dalao.ai

Coolify

Self-hosted Heroku and Vercel alternativeOpen source

About Coolify

Coolify is an open-source, self-hostable deployment platform that deploys apps, databases and 360+ one-click services onto servers the user connects over SSH, a self-hosted alternative to Vercel and Heroku. The self-hosted edition is free with no feature gates; Coolify Cloud, the managed control plane, costs $5/month for 2 servers plus $3 per extra server (2026-10-25); servers are user-supplied. The code is Apache-2.0, and v4.0.0 shipped on 2026-04-27 after a long beta. The repository has published 70 security advisories.

EditorialUpdated 10 min read

The Coolify interface

What it is

Coolify is a self-hosted PaaS (platform as a service) control plane. Users install Coolify on a Linux server, or use the managed Coolify Cloud, and then connect one or more servers over SSH. In the web dashboard they pick a Git repository, a Docker image or a Docker Compose file; Coolify builds, deploys, configures the reverse proxy and HTTPS certificates, and keeps apps, databases and one-click services in one project view.

It describes itself as an "open-source and self-hostable alternative to Vercel, Heroku, Netlify and Railway". The difference is compute: those hosted platforms sell their own machines, while Coolify only manages the user's own. A server can be a cloud VPS, a dedicated box, a virtual machine, a 64-bit Raspberry Pi or a spare Linux laptop, as long as it accepts SSH and runs Docker.

The product is run by coolLabs Solutions Kft., and the founder is Andras Bacsai. The GitHub repository coollabsio/coolify was created on 2021-01-26 and, as of 2026-10-25, has 63,836 stars and 5,749 forks. The code is mostly PHP (Laravel and Livewire).

There are two deployment modes. The self-hosted edition keeps the dashboard and its data on the user's server and is free with no feature limits; Coolify Cloud keeps the dashboard, control plane and their backups on infrastructure the Coolify team runs, while the user's apps, databases and data still run on the servers the user connects. The comparison table on the pricing page lists "Open source" for both under "Codebase".

Software should be free and accessible to everyone.

coolLabs philosophy page headline

Core capabilities

The homepage lists Nixpacks, Railpack, Dockerfile, Docker Compose, static sites and prebuilt images from a registry as build paths; Git integration covers hosted and self-hosted GitHub, GitLab, Bitbucket, Gitea and others, with push-to-deploy and separate preview deployments for pull requests.

Databases and one-click services. PostgreSQL, MySQL, MariaDB, MongoDB, Redis, KeyDB, Dragonfly and ClickHouse start with one click, with optional public access and SSL, and database backups go to any S3-compatible storage. The repository description cites 360+ one-click service templates; the v4.0.0 release notes mention updates to the Langfuse, Plane and Beszel templates.

Day-to-day operations sit in one dashboard: automatic Let's Encrypt issuance and renewal, a real-time terminal in the browser, scheduled tasks, environments and shared variables, team members and roles, Cloudflare Tunnel setup, monitoring and notifications.

v4.5.0, released on 2026-10-23, added: Gitea App sources, per-server automatic security updates (beta), a fleet Metrics page, a file browser, passkey sign-in, maintenance mode and custom error pages, an automatic backup of the Coolify database before updates, and MCP tools to manage resources. The homepage also describes the built-in MCP server: once Claude, Cursor or another MCP client is connected to a Coolify instance, the agent can list resources, deploy, read logs and restart services using existing API tokens and team permissions.

APIs and automation. There is a REST API and webhooks that plug into GitHub Actions, GitLab CI, Bitbucket Pipelines and other pipelines; v4.2.0 added API endpoints for logs, storage backups and moving resources.

Who it's for / Not for

For:

Individual developers and small teams with one or a few VPSs who want something close to Heroku without paying hosted-platform prices. Coolify gathers Docker, reverse proxy, certificates and database backups into one dashboard, so users stop writing deployment scripts.

People running many small projects at once. The Cloud docs give a reference point: one Hetzner CAX11 (2 cores, 4 GB RAM, 40 GB disk) runs 16 static sites, 25 Rust services and bots, 2 Valkey and 1 PostgreSQL database at an average of 2.1 GB of memory. It is ShadowArcanist's optimized setup, and the docs say to treat it only as a rough reference.

People who want AI agents in their operations. The built-in MCP server reuses API tokens and team permissions, so an agent can read logs, restart services and troubleshoot failed deployments, which suits developers already using Claude or Cursor.

Not for:

People who do not want to touch servers. Even on Coolify Cloud users bring their own servers and own OS updates, firewalls, application data and database backups; the Cloud docs list these explicitly as the user's responsibility.

Organizations that open one instance to many members who do not trust each other. A sizeable share of the published advisories need only "an authenticated low-privileged team member" yet reach root on the server.

