about what a live compromise would yield.