Three service types
Docker images (built or pulled), PM2-managed Node processes, and Docker Compose stacks with an ndcmp- project prefix — first-class, not bolted on.
Everything, inventoried.
No paid tiers gating features: if it's on this page, it's in the box. Grouped the way the dashboard's icon rail groups them.
36 capabilities across four areas
Deploy
From a push, an image or a template to a healthy container — and back again by digest.
Git, registry, or hub
Use a GitHub App, PAT or SSH deploy key, pull from private registries, or start from 305 hub templates — 276 runtime-certified. GitHub Apps use short-lived repository-scoped tokens and can report deploy status and PR preview URLs.
Build placement and image transfer
Build on the runtime host, the panel or a dedicated build server. Move images to nodes over the sealed agent channel or through an operator-bound registry. A failed build or transfer leaves the running version serving.
Docker Swarm, opt-in
Operators can enable Swarm per Docker service for rolling, start-first updates and replicas. Traefik remains the public entry point. Compose, PM2, volumes and managed databases keep their separate runtimes.
The .ninedeploy manifest
Commit build, runtime, routing, storage and alert config next to the code. Panel beats manifest beats auto-detect, and a secret scanner refuses credential-shaped values before they reach git.
Rollback and cancel
Every deployment records the exact image digest, so a rollback redeploys that precise image — never a moved :latest. In-flight deploys cancel at any stage.
Watch paths and cron
Monorepo-friendly webhooks that only fire on watched path globs. Cron-scheduled redeploys and container commands with run history.
Live build logs
WebSocket log streaming with backlog replay and on-disk log persistence. Operators get real TTY terminals for services, databases and managed containers, locally and on nodes, with resize and audited session metadata.
HMAC webhooks
GitHub, GitLab and Gitea verification, branch matching and replay dedup — a captured push can't flood the deploy queue.
Ephemeral PR previews
A pull request spins up service-pr-123 with the parent's non-secret config, capped by a max-active limit and destroyed when the PR closes.
One-click demo stack
A pre-configured stack with PostgreSQL, a Next.js standalone container and a Next.js PM2 cluster — to see the whole loop in a minute.
Data
11 database engines, encrypted backups and volumes — on your panel host or nodes.
11 managed engines
PostgreSQL (with pgvector), MySQL, MariaDB, Redis, Valkey, KeyDB, Dragonfly, MongoDB, ClickHouse, Meilisearch and RabbitMQ. KeyDB and Dragonfly include Redis-compatible connection strings, RDB backup/restore, imports and drills.
Databases and volumes on nodes
Place managed databases on a node, attach services on the same host, and back up or restore node volumes over the sealed channel. Node databases support logs, limits, backups, imports and shells; Studio, PgBouncer and public access stay on the panel host.
Public access and dump import
Opt-in TCP access for eight database engines on the panel host, through a dedicated sidecar and a required IP allowlist. Import resumable uploads or S3 dumps with a pre-import safety backup.
Injected connection strings
Attach a database to a service and its connection string arrives as environment on every deploy — resolved fresh from the vault, never pasted once and forgotten.
Encrypted backups
Dumps and volume archives are sealed with AES-256-GCM as they're written. Restore and download decrypt transparently.
Off-site to any S3
Cloudflare R2, AWS S3, MinIO, Wasabi or Backblaze B2 through a dependency-free SigV4 client, with retention pruning per destination.
Volume snapshots
Snapshot, restore and download any managed volume through a throwaway sidecar. Restores are tar-slip validated and refuse to run under a live service.
Container file manager
Browse a container's filesystem in the browser, edit files, and drag and drop uploads and downloads.
One SQLite core
All panel state in one .data directory — no PostgreSQL or Redis to babysit for the panel itself. Migrations apply on every start.
Network
Traefik in front, certificates handled, nothing exposed you didn't ask for.
Traefik ingress and middlewares
Dynamic routing with IP allowlists, rate limits, basic auth, www→apex redirects and custom headers. Only 80 and 443 are open on the host.
Wildcard HTTPS
ACME DNS-01 through Cloudflare, DigitalOcean, Hetzner, Linode, Gandi or DuckDNS. One *.your-domain certificate; {slug}.your-domain for every service.
Bring your own proxy config and TLS
Upload certificates with encrypted private keys, or add custom- routers, middlewares and services. Traefik validates custom config before applying it and reverts a rejected change.
Traffic analytics
Opt-in requests, status classes and latency charts per service and domain. Traefik access logs omit client IP, path, query and headers; rollups keep 48 hours of minute data and 30 days of hourly data by default.
Cloudflare Tunnels
Expose services from a host with no inbound ports, with managed cloudflared tunnels straight from the dashboard.
Multi-server agents
Remote hosts advertise their agent version and capabilities. Updated nodes support Docker and Compose, Nixpacks/Railpack builds, private clones and volumes. Each node has its own Traefik; PM2 remains on the panel host.
Topology view
Interactive diagrams of services, databases and routes, with live inspectors and one-click endpoint copying.
Direct port publishing
Expose a service on a dedicated TCP port when you need to. Reserved ports (the panel, 22, 80, 443) are refused outright.
System
Teams, secrets, alerts and every way in — a web panel, a CLI, an SDK and an MCP server.
Workspaces and roles
Owner, admin, member and viewer, enforced at the route layer. Project and environment grants can raise a user's role or give guests access to selected resources without a workspace seat. Instance operator is a separate privilege.
Serious auth
Argon2id, passkeys (WebAuthn), TOTP with replay protection, OIDC for Google, GitHub, Okta and Keycloak, and a 5-fails-then-15-minutes lockout.
Pinned Git SSH host keys
Opt in per deploy-key source: a successful panel clone learns the Git host's keys and later clones refuse a changed key. Disabling pinning or resetting keys requires an interactive password re-check and is audited.
Secrets vault
AES-256-GCM in versioned envelopes with a rotatable master-key ring. Resolve Infisical, Doppler, HashiCorp Vault / OpenBao and AWS Secrets Manager references at deploy time.
Alerts and notifications
Rules on CPU, memory, disk, cert expiry and offline nodes, delivered to Telegram, Discord, Slack, Microsoft Teams, ntfy, SMTP, Resend or webhooks. Password resets and invitations can use Resend, with SMTP preferred when both are configured.
Log drains and audit
Forward logs to Loki, Datadog, Vector or syslog. Every destructive action lands in the audit log.
Plugins on a microkernel
An event bus, hook pipeline, config center and menu registry; write plugins against @ninedeploy/plugin-sdk.
Every interface
Web dashboard with a ⌘K palette, the ninedeploy CLI, a typed REST SDK, an authenticated OpenAPI 3.1 document, and 62 MCP tools including generated read-only tools and API search.
Convinced? It installs in one command.
Install NineDeploy