v0.18.26Features, fixes and upgrade notes

Ship likeyou mean it.

Push a branch. NineDeploy builds and deploys it on your server, with automatic TLS and healthchecked rollouts. Your databases, backups and certificates live alongside it.

$curl -fsSL https://ninedeploy.com/install.sh | bash

Read the docsMIT licensed. No external database. No vendor.

Your users

api.example.com

Traefik:443

route →api-blue

api-bluelive

commit 4b1e07c0 req

api-greenstandby

commit —

Try breaking it. Traffic stays where it is.

ninedeploy deploys watch api

12:00:58→ api-blue serving 4b1e07c · healthy

322 apps you can run before your coffee cools.

Browse the template hub

Current release · v0.18.26

More control. Clearer limits.

Release notes

HTTPS from the first boot

Set your panel domain and ACME email in the installer. A one-time setup token protects the first admin, and the stable channel lets you choose a slower release cadence.

Install on your own domain

Backups proven to restore

Restore verification covers all 11 managed engines in isolated copies. PostgreSQL adds point-in-time recovery into a new database. Structural drills remain a separate check.

Explore recovery

Know what works where

322 templates, protected production lanes, CI runners and remote MCP. The runtime support matrix states exactly where canaries, autoscaling and scale to zero apply.

Check runtime support

The panel you'll actually use.

Redrawn here from the real dashboard, numbers moving. Everything on this page has a screen like these behind it.

Admin's WorkspaceOWNER FilterWorkspace Admin's WorkspaceProject AnySystem / Monitoring Search ⌘K

System

Activity

Monitoring

Doctor

Docker

Servers

Users

Settings

Live Monitoring & Telemetry

Real-time host, cluster nodes, container metrics and alerts.

Host CPU

8 cores

load avg 1.07 · total 5.5%

Host memory

16%

2.7 GB / 16.8 GB

Disk storage

30%

117.5 GB free

Active workloads

8 services · 3 databases

n8n

n8n-75

running

CPU

0.60 %

Memory

346 MB

Directus

directus-77

running

CPU

2.63 %

Memory

232 MB

Next.js Demo

nextjs-demo-118

running

CPU

0.03 %

Memory

42 MB

Uptime Kuma

uptime-kuma-41

running

CPU

0.24 %

Memory

88 MB

IT-Tools

it-tools-38

running

CPU

0.02 %

Memory

15 MB

postgres

running

CPU

0.03 %

Memory

74 MB

Host, node and per-container telemetry every few seconds, with limits you can change in place.

What a deploy actually does.

Triggered by the panel, a webhook, the CLI, a cron job or a template install. Ten stages, and your site stays up through all of them.

01of 10

Queued

A worker slot claims the deployment atomically and snapshots the build config plus a fingerprint of your env keys — never the values.

→ deployment #48 queued · slot-1 claimed

02of 10

Recovered, if it has to be

Builds still marked building after 45 minutes are requeued on boot, so a panel restart mid-build recovers instead of leaving a ghost.

→ requeued 1 stale build on boot

03of 10

Prepare

Image deploys pull, and a rollback pins the exact digest. Repo deploys check out the commit with the token scrubbed from every log line.

→ checkout 9f3c1ab · creds scrubbed

04of 10

Environment

Project vars, then service vars, then attached database URLs. Infisical and Doppler references resolve at deploy time and are never stored.

→ env: 14 keys · DATABASE_URL injected

05of 10

Build

Your Dockerfile through buildx, Nixpacks when there isn't one, PM2 on the host, or docker compose up --build. The manifest fills any gaps.

→ buildx · 11/14 layers cached

06of 10

Boot beside the old one

The new container starts with secrets from a 0600 env-file that's deleted right after start. The old container keeps serving.

→ api-green up · api-blue serving

07of 10

Healthcheck

Container liveness and an HTTP probe against the new container's network IP, retried with a fresh timeout per attempt for up to five minutes.

→ GET /healthz → 200 (3/3)

08of 10

Cut over

Only after the probe passes: pin the digest, assign the domain, flip Traefik, wait two seconds, then retire the previous container.

→ route flipped → api-green

09of 10

Or fail safely

If anything fails, the new runtime is torn down and the old one keeps serving. Only the deployment is marked failed — not your site.

→ deploy #49 failed · api-green still live

10of 10

Cancel any time

The pipeline re-reads its own status at every checkpoint and tears down partial work when you cancel.

→ deploy #50 cancelled at build

What a deploy actually does.

