{
  "slug": "coolify",
  "repo": "coollabsio/coolify",
  "name": "Coolify",
  "tagline": "An open-source and self-hostable Heroku, Netlify, and Vercel alternative.",
  "category": "developer-tools",
  "license_spdx": "Apache-2.0",
  "stars": 65699,
  "contributors": 145,
  "last_push_days": 0,
  "latest_release": "v4.0.0-beta.385",
  "safety_score": 90.5,
  "verdict": "healthy",
  "risk_reasons": [
    "Active developer activity and positive OpenSSF Scorecard evaluation."
  ],
  "scorecard": 7.9,
  "components": {
    "security_health": 84,
    "maintenance": 95,
    "community": 94,
    "releases": 92
  },
  "language": "PHP / Laravel",
  "self_host_difficulty": "Medium",
  "install