Lab platform vendor recommendation¶
Status: Recommendation made 2026-05-16, awaiting Silas decision Recommended: Kasm Workspaces (self-hosted) — Instruqt as fallback
Verification caveat. Pricing numbers in this doc are estimates from the research agent's training data (no live web access during the research run). Before signing any contract or building against a specific tier, spend ~30 min on each vendor's current pricing page and book a sales call with the top two. Numbers marked with
~are unverified estimates.
TL;DR¶
- Winner: Kasm Workspaces, self-hosted on a single Hetzner / DigitalOcean dedicated box, or Kasm Cloud Personal/Professional for v0.
- Runner-up: Instruqt (best UX but enterprise-priced; revisit when corporate buyers show up).
- Estimated all-in cost for ~30 peak concurrent learners: $250–500/mo total (license + infra). At $1,500/seat that's 1–3% of revenue. Healthy.
- Estimated setup time: ~5 engineering days for v1.
- One trap to avoid: Don't bake the llama3.2:3b weights into the Docker image. Mount the Ollama models directory as a host volume so all learners share the read-only weights. Cold-start drops from 60–90s to ~5s and the image stays under 2 GB.
Why Kasm wins for this shape of business¶
- Concurrency is small (10–30 peak) and image is fat (3–6 GB with Ollama + llama3.2:3b). Kasm self-hosted is built for exactly this profile: bring-your-own-Docker, full DinD via privileged workspaces, single-tenant, no per-seat tax.
- Kasm Community Edition is free up to 5 concurrent sessions. Paid tiers are licensed per concurrent session, not per learner — which fits async/drip delivery where 100–500 seats sold = ~10–30 peak concurrent.
- You can ship your own image (Python + uv + Ollama + llama3.2:3b on a host volume + Node tools) as a standard Kasm workspace definition.
- Thinkific integration is the weakest link, but solvable in ~half a day: "Launch Lab" button in each Thinkific lesson deep-links to Kasm with a one-time join token from a thin auth shim.
Why Instruqt is fallback, not winner¶
- Best-in-class authoring experience and the exact split-screen UX that Practical DevSecOps uses.
- But enterprise-sold (annual contracts, talk-to-sales, historically 5-figure floor). At 100–500 seats Year 1 you'd be paying enterprise prices for indie volume.
- Revisit when: (a) sales accelerate; (b) a corporate buyer wants 50+ seats and would absorb the platform premium; (c) authoring time on Kasm becomes the bottleneck.
Comparison matrix¶
| Vendor | Pricing model | DinD | Custom image | Thinkific story | Time-to-first-lab | Indie-friendly? |
|---|---|---|---|---|---|---|
| Kasm (self-hosted) | Per concurrent session license; free up to 5 | Yes (privileged workspace) | Yes, any Docker image | Deep-link / iframe | 3–5 days | Yes |
| Kasm Cloud | ~$5–15/user/mo tiers; capped | Limited on shared cloud | Limited | Same as above | 1–2 days | Yes for v0 |
| Instruqt | Annual contract, talk-to-sales (~$15–50k/yr typical floor) | Yes, first-class | Yes | Iframe-embeddable tracks | 5–10 days | No |
| Killercoda | Free public scenarios; Business tier paid | Yes but throttled | Limited (preset envs + apt installs) | Embed widget | 2–3 days | Yes for free/cheap, no for fat images |
| KodeKloud | Sells own courses; not a platform you rent | n/a | n/a | None | n/a | No |
| Strigo | Per-hour or per-seat, sales-led | Yes | Yes (AWS-backed VMs) | Embed + SSO | 5–7 days | Borderline |
| Skillable | Enterprise per-lab-hour, MSA required | Yes | Yes | LTI / embed | 10+ days | No |
| Coder.com | Per-user/mo OSS or Premium | Yes | Yes (any image) | Deep-link only | 4–6 days | Yes (alt to Kasm) |
| Gitpod / Codespaces | Per-hour compute | Yes | Yes | Deep-link only | 2–3 days | Yes but wrong UX |
Pricing reality check — Kasm self-hosted (estimates)¶
- Kasm Community Edition: $0 up to 5 concurrent.
- Kasm Workspaces paid tiers: historically Standard at ~$5/concurrent/mo, Enterprise at ~$8–12/concurrent/mo, billed annually. Verify on kasmweb.com/pricing. For 30 concurrent: ~$150–360/mo license.
- Infra: one Hetzner AX52 (16-core Ryzen, 64 GB RAM, NVMe) at ~€60/mo handles 20–30 concurrent fat-image sessions. Second box for HA brings to ~€120/mo. AWS equivalent ~$250–400/mo.
- All-in monthly: $250–500 at 30 peak concurrent. $5–15 per active learner-month against a $1,500 course price = 1–3% cost line.
Setup time estimate (5 engineering days for v1)¶
- Day 1. Kasm Community on a Hetzner box (one-liner installer, ~2 hours).
- Day 2. Build the Asfela base image (Python, uv, Ollama, Node tools), push to private registry, register as Kasm workspace. Mount Ollama models from host volume — do not bake into image.
- Day 3. Validate DinD with a vulnerable LLM target container inside the learner workspace.
- Day 4. Thinkific bridge: a tiny Node/Python service that takes a Thinkific webhook on lesson view, mints a Kasm join URL, returns iframe src or "Launch Lab" button. Inject per-learner API keys as session env vars.
- Day 5. End-to-end dry run with a test learner; tune idle timeout (30 min idle / 4 hr hard cap).
Add 2–3 days for polish (lab progress sync back to Thinkific, support screenshots).
Open questions to resolve before signing¶
- Kasm: Current per-concurrent-session price on Standard and Enterprise self-hosted in 2026? Is privileged/DinD allowed on Standard or Enterprise only?
- Kasm: Does Cloud Personal allow custom images from a private registry, or only marketplace images?
- Thinkific: Confirm your plan tier allows raw iframes in lesson bodies (free plan doesn't; Pro+ does).
- Per-learner secrets: Do learners paste API keys into a Kasm session prompt at launch, or do we store them in a Thinkific custom field and inject on session start? Second is nicer UX but the bridge then holds key material — a security/liability question for an AI security course.
- Instruqt (only if Kasm falls through): Minimum annual contract for 2026? Any startup/educator program?
- Egress: Confirm hosting provider allows outbound to api.openai.com / api.anthropic.com without rate-limit issues at 30 concurrent.
Assumptions baked into this recommendation¶
- You have one part-time engineer who can run Linux/Docker.
- Thinkific is on Pro tier or higher (iframe embeds allowed).
- You're comfortable self-hosting a single VM (if not, default to Kasm Cloud or pay the Instruqt premium).
- v1 ships in ~2 weeks, not 2 days.