Triggered by the panel, a webhook, the CLI, a cron job or a template install. Ten stages, and your site stays up through all of them.

01of 10

Queued

A worker slot claims the deployment atomically and snapshots the build config plus a fingerprint of your env keys — never the values.

→ deployment #48 queued · slot-1 claimed

02of 10

Recovered, if it has to be

Builds still marked building after 45 minutes are requeued on boot, so a panel restart mid-build recovers instead of leaving a ghost.

→ requeued 1 stale build on boot

03of 10

Prepare

Image deploys pull, and a rollback pins the exact digest. Repo deploys check out the commit with the token scrubbed from every log line.

→ checkout 9f3c1ab · creds scrubbed

04of 10

Environment

Project vars, then service vars, then attached database URLs. Infisical and Doppler references resolve at deploy time and are never stored.

→ env: 14 keys · DATABASE_URL injected

05of 10

Build

Your Dockerfile through buildx, Nixpacks when there isn't one, PM2 on the host, or docker compose up --build. The manifest fills any gaps.

→ buildx · 11/14 layers cached

06of 10

Boot beside the old one

The new container starts with secrets from a 0600 env-file that's deleted right after start. The old container keeps serving.

→ api-green up · api-blue serving

07of 10

Healthcheck

Container liveness and an HTTP probe against the new container's network IP, retried with a fresh timeout per attempt for up to five minutes.

→ GET /healthz → 200 (3/3)

08of 10

Cut over

Only after the probe passes: pin the digest, assign the domain, flip Traefik, wait two seconds, then retire the previous container.

→ route flipped → api-green

09of 10

Or fail safely

If anything fails, the new runtime is torn down and the old one keeps serving. Only the deployment is marked failed — not your site.

→ deploy #49 failed · api-green still live

10of 10

Cancel any time

The pipeline re-reads its own status at every checkpoint and tears down partial work when you cancel.

→ deploy #50 cancelled at build

Swipe through the ten stages.

A platform, not a pile of scripts.

See the full inventory

It replaces the docker run invocations, nginx vhosts, certbot cron jobs and pg_dump scripts — and the wiki page nobody updated since the last migration.

From a push, an image or a template to a healthy container — and back again by digest.

Three service types: Docker images (built or pulled), PM2-managed Node processes, and Docker Compose stacks with an ndcmp- project prefix — first-class, not bolted on.
Git, registry, or hub: Use a GitHub App, PAT or SSH deploy key, pull from private registries, or start from 322 hub templates — 293 runtime-certified. GitHub Apps use short-lived repository-scoped tokens and can report deploy status and PR preview URLs.
Build placement and image transfer: Build on the runtime host, the panel or a dedicated build server. Move images to nodes over the sealed agent channel or through an operator-bound registry. A failed build or transfer leaves the running version serving.
Docker Swarm, opt-in: Operators can enable Swarm per Docker service for rolling, start-first updates and replicas. Traefik remains the public entry point. Compose, PM2, volumes and managed databases keep their separate runtimes.
The .ninedeploy manifest: Commit build, runtime, routing, storage and alert config next to the code. Panel beats manifest beats auto-detect, and a secret scanner refuses credential-shaped values before they reach git.
Rollback and cancel: Manual rollback redeploys a recorded commit or image with current settings and environment. Recorded Docker artifacts and inline Compose releases offer explicit promotion and restore paths with documented limits. In-flight deploys cancel at any stage.
Watch paths and cron: Monorepo-friendly webhooks that only fire on watched path globs. Cron-scheduled redeploys and container commands with run history.
Live build logs: WebSocket log streaming with backlog replay and on-disk log persistence. Operators get real TTY terminals for services, databases and managed containers, locally and on nodes, with resize and audited session metadata.
HMAC webhooks: GitHub, GitLab and Gitea verification, branch matching and replay dedup — a captured push can't flood the deploy queue.
Ephemeral PR previews: A pull request spins up service-pr-123 with the parent's non-secret config, capped by a max-active limit and destroyed when the PR closes.
Protected lanes and approval gates: Production lanes can hide variables and logs from members while still allowing deploys, hold changes for an admin's approval, and apply deploy freezes. Pushes, schedules and deploy hooks follow the same gate.
Canaries, replicas and autoscaling: Docker services can use staged traffic, resource or request-rate scaling, and scale to zero on supported placements. Node canaries and RPS scaling require explicit capabilities; node sleep/wake remains work in progress. Swarm uses native rolling updates and its configured replicas.
CI on your own runners: Run pipeline jobs on enrolled runners, inspect attempts and logs, and require CI before deployment. Cancellation, lease expiry, retry and capacity are tracked by the panel.
Deploy without a repository: Upload source archives, use an inline Dockerfile, paste a Compose stack, or trigger image redeploys from registry webhooks. File mounts, deploy hooks and container options have explicit operator and runtime boundaries.
One-click demo stack: A pre-configured stack with PostgreSQL, a Next.js standalone container and a Next.js PM2 cluster — to see the whole loop in a minute.