Large production setups that need autoscaling across machines. The v4.0.0 release notes name "full scalability in the core" as the biggest v5 feature.

People who only run Windows or macOS as servers. The install docs say Coolify runs only on Linux; other systems need a Linux virtual machine.

How it compares

Against hosted platforms. Vercel Pro costs $20/month per developer seat as of 2026-10-25, with $20 of included usage; Railway Hobby has a $5 monthly minimum and Pro a $20 minimum, with resource usage billed on top. Coolify sells no compute: the self-hosted edition is free, Cloud charges only for the control plane, and users pay their cloud provider for machines.

Against Dokploy. Dokploy is also an open-source self-hosted deployment dashboard, with 38,011 GitHub stars as of 2026-10-25. Its hosted pricing page lists Hobby at $4.50 per server per month and Startup from $15/month with 3 servers, basic RBAC and 2FA; the enterprise tier offers SSO/SAML, SCIM and audit logs through sales. Coolify puts every feature in the open-source edition and has one Cloud plan; Dokploy splits multi-organization, RBAC and SSO across plans.

Against CapRover. CapRover is also free and self-hosted, built on Docker, nginx and Docker Swarm, with 15,188 GitHub stars as of 2026-10-25. The two share the free self-hosted model.

Getting started

Step one, pick a mode. To self-host the dashboard, prepare a Linux server per the install docs: at least 2 CPU cores, 2 GB RAM and 10 GB disk, on Debian, Ubuntu (non-LTS needs the manual install), CentOS, Fedora, Red Hat, AlmaLinux, Rocky, SUSE, Arch, Alpine or 64-bit Raspberry Pi OS. Otherwise, register for Coolify Cloud at app.coolify.io.

Step two, install or register. Self-hosting uses the official one-line command, which runs the install script as root and sets up Docker and Coolify (the vendor says in under a minute); then follow the next steps printed in the terminal to open the dashboard and finish setup. For existing Docker installs or non-root setups, the docs give a manual flow. On Cloud, choose how many servers to connect and pay first.

Step three, connect a server. Add an SSH private key in the dashboard, enter the server address, use root or a sudo-capable user, and let Coolify validate the connection and install Docker Engine. The firewall must allow SSH and the ports Coolify and the apps use; on Cloud, allow the control-plane IPs listed in the docs.

Step four, deploy a first resource. Create a project and choose a Git repository, Docker image, Compose file or one-click template. Smart scan, added in v4.5.0, tries to detect the build pack, Dockerfiles and environment variables. Certificates are issued once a domain is attached.

Pricing & license

Self-hosted: free; the pricing page says "Free forever", with every feature, no limits on servers, deployments or members, and community support. Users pay only for their own servers.

Coolify Cloud: as of 2026-10-25, the base price is $5/month for 2 connected servers, each additional server costs $3/month, and annual billing saves 20%. The pricing page also notes each team needs its own subscription. Cloud includes a managed dashboard (at app.coolify.io), managed control-plane updates and backups, free email alerts, and community plus limited email support. Servers are still yours and not included.

Revenue: the coolLabs philosophy page lists $23,000+ hosted-services MRR, $9,000+ per month from GitHub Sponsors and $1,100+ per month from Open Collective, all as reported by the vendor. The sponsorship page says the company is self-funded with no investors and sells sponsor slots on the homepage and README, citing 170k+ unique visitors a month.

License: Apache-2.0. The first LICENSE in the repository was added by commit dbe82b3 ("initial production release") at 2021-03-25 05:11 (UTC+8) as AGPL-3.0; the V2 rewrite in February 2022 removed the file, and commit 0b8a648 added AGPL-3.0 back at 2022-03-31 15:11 (UTC+8); the current Apache-2.0 text was first written by commit 9eeef96 ("Changing license") at 2022-08-08 20:22 (UTC+8), and has since changed only in a 2025 workflow cleanup.

The philosophy page also makes a request: Apache allows commercial redistribution, but the team asks people not to resell Coolify under their own name.

Risks & limits

As of 2026-10-25, the repository's security advisories page lists 70 published advisories. They include command injection and cross-team authorization flaws, some reaching root on managed servers.

Take CVE-2026-34048: the terminal's websocket bootstrap endpoints checked only that a user was logged in, not that the user had terminal rights, so a low-privileged team member could run commands on terminal-enabled team servers. The precondition is that the attacker holds a team member account on the instance and the target server has the terminal enabled; it affects 4.0.0-beta.470 and earlier and was fixed in beta.471. The CVSS 3.1 score of 9.9 was given by the advisory publisher on GitHub; NVD lists GitHub (security-advisories@github.com) as the score source and has no score of its own.

