dalao.ai

Dokploy

Deploy anything with Docker, beautifullyOpen source

About Dokploy

Dokploy is a self-hostable deployment platform in TypeScript, built on Docker, Swarm and Traefik, for running apps, Compose projects and databases on the user's own servers. As of 2026-10-25 it has 38,014 stars and the latest release is v0.30.10; core code is Apache-2.0, enterprise features such as SSO sit under a source-available license, and Cloud starts at $4.50 per server per month. Good for small teams with a VPS wanting a Heroku-like flow; with several critical security advisories published, a poor fit for teams that cannot upgrade promptly or must give accounts to untrusted users.

EditorialUpdated 10 min read

The Dokploy interface

What it is

Dokploy is a deployment platform that runs on the user's own server, often called a self-hosted PaaS. The GitHub description pitches it as an open-source alternative to Vercel, Netlify and Heroku; the README calls it a free, self-hostable platform that simplifies deploying and managing applications and databases. Users connect a Git or image registry in a web panel, and Dokploy builds images, starts containers, sets up domains and certificates, and puts databases, backups, logs and monitoring in one interface.

Technically it is a management layer on top of Docker. When self-hosted, the panel, a PostgreSQL database, Redis, the Traefik reverse proxy and the user's own apps run on the same machine; multiple servers are joined with Docker Swarm, and Traefik handles routing and load balancing. The main language is TypeScript, the default branch is canary, and stable releases are merged from canary into main. Besides self-hosting there is Dokploy Cloud, a managed control plane: the vendor runs the panel and management database, while apps and data stay on the user's servers.

As of 2026-10-25 the repo has 38,014 stars and 3,123 forks. The canary branch has 7,283 commits, the latest at 2026-10-25 20:46 (UTC+8). GitHub lists 178 releases; the latest, v0.30.10, shipped at 2026-10-23 02:25 (UTC+8) with notes that contain only a compare link. Version numbers are still 0.x.

Dokploy is a free, self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases.

Dokploy README

Core capabilities

First, deployment options. The website says apps can be built with Nixpacks, Heroku Buildpacks or a custom Dockerfile. Docker Compose is supported natively, either as plain Compose or as a Swarm stack. The comparison table in the docs lists four Git integrations (GitHub, GitLab, Bitbucket and Gitea), and the pricing feature list adds webhook auto-deploy, preview deployments, watch paths and registry-based rollbacks.

Second, databases and backups. The README lists six databases (MySQL, PostgreSQL, MongoDB, MariaDB, libsql and Redis) with scheduled backups to external S3-compatible storage; volume backups and scheduled jobs are also set up in the panel.

Third, multiple servers. Users can add remote servers to the panel, assign a dedicated build server, or form a Docker Swarm cluster. The v0.29.9 notes say all builds had shared one global queue for two years; from that release each server gets its own queue, running 1 build at a time by default and up to 2, with no limit on Enterprise.

Fourth, operations. The README lists real-time CPU, memory, storage and network monitoring for every resource, shipping of logs and metrics to Grafana, Datadog, New Relic and others, deployment notifications to Slack, Discord, Telegram or email, plus an API and CLI. v0.30.0, released at 2026-08-15 00:20 (UTC+8), added a Docker network management UI, automatic DNS records for Cloudflare and AWS Route53, environment variables read from external secret vaults, passkey login and session management, and SCIM user sync on Enterprise. The website also mentions connecting AI tools to Dokploy via MCP, as reported by the vendor.

Who it's for / Not for

Good fit: individual developers and small teams with one or two VPSes who want a push-to-deploy experience close to Heroku or Vercel without paying usage-based hosting fees.

Good fit: heavy Docker Compose users. Existing compose files can be imported into the panel, which then takes over domains, certificates and logs, with no need to rewrite them into another format.

Good fit: agencies or small companies managing several servers. The pricing page lists a separate plan for agencies, Cloud bills per server, and many machines can be run from one panel.

Good fit: teams that want someone else to maintain the control plane while data stays on their own machines. Dokploy Cloud has the vendor run the panel and database, and the docs stress that code and data stay on the user's servers.

Not a fit: anyone without time to keep up with releases. The repo has published several critical security advisories, so leaving an old version unpatched is high risk.

Not a fit: handing panel accounts to people who are not fully trusted, such as low-privilege member accounts for clients. Several advisories published in 2026 let a member role reach host root or read other organizations' credentials.

Not a fit: organizations that require every feature under an open-source license. SSO, SCIM, audit logs, white labeling and custom roles live in proprietary directories, and production use needs a commercial agreement.

Not a fit: teams already centered on Kubernetes. Inference: Dokploy's clustering is built on Docker Swarm and does not plug into an existing Kubernetes toolchain, so such teams are more likely to choose something inside the Kubernetes ecosystem.

