v0.15.8Optional pinning of a Git host's SSH keys for deploy-key sources, and `deploys watch` that

Ship likeyou mean it.

Push a branch, get a healthy container behind TLS. NineDeploy builds it on a server you own, keeps the old version serving until the new one passes its healthcheck, and runs the databases, certificates and backups around it.

$curl -fsSL https://ninedeploy.com/install.sh | bash

Read the docsMIT licensed. No external database. No vendor.

Your users

api.example.com

Traefik:443

route →api-blue

api-bluelive

commit 4b1e07c0 req

api-greenstandby

commit —

Try breaking it. Traffic stays where it is.

ninedeploy deploys watch api

12:00:58→ api-blue serving 4b1e07c · healthy

305 apps you can run before your coffee cools.

Browse the template hub

New in the 0.15 series

More apps. More ways to deploy.

Release notes

305 one-click templates

Immich, Paperless, Authentik, Karakeep, Docmost and many more. Browse the expanded catalog and its runtime certification marks.

Explore the catalog

Build and run across nodes

Nixpacks and Railpack on nodes, dedicated build servers, sealed image transfer, node databases and opt-in Docker Swarm.

Explore multi-server deploys

11 managed database engines

KeyDB and Dragonfly join the lineup, with Redis-compatible backups, imports and drills. Teams and Resend extend notification delivery.

Explore managed data

The panel you'll actually use.

Redrawn here from the real dashboard, numbers moving. Everything on this page has a screen like these behind it.

Admin's WorkspaceOWNER FilterWorkspace Admin's WorkspaceProject AnySystem / Monitoring Search ⌘K

System

Activity

Monitoring

Doctor

Docker

Servers

Users

Settings

Live Monitoring & Telemetry

Real-time host, cluster nodes, container metrics and alerts.

Host CPU

8 cores

load avg 1.07 · total 5.5%

Host memory

16%

2.7 GB / 16.8 GB

Disk storage

30%

117.5 GB free

Active workloads

8 services · 3 databases

n8n

n8n-75

running

CPU

0.60 %

Memory

346 MB

Directus

directus-77

running

CPU

2.63 %

Memory

232 MB

Next.js Demo

nextjs-demo-118

running

CPU

0.03 %

Memory

42 MB

Uptime Kuma

uptime-kuma-41

running

CPU

0.24 %

Memory

88 MB

IT-Tools

it-tools-38

running

CPU

0.02 %

Memory

15 MB

postgres

running

CPU

0.03 %

Memory

74 MB

Host, node and per-container telemetry every few seconds, with limits you can change in place.

What a deploy actually does.

Triggered by the panel, a webhook, the CLI, a cron job or a template install. Ten stages, and your site stays up through all of them.

01of 10

Queued

A worker slot claims the deployment atomically and snapshots the build config plus a fingerprint of your env keys — never the values.

→ deployment #48 queued · slot-1 claimed

02of 10

Recovered, if it has to be

Builds still marked building after 45 minutes are requeued on boot, so a panel restart mid-build recovers instead of leaving a ghost.

→ requeued 1 stale build on boot

03of 10

Prepare

Image deploys pull, and a rollback pins the exact digest. Repo deploys check out the commit with the token scrubbed from every log line.

→ checkout 9f3c1ab · creds scrubbed

04of 10

Environment

Project vars, then service vars, then attached database URLs. Infisical and Doppler references resolve at deploy time and are never stored.

→ env: 14 keys · DATABASE_URL injected

05of 10

Build

Your Dockerfile through buildx, Nixpacks when there isn't one, PM2 on the host, or docker compose up --build. The manifest fills any gaps.

→ buildx · 11/14 layers cached

06of 10

Boot beside the old one

The new container starts with secrets from a 0600 env-file that's deleted right after start. The old container keeps serving.

→ api-green up · api-blue serving

07of 10

Healthcheck

Container liveness and an HTTP probe against the new container's network IP, retried with a fresh timeout per attempt for up to five minutes.

→ GET /healthz → 200 (3/3)

08of 10

Cut over

Only after the probe passes: pin the digest, assign the domain, flip Traefik, wait two seconds, then retire the previous container.

