How much CPU and RAM does the agent use?

The agent is deliberately small. It ships as a single statically-linked binary with no runtime to install, sits quietly when idle, and scales its work with the traffic you actually push.

Idle: small and quiet

With no tunnel active there is nothing to relay and nothing to encrypt, so the agent does effectively no work — it just holds its outbound connection open and answers keepalives. Leaving an agent connected around the clock costs almost nothing.

Under traffic: predictable

Each active relayed stream allocates a fixed buffer of roughly 64 KB. That means memory grows with the number of concurrent streams, not with how many tunnels are defined or how long they have been open. CPU scales with throughput, because the data is encrypted chunk by chunk with ChaCha20-Poly1305 as it passes through — more bytes per second means more cipher work, and an idle stream costs no CPU.

What that means for small hardware

Because the binary is self-contained and the per-stream cost is small and fixed, the agent runs comfortably on modest hardware, including small ARM single-board computers. The ceiling on a given box is mostly how fast it can run the cipher, which depends on the CPU; on a normal server the agent is rarely the bottleneck. For sizing a specific device or workload, get in touch — the realistic number depends on your hardware and traffic mix.