Built for a team, guarded like root — because it is
The platform drives the Docker daemon on your server, so admin access to the portal is root on the machine. Everything here follows from taking that seriously: what you deploy is judged before it runs, and who can do what is explicit.
What you get
Your Compose file, judged
It is never run as written. Privileged containers, host namespaces and networking, added capabilities, weakened confinement, and bind mounts outside your files are refused.
Roles that mean something
Members deploy, operate, and configure. Owners and admins also hold what cannot be undone: enrolling or removing servers, deleting, credentials, and API tokens.
Passkeys and two-factor
Sign in with a passkey, or add a time-based second factor to your password. Enrolling either asks for your password again.
An audit log
Who did what, to what, and from where — searchable by action, actor, and date, for the organization’s owners.
In detail
- One account can belong to several organizations, with a switcher in the portal; invitations are sent by email.
- See every session signed in to your account and revoke any of them.
- API tokens carry their creator’s live role and stop working the moment that person leaves the organization.
- Archive extraction refuses the whole upload on the first entry that would land outside its destination.
- The compose sanitiser, the archive guard, and the routing rules each have a regression suite whose job is to stay unbroken.
Works well with
Environment variables
Encrypted, write-only configuration that never touches the disk.
Your own servers
One command connects a VPS you already own. Nothing inbound is opened.
Git deployments
Push to your branch and it ships itself — built, health-gated, and rollback-ready.
Your server is ready when you are
Create an account, connect a VPS, and ship your first application.