→ route flipped → api-green

09of 10

Or fail safely

If anything fails, the new runtime is torn down and the old one keeps serving. Only the deployment is marked failed — not your site.

→ deploy #49 failed · api-green still live

10of 10

Cancel any time

The pipeline re-reads its own status at every checkpoint and tears down partial work when you cancel.

→ deploy #50 cancelled at build

What a deploy actually does.

Triggered by the panel, a webhook, the CLI, a cron job or a template install. Ten stages, and your site stays up through all of them.

01of 10

Queued

A worker slot claims the deployment atomically and snapshots the build config plus a fingerprint of your env keys — never the values.

→ deployment #48 queued · slot-1 claimed

02of 10

Recovered, if it has to be

Builds still marked building after 45 minutes are requeued on boot, so a panel restart mid-build recovers instead of leaving a ghost.

→ requeued 1 stale build on boot

03of 10

Prepare

Image deploys pull, and a rollback pins the exact digest. Repo deploys check out the commit with the token scrubbed from every log line.

→ checkout 9f3c1ab · creds scrubbed

04of 10

Environment

Project vars, then service vars, then attached database URLs. Infisical and Doppler references resolve at deploy time and are never stored.

→ env: 14 keys · DATABASE_URL injected

05of 10

Build

Your Dockerfile through buildx, Nixpacks when there isn't one, PM2 on the host, or docker compose up --build. The manifest fills any gaps.

→ buildx · 11/14 layers cached

06of 10

Boot beside the old one

The new container starts with secrets from a 0600 env-file that's deleted right after start. The old container keeps serving.

→ api-green up · api-blue serving

07of 10

Healthcheck

Container liveness and an HTTP probe against the new container's network IP, retried with a fresh timeout per attempt for up to five minutes.

→ GET /healthz → 200 (3/3)

08of 10

Cut over

Only after the probe passes: pin the digest, assign the domain, flip Traefik, wait two seconds, then retire the previous container.

→ route flipped → api-green

09of 10

Or fail safely

If anything fails, the new runtime is torn down and the old one keeps serving. Only the deployment is marked failed — not your site.

→ deploy #49 failed · api-green still live

10of 10

Cancel any time

The pipeline re-reads its own status at every checkpoint and tears down partial work when you cancel.

→ deploy #50 cancelled at build

Swipe through the ten stages.

A platform, not a pile of scripts.

See the full inventory

It replaces the docker run invocations, nginx vhosts, certbot cron jobs and pg_dump scripts — and the wiki page nobody updated since the last migration.

From a push, an image or a template to a healthy container — and back again by digest.

Three service types: Docker images (built or pulled), PM2-managed Node processes, and Docker Compose stacks with an ndcmp- project prefix — first-class, not bolted on.
Git, registry, or hub: Use a GitHub App, PAT or SSH deploy key, pull from private registries, or start from 305 hub templates — 276 runtime-certified. GitHub Apps use short-lived repository-scoped tokens and can report deploy status and PR preview URLs.
Build placement and image transfer: Build on the runtime host, the panel or a dedicated build server. Move images to nodes over the sealed agent channel or through an operator-bound registry. A failed build or transfer leaves the running version serving.
Docker Swarm, opt-in: Operators can enable Swarm per Docker service for rolling, start-first updates and replicas. Traefik remains the public entry point. Compose, PM2, volumes and managed databases keep their separate runtimes.
The .ninedeploy manifest: Commit build, runtime, routing, storage and alert config next to the code. Panel beats manifest beats auto-detect, and a secret scanner refuses credential-shaped values before they reach git.
Rollback and cancel: Every deployment records the exact image digest, so a rollback redeploys that precise image — never a moved :latest. In-flight deploys cancel at any stage.
Watch paths and cron: Monorepo-friendly webhooks that only fire on watched path globs. Cron-scheduled redeploys and container commands with run history.
Live build logs: WebSocket log streaming with backlog replay and on-disk log persistence. Operators get real TTY terminals for services, databases and managed containers, locally and on nodes, with resize and audited session metadata.
HMAC webhooks: GitHub, GitLab and Gitea verification, branch matching and replay dedup — a captured push can't flood the deploy queue.
Ephemeral PR previews: A pull request spins up service-pr-123 with the parent's non-secret config, capped by a max-active limit and destroyed when the PR closes.
One-click demo stack: A pre-configured stack with PostgreSQL, a Next.js standalone container and a Next.js PM2 cluster — to see the whole loop in a minute.

