---
title: "About non-cluster hosts"
description: "Install Calico Open Source on non-cluster hosts and VMs — pick between policy-only and networking-and-policy modes for protecting hosts outside Kubernetes."
product: "Calico Open Source"
version: "3.32 (latest)"
section: "Installing and upgrading"
canonical_url: "https://docs.tigera.io/calico/latest/getting-started/bare-metal/about"
---

# About non-cluster hosts

## Big picture

Secure non-cluster hosts and VMs by installing Calico for networking and/or networking policy.

## Value

Not all hosts in your environment run pods/workloads. You may have physical machines or legacy applications that you cannot move into a Kubernetes cluster, but still need to securely communicate with pods in your cluster. Calico lets you enforce policy on these **non-cluster hosts** using the same robust Calico network policy that you use for pods.

## Concepts

### Non-cluster hosts and host endpoints

A **non-cluster host** is a computer that is running an application that is *not part of a Kubernetes cluster*. Using Calico network policy, you can secure these host interfaces using **host endpoints**. Host endpoints can have labels, and work the same as labels on pods/workload endpoints.

The advantage is, you can write network policy rules to apply to both workload endpoints and host endpoints using label selectors; where each selector can refer to the either type (or be a mix of the two). For example, you can write a cluster-wide policy for non-cluster hosts that is immediately applied to every host. To learn how to restrict traffic to/from hosts and VMs using Calico network policy, see [Protect hosts](https://docs.tigera.io/calico/latest/network-policy/hosts/protect-hosts.md).

If you are using the etcd3 database, you can also install Calico with networking as described below.

### Install options for non-cluster hosts

| Install Calico with...        | Requires                         | Use case                                                                                                                                                                                                                                                                                                                                            | Supported install methods                      |
| ----------------------------- | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- |
| Policy only                   | An etcd3 or Kubernetes datastore | Use Calico network policy to control firewalls on non-cluster hosts.                                                                                                                                                                                                                                                                                | Binary install with/ without a package manager |
| Networking and network policy | An etcd3 datastore               | **Networking** Use Calico networking (BGP, or overlay with VXLAN or IP-in-IP) to handle these communications: - pod ↔ pod - pod ↔ host **Note**: Calico does not handle host ↔ host networking; your underlying network must already be set up to handle this. **Policy** Use Calico network policy to control firewalls on your non-cluster hosts. | Docker container                               |

## Before you begin

**Supported**

- All platforms in this release, except Windows

**Required**

- Non-cluster host meets [system requirements](https://docs.tigera.io/calico/latest/getting-started/bare-metal/requirements.md) for Calico. If you want to use a package manager for installation, the non-cluster host must be a system derived from Ubuntu or RedHat.
- Set up a datastore; if Calico is installed on a cluster, you already have a datastore
- Install `kubectl` or [`calicoctl`](https://docs.tigera.io/calico/latest/operations/calicoctl.md). (`kubectl` works only with the Kubernetes datastore.)

## Next steps

Select an install method.

> **SECONDARY:** Calico must be installed on each non-cluster host that you want to control with networking and/or policy.

| Install method                                                                                                                 | Networking | Policy |
| ------------------------------------------------------------------------------------------------------------------------------ | ---------- | ------ |
| [Docker container](https://docs.tigera.io/calico/latest/getting-started/bare-metal/installation/container.md)                     | ✓          | ✓      |
| [Binary install with package manager](https://docs.tigera.io/calico/latest/getting-started/bare-metal/installation/binary-mgr.md) |            | ✓      |
| [Binary install without package manager](https://docs.tigera.io/calico/latest/getting-started/bare-metal/installation/binary.md)  |            | ✓      |