A place between your laptop and production.
Use a separate VPS for preview deployments, integration checks or an environment your team can share. Keep staging data anonymised and restrict access; a hard-to-guess URL is not an access policy.
Your tools, under your control.
Run compatible version-control tools, documentation, task services or deployment agents. Review license requirements, resource use and vendor support before committing to a particular stack.
Containers are a workflow, not a security boundary you can ignore.
Pin image versions, avoid unnecessary privileged containers and store secrets outside your repository. Keep an eye on image caches and build artifacts: development servers can fill their disks quietly.
Keep experiments apart.
Give users individual credentials and make privileges explicit. Isolate untrusted code appropriately. Do not run arbitrary third-party builds on the same machine that holds production secrets.
Tempo 4 is a configuration to evaluate for a modest staging service. Builds with many parallel workers may need more memory and CPU. Benchmark your own pipeline rather than choosing by repository size alone.
Prepare your server safely