Click it, type it, script it, or ask an agent.

40+ commands, one token in ~/.ninedeploy.

Create services with a wizard, stream a running deploy, cancel it, roll it back. The CLI speaks the same REST API as the dashboard.

terminal

npm install -g ninedeploy

ninedeploy login                   # authenticate against your panel
ninedeploy services create         # interactive wizard
ninedeploy services deploy 12
ninedeploy deploys watch 12 480    # stream a running deployment
ninedeploy env set 12 NODE_ENV production
ninedeploy domains add 12 api.example.com
ninedeploy system dashboard        # live health board

Raw Docker, a managed PaaS, or the one in between.

The honest pitch: you get the managed-platform experience and keep the bill and the data of a box you rent.

Capability	NineDeploy	Raw Docker	Managed PaaS
Your data stays on your server	Always	Yes	Vendor cloud
Zero-downtime deploys	Blue-green	DIY scripts	Yes
Managed databases and backups	11 engines, S3	Manual	Metered
Automatic HTTPS and wildcard domains	ACME DNS-01	Manual proxy	Yes
AI agents can operate it	62 MCP tools	Shell access	Varies
Price at 50 services	$0, your hardware	$0, your weekends	Per seat, per GB
Lock-in	None, MIT	None	Proprietary

One process. One file. The Docker socket.

Start with one host, then add nodes for workloads, databases or builds. The panel keeps its state in SQLite; Docker Swarm is an optional orchestrator for services that need rolling updates and replicas. Upgrades snapshot your data first and gate on a health endpoint.

It is not Kubernetes, and doesn't pretend to be.

NineDeploy

Self-hosted deployment platform

MIT

Release: v0.15.8
Runtime: Node ≥ 22.13 + Docker
Panel state: 1 SQLite file, 66 tables
API contract: OpenAPI 3.1 + typed SDK
Database engines: 11
Templates: 305 (276 certified)
MCP tools: 62
Secrets: AES-256-GCM, rotatable keys
Releases: Sigstore-signed, SLSA provenance

Serial: your-server-01. Made by OXOGNET OÜ, Estonia.

The fine print, in large print.

Finding these out during an incident is worse than reading them here. The architecture doc tracks each one against the code and marks it when it closes.

Agent transport has no TLS of its own.
It fails closed and uses sealed operations, but keep worker nodes on a private network or VPN.
Node capabilities depend on the agent version.
Updated nodes support Nixpacks and Railpack. Missing capabilities or disabled node switches give an explicit refusal. PM2 remains on the panel host.
Remote health is container state, not an HTTP probe.
Probing would mean publishing ports on the node's public interface. The deploy log says so.
PM2 services have no blue-green window.
They stop, then start, with automatic rollback on failure.

Your server.
Your rules.

One command, one admin account, one dashboard. The first account you create becomes the instance operator.

$curl -fsSL https://ninedeploy.com/install.sh | bash

Recommended for production on Linux. Provisions Node and Docker on Debian/Ubuntu, verifies the release checksum, and starts a hardened systemd service. Read the script

Read the install guide Star it on GitHub

Ship likeyou mean it.

305 apps you can run before your coffee cools.

More apps. More ways to deploy.

305 one-click templates

Build and run across nodes

11 managed database engines

The panel you'll actually use.

What a deploy actually does.

Queued

Recovered, if it has to be

Prepare

Environment

Build

Boot beside the old one

Healthcheck

Cut over

Or fail safely

Cancel any time

What a deploy actually does.

Queued

Recovered, if it has to be

Prepare

Environment

Build

Boot beside the old one

Healthcheck

Cut over

Or fail safely

Cancel any time

A platform, not a pile of scripts.

Click it, type it, script it, or ask an agent.

40+ commands, one token in ~/.ninedeploy.

Raw Docker, a managed PaaS, or the one in between.

One process. One file. The Docker socket.

The fine print, in large print.

Your server.Your rules.

Your server.
Your rules.