One needs no login: CVE-2026-41896. Older apps had no webhook secret by default, and the server computed the HMAC with an empty key, so anyone could forge a signature and trigger deployments. The precondition is an app with no manually set webhook secret (the default then); it affects beta.473 and earlier and was fixed in beta.474; the CVSS 3.1 score of 7.5 was also given by the advisory publisher on GitHub.

The advisories published in June and July 2026 were mostly fixed in beta.471 and beta.474 from April 2026.

Dependencies. v4.4.7, released at 2026-10-21 22:12 (UTC+8), upgraded PHP for CVE-2026-109618 and CVE-2026-109619 and shipped a patch release for each line from v4.0 to v4.3. CVE-2026-109618 requires driving PHP to an out-of-memory condition in certain contexts; PHP (the CNA) scored it 9.2 under CVSS 4.0 with high attack complexity, while NVD scored it 9.8 under CVSS 3.1.

Privileges. Coolify manages servers with SSH private keys as root or a sudo user, and the one-line installer requires root.

Minor versions carry breaking changes. v4.2.0 made the Member role read-only and required POST for state-changing API calls, so old GET requests return 405.

The team. The sponsorship page says the founder has worked full-time on open source since July 2022 and from mid-2024 hired a developer and a few community support members. Cloud support is "community + limited email support".

How it got here

On 2021-01-26, Andras Bacsai created the coollabsio/coolify repository. Commit dbe82b3 on 2021-03-25 was labelled "initial production release", and the project shipped under AGPL-3.0.

On 2022-02-10, the V2 rewrite landed on the main branch. In July 2022 the founder quit a day job to work on open source full-time; a month later, on 2022-08-08, commit 9eeef96 switched the license from AGPL-3.0 to Apache-2.0, and Coolify has stayed Apache-2.0 since.

v4 spent a long time in beta. The v4.0.0 release notes say thousands of companies and people had used it in production for one to two years, as reported by the vendor.

At 2026-04-21 18:31 (UTC+8), beta.474 shipped, encrypting webhook secrets and hardening signature checks; six days later, at 2026-04-27 16:55 (UTC+8), v4.0.0 was released. The notes say v5 is in development with full scalability in the core as its biggest feature, and that v4 will keep being supported.

Later releases: v4.1.0 on 2026-05-18 added Railpack builds and audit logging; v4.2.0 on 2026-07-22 made the Member role read-only; v4.3.0 on 2026-08-12 brought a new UI.

On 2026-10-21, v4.4.7 fixed several critical vulnerabilities in dependencies, and the same day patch releases went out for v4.3, v4.2, v4.1 and v4.0 along with a one-line upgrade script. Two days later, at 2026-10-23 18:41 (UTC+8), v4.5.0 shipped with automatic server security updates, MCP tools and passkey sign-in.

As of 2026-10-25 the homepage shows 3,953+ Cloud customers and 522,874+ self-hosted instances, as reported by the vendor.

Our verdict

What sets Coolify apart: it is an open-source, self-hosted deployment dashboard under Apache-2.0; the self-hosted edition is free with every feature included, and Cloud charges only for the control plane, from $5/month; it supports push-to-deploy, preview deployments, one-click databases, 360+ service templates and a built-in MCP server.

Its limits: the repository has published 70 security advisories, some of which need only an authenticated low-privileged team member to reach root on the server; Coolify manages connected servers as root or a sudo user; minor versions carry breaking changes; full scalability in the core is listed as a v5 feature; Cloud support is community plus limited email support.

Why it stands out

Coolify is self-hosting for people who like Vercel and Heroku but not their invoices. Point it at a server, connect a repository, and it builds, deploys, and manages databases, backups, and SSL for you.

Andras Bacsai built it alone, funded it through sponsorships and a hosted plan, and rewrote it from scratch for version 4 without losing the community. It is one of the few open source PaaS projects that has proven financially sustainable.

It is open source and self-hosted, handling builds, deployments, databases, backups and SSL on your own server, and is funded by sponsorships and a hosted plan.

Sources

Official

  1. Coolify - Self-hosting with superpowerscoolify.io · Accessed Oct 25, 2026
  2. Coolify Pricing: Cloud from $5/mo, self-hosted freecoolify.io · Accessed Oct 25, 2026
  3. Self-hosted Coolify: Free, open source, every featurecoolify.io · Accessed Oct 25, 2026
  4. Sponsorship | coolLabscoolify.io · Accessed Oct 25, 2026
  5. Start with Coolify Cloud | Coolify Docscoolify.io · Accessed Oct 25, 2026
  6. Install Coolify (Self-hosted): One-command Setupcoolify.io · Accessed Oct 25, 2026
  7. GitHub - coollabsio/coolify: An open-source, self-hostable PaaS alternative to Vercel, Heroku & NetlifyGitHub · Accessed Oct 25, 2026
  8. Release v4.0.0 · coollabsio/coolifyGitHub · Accessed Oct 25, 2026

Updates & reading