How Hetzner Dominates Using Bare Metal Server Orchestration

Introduction: The Challenge of Physical Server Automation

While virtualized cloud instances offer rapid deployments, they introduce a performance tax. Shared CPU cores, hypervisor overhead, and network congestion can degrade performance for compute-intensive workloads.

Bare metal servers solve this performance loss by providing direct access to raw physical hardware. However, provisioning physical servers has traditionally required manual intervention by data center technicians, leading to long lead times and operational inefficiency.

Hetzner overcomes this limitation by implementing a highly automated bare metal orchestration platform. By automating the entire lifecycle of physical hardware—from initial power-on to operating system installation and network provisioning—Hetzner delivers dedicated physical servers in minutes rather than days. This architecture combines the performance of dedicated hardware with the flexibility of cloud provisioning.

PXE Booting and Automated Image Installation

Hetzner's bare metal automation is built on PXE (Preboot Execution Environment) networking. When a user requests a new server or triggers a system reinstall, the orchestration system sets the server's boot device to network boot and performs a hard reset.

During the boot sequence, the server's network card requests an IP address via DHCP. Hetzner's DHCP servers respond with a network configuration and a path to a custom network bootstrap program.

The server downloads this program via TFTP or HTTP, booting into a lightweight, in-memory Linux rescue environment. From this rescue environment, Hetzner's automated scripts partition the local drives, configure RAID arrays, and write the target operating system image directly to the physical storage.

Hardware Diagnostics and Out-of-Band Management

To maintain high reliability, Hetzner's orchestration platform performs automated hardware audits during the provisioning process. The rescue environment executes diagnostic tests on the physical CPU, runs memory test sweeps, and reads SMART data from the SSDs. If any component shows signs of degradation, the server is flagged and routed to a technician queue, preventing faulty hardware from entering production.

Additionally, Hetzner integrates out-of-band management through IPMI (Intelligent Platform Management Interface) and LOM (Lights Out Management) controllers. These hardware-level controllers run on independent processors, allowing Hetzner's orchestration APIs to perform power cycles, monitor hardware temperatures, and access console redirects even if the primary operating system is unresponsive.

Network Isolation via vSwitch and VLANs

Running bare metal servers requires secure, isolated networking. Hetzner resolves this by utilizing dynamic VLAN (Virtual Local Area Network) mapping and custom vSwitch (virtual switch) APIs. When a user configures a private network, Hetzner's switch orchestration software configures the physical network switches to tag the server's switch ports with specific VLAN IDs.

• Secure Tenancy: VLAN isolation guarantees that private network traffic cannot be intercepted by other servers sharing the same physical rack.
• IP Routing: Public IP addresses are routed through upstream routers, while private traffic stays isolated within the VLAN.
• Flexible Topology: Users can dynamically link multiple bare metal servers and cloud instances into a unified, secure private network.

Orchestrating Bare Metal Infrastructure from the Edge with Bramsley

Managing bare metal servers from a centralized console can introduce latency and security risks, particularly when routing client traffic across public networks. Bramsley Digital Studio optimizes this setup by serving as an edge-native control plane and security gateway for bare metal environments. Bramsley Edge workers establish secure, high-speed WireGuard tunnels directly to Hetzner bare metal nodes, encrypting and routing database and application traffic across our global private backbone.

With Bramsley's intelligent edge routing, client requests are terminated at the closest edge node, where SSL/TLS handshakes are resolved. Bramsley then routes the clean traffic to the back-end Hetzner bare metal instances using persistent, pre-warmed TCP connections.

In the event of a physical server failure, Bramsley's edge load balancers detect the health change within milliseconds and redirect traffic to redundant physical servers. This ensures that you can leverage the high performance of bare metal compute while enjoying the security, availability, and global speed of the Bramsley Edge Network.