How it compares

Coolify: a self-hosted PaaS in the same category, written in PHP, with 63,917 stars as of 2026-10-25; the GitHub API identifies its license as Apache-2.0, and the latest release, v4.5.0, shipped at 2026-10-23 18:41 (UTC+8). Coolify's pricing page says the self-hosted edition has no feature limits; Cloud costs $5 per month base with 2 servers, then $3 per additional server per month. Inference: with one or two servers the Cloud prices are close; if it matters whether features like SSO and audit logs are open source, Coolify's unrestricted self-hosted edition is simpler than Dokploy's dual-license layout.

CapRover: an older self-hosted PaaS, written in TypeScript, with 15,189 stars; the latest release, v1.15.5, shipped at 2026-10-24 01:46 (UTC+8). The comparison table in Dokploy's docs marks CapRover as lacking Docker Compose support; Dokploy compiled that table.

Dokku: written in Go, MIT-licensed, with 32,202 stars; the latest release, v0.38.32, shipped at 2026-10-25 11:17 (UTC+8). The same table marks Dokku as having no graphical UI and no built-in monitoring. Inference: for people used to the command line and git push deploys on a single machine, Dokku is lighter; for those who want to manage databases and backups by clicking in a web UI, Dokploy is more convenient.

Vercel, Netlify, Heroku: these are hosted platforms that Dokploy uses to explain its positioning. The difference is the responsibility boundary: Dokploy's production hardening guide says the panel covers the application layer, such as authentication, authorization and certificate automation, while the host OS, network perimeter, database placement and backup storage are the operator's responsibility. Inference: part of the saved hosting fee turns into the operator's own time.

Getting started

Machine requirements: the install docs require at least 2GB of RAM and 30GB of disk, and ports 80, 443 and 3000 must be free or the install fails. Tested systems listed in the docs include Ubuntu 18.04 to 24.04, Debian 10 to 12, Fedora 40 and CentOS 8 and 9; if Docker is missing, the install script sets it up.

Install and first login: the install command is curl -sSL https://dokploy.com/install.sh | sh, run with root privileges (or via sudo); the admin account is then created on port 3000 of the server IP in a browser. The docs then call for giving the panel a domain with HTTPS and, once that works, turning off access by IP and port, to avoid losing access. For a pinned version, each release ships its own install.sh; upgrades append the update argument to the same command.

Hardening: the production hardening guide is a checklist, including SSH key-only login, root login disabled, Fail2Ban enabled, a firewall open only on ports 22, 80 and 443, and ufw-docker, because ports published by Docker bypass UFW rules. The guide also lists keeping port 3000 off the public internet, behind a Traefik domain or Tailscale.

Cloud: people who do not want to maintain the panel can sign up for Dokploy Cloud; the website lists a 7-day free trial with no credit card, after which users connect their own servers and deploy.

Contributing: CONTRIBUTING.md asks contributors to start from the canary branch with Node 24.22.1, follow Conventional Commits, and personally test PRs or see them rejected; large features must be discussed in an issue first. One-click templates are kept in a separate templates repo.

Pricing & license

Self-hosted: free to download and use. The LICENSE.MD at the repo root says code outside proprietary directories is Apache-2.0, while code inside them falls under LICENSE_PROPRIETARY.md, the Dokploy Source Available License 1.0. As of 2026-10-25 such directories on the canary branch hold enterprise features such as SSO, SCIM, audit logs, white labeling, custom roles, license keys and forward auth for apps. That code may be copied and modified for development and testing, but production use requires a commercial agreement with Dokploy, and Dokploy owns the modifications.

Enterprise: the docs describe two forms, a license key activated on a self-hosted instance or Enterprise Cloud with a vendor-hosted control plane; both include SSO, SCIM, custom roles and audit logs. Pricing requires contacting sales.

Cloud: per the pricing page as of 2026-10-25, the Hobby plan costs $4.50 per server per month, limited to 1 user, 1 organization, 2 environments and 1 backup per database, with community Discord support. Startup starts at $15 per month with 3 servers and unlimited users, plus basic admin and developer roles, two-factor authentication, and email and chat support; extra servers are also $4.50 each. Enterprise is quote-based. Yearly billing saves 20%.

License history: the first commit, on 2024-04-19, carried AGPL-3.0. At 2024-04-29 13:57 (UTC+8) it switched to Apache-2.0 with an appendix barring third parties from selling future paid features. From 2024-05-23 16:15 (UTC+8) that became additional terms barring anyone but the copyright holder from selling or offering features such as multi-node and Compose as a service; multi-server, preview deployments and schedules were added later. Commit dd10d0b at 2026-01-22 02:43 (UTC+8) dropped those terms for the current Apache-2.0-plus-proprietary-directories layout and moved copyright from an individual to Dokploy Technology, Inc. As a result the GitHub API identifies the license as Other.

Risks & limits

Security advisories. As of 2026-10-25 the repo's advisory list holds critical, high, medium and low entries, with one batch published at 2026-05-12 02:35–02:38 (UTC+8) and another at 2026-07-22 07:22–07:27 (UTC+8). Types include OS command injection and cross-organization access control flaws: fields such as branch names, repo URLs, image names, database names and certificate paths were spliced straight into shell commands. The impact is large because, as the advisories note, Dokploy mounts the Docker socket, so command execution in a container can escalate to control of the whole host.