Click it, type it, script it, or ask an agent.

The panel API, from your terminal.

Create services with a wizard, stream a running deploy, cancel it, roll it back. The CLI speaks the same REST API as the dashboard.

terminal

npm install -g ninedeploy

ninedeploy login                   # authenticate against your panel
ninedeploy services create         # interactive wizard
ninedeploy services deploy 12
ninedeploy deploys watch 12 480    # stream a running deployment
ninedeploy env set 12 NODE_ENV production
ninedeploy domains add 12 api.example.com
ninedeploy system dashboard        # live health board

Raw Docker, a managed PaaS, or the one in between.

The honest pitch: you get the managed-platform experience and keep the bill and the data of a box you rent.

Capability	NineDeploy	Raw Docker	Managed PaaS
Your data stays on your server	Always	Yes	Vendor cloud
Zero-downtime deploys	Blue-green	DIY scripts	Yes
Managed databases and backups	11 engines, S3	Manual	Metered
Automatic HTTPS and wildcard domains	ACME DNS-01	Manual proxy	Yes
AI agents can operate it	64 MCP tools	Shell access	Varies
Price at 50 services	$0, your hardware	$0, your weekends	Per seat, per GB
Lock-in	None, MIT	None	Proprietary

One process. One file. The Docker socket.

Start with one host, then add nodes for workloads, databases or builds. The panel keeps its state in SQLite; Docker Swarm is an optional orchestrator for services that need rolling updates and replicas. Upgrades snapshot your data first and gate on a health endpoint.

It is not Kubernetes, and doesn't pretend to be.

NineDeploy

Self-hosted deployment platform

MIT

Release: v0.18.26
Runtime: Node ^22.23.4 || ^24.22.1 || ^26.12.1 + Docker
Panel state: 1 SQLite file, 97 tables
API contract: OpenAPI 3.1 + typed SDK
Database engines: 11
Templates: 322 (293 certified)
MCP tools: 64
Secrets: AES-256-GCM, rotatable keys
Releases: Sigstore-signed, SLSA provenance

Serial: your-server-01. Made by OXOGNET OÜ, Estonia.

The fine print, in large print.

Finding these out during an incident is worse than reading them here. The architecture doc tracks each one against the code and marks it when it closes.

Agent transport has no TLS of its own.
It fails closed and uses sealed operations, but keep worker nodes on a private network or VPN.
Node capabilities depend on the agent version.
Updated nodes support Nixpacks and Railpack. Missing capabilities or disabled node switches give an explicit refusal. PM2 remains on the panel host.
Runtime support varies by placement.
Node HTTP/TCP readiness is opt-in. Node scale to zero is still being built; Swarm uses its configured replicas and native rolling updates. Read the support matrix for the current boundaries.
PM2 services have no blue-green window.
They stop, then start, with automatic rollback on failure.

Your server.
Your rules.

One command, one admin account, one dashboard. The first account you create becomes the instance operator.

$curl -fsSL https://ninedeploy.com/install.sh | bash

Recommended for production on Linux with systemd. Provisions supported Node and Docker packages, verifies the release checksum, and prints a one-time first-admin setup token. Add --domain and --email for HTTPS from the first boot. Read the script

Read the install guide Star it on GitHub

Ship likeyou mean it.

322 apps you can run before your coffee cools.

More control. Clearer limits.

HTTPS from the first boot

Backups proven to restore

Know what works where

The panel you'll actually use.

What a deploy actually does.

Queued

Recovered, if it has to be

Prepare

Environment

Build

Boot beside the old one

Healthcheck

Cut over

Or fail safely

Cancel any time

What a deploy actually does.

Queued

Recovered, if it has to be

Prepare

Environment

Build

Boot beside the old one

Healthcheck

Cut over

Or fail safely

Cancel any time

A platform, not a pile of scripts.

Click it, type it, script it, or ask an agent.

The panel API, from your terminal.

Raw Docker, a managed PaaS, or the one in between.

One process. One file. The Docker socket.

The fine print, in large print.

Your server.Your rules.

Your server.
Your rules.