Introduction

NineDeploy is a self-hosted PaaS for servers you own. The dashboard, CLI, typed SDK and MCP server share the API. Docker, PM2 and Compose runtimes sit alongside managed databases, encrypted backups, GitHub Apps, audited terminals and opt-in traffic analytics. Panel state lives in one SQLite database.

The shape of the system

• Core server (Fastify + Microkernel) runs bare-metal under systemd for direct Docker daemon + PM2 access — or in a single Docker container.
• Remote hosts run the same binary in agent mode (NINEDEPLOY_AGENT=1) and execute a fixed table of typed, sanitized operations.
• All application containers live on a shared Docker network; only Traefik is exposed on :80/:443.
• The web dashboard is served directly by the API process — one process, one port, zero orchestration overhead.

Design principles

• No host ports exposed on apps — healthchecks probe internal container IPs, Traefik routes traffic by hostname.
• Every subprocess has a hard timeout with tree-kill; a hung build or script can never stall the deployment queue.
• Secrets are AES-256-GCM encrypted in versioned envelopes with a rotatable key ring.
• Coverage floors are enforced in CI for every package: 100% on the schemas, SDK, database and plugin-sdk packages, 97.5% line coverage on the dashboard and 95% on the server, with the CLI and MCP floors (and the reasoning for each) recorded in their vitest configs.