Two examples. GHSA-w3gm-rc4p-9rhj scores 10.0: versions 0.27.0 to 0.28.8 fell back to a default auth secret hardcoded in the source when the environment variable was unset, and the install script never set it, so an attacker could forge tokens and take over the admin without logging in. GHSA-899j-cjwp-v4gw scores 9.9: the container terminal WebSocket only checked for a login, so the lowest-privilege member could open a root shell in any container on the host; the patched version is listed as v0.29.13. That release shipped at 2026-07-22 00:08 (UTC+8), and several of its changes are labeled security fixes.

Inconsistent advisory metadata. Affected ranges are written inconsistently: some stop at 0.29.8, others say up to 0.0.0 or 99.99.99. Inference: users can hardly tell from the advisories whether their version is safe. SECURITY.md asks reporters to email contact@dokploy.com and not to disclose before a fix.

Still 0.x. v0.29.9 warned Enterprise white-labeling users that custom colors may render differently after a styling migration, and v0.30.0 deprecated Isolated Deployment. These changes are listed in the release notes.

Founder dependence. As of 2026-10-25 the GitHub contributors API ranks founder Mauricio Siu first. When self-hosted, the panel shares one machine's resources with the apps, which the Cloud docs also list as a reason to switch to Cloud.

How it got here

At 2024-04-19 15:49 (UTC+8), Mauricio Siu created the repo on GitHub and pushed the first commit, then licensed AGPL-3.0.

At 2024-04-29 13:57 (UTC+8), the license became Apache-2.0 with an appendix; the additional terms were revised several times after that.

v0.0.1 shipped at 2024-05-02 11:48 (UTC+8), already with fixes from several outside contributors; v0.1.0 followed at 2024-05-30 15:02 (UTC+8).

v0.10.0 shipped at 2024-10-14 06:51 (UTC+8) and v0.20.0 at 2025-03-10 15:40 (UTC+8).

The first advisories came in 2025-07: medium ones at 2025-07-05 15:35 (UTC+8), and a critical preview-deployment remote code execution at 2025-07-14 13:53 (UTC+8), fixed in 0.24.3.

At 2026-01-22 02:43 (UTC+8), the license changed to the current Apache-2.0-plus-proprietary-directories layout, copyright moved to Dokploy Technology, Inc., and enterprise features have been licensed separately since.

At 2026-01-28 04:27–04:29 (UTC+8), a batch of advisories was published, one of them about database credentials hardcoded in the install script.

v0.27.0 shipped at 2026-02-10 16:15 (UTC+8); on 2026-05-12, a batch of advisories was published, including the hardcoded auth secret scored 10.0.

v0.29.9 shipped at 2026-07-06 14:00 (UTC+8), splitting the build queue per server.

v0.29.13 shipped at 2026-07-22 00:08 (UTC+8) with a batch of security fixes; another batch of advisories was published the same day.

v0.30.0 shipped at 2026-08-15 00:20 (UTC+8), adding network management, DNS automation, external secret vaults, passkeys and SCIM.

v0.30.10 shipped at 2026-10-23 02:25 (UTC+8).

As of 2026-10-25, the website claims over 388 contributors; the GitHub contributors API list includes bot accounts such as autofix.

Our verdict

Dokploy wraps Docker, Compose, Traefik and database backups into a web panel, with Cloud from $4.50 per server per month, aimed at small teams with a few VPSes.

The problems are security and licensing. The advisories show the codebase once spliced user input into shell commands in many places; a batch was fixed in 2026, but advisory metadata is inconsistent, and enterprise features sit in proprietary directories that need a commercial agreement.

Inference: personal projects and internal services match Dokploy's positioning; for giving accounts to clients or several teams, or for SSO and audit under an open-source license, alternatives such as Coolify are also options.

Why it stands out

Dokploy is a deployment panel that treats Docker Compose as a first-class citizen and wraps it in an interface that would not look out of place in a commercial product. Databases, backups, monitoring, and Traefik routing are all a few clicks.

Mauricio Siu built it and grew it on GitHub, competing directly with older tools by simply being nicer to use every day.

It treats Docker Compose as first-class and puts databases, backups, monitoring and Traefik routing in one panel.

Sources

Official

  1. Dokploy/dokploy on GitHubGitHub · Accessed Oct 25, 2026
  2. Dokploy READMEGitHub · Accessed Oct 25, 2026
  3. Dokploy LICENSE.MDGitHub · Accessed Oct 25, 2026
  4. Dokploy LICENSE_PROPRIETARY.md (DSAL 1.0)GitHub · Accessed Oct 25, 2026
  5. Dokploy commit dd10d0b: introduce proprietary licenseGitHub · Accessed Oct 25, 2026
  6. Dokploy commit 48bf9a1: Initial commitGitHub · Accessed Oct 25, 2026
  7. Dokploy commit be56ba0: feat: initial commit (LICENSE.MD, Apache 2.0)GitHub · Accessed Oct 25, 2026
  8. Dokploy SECURITY.mdGitHub · Accessed Oct 25, 2026

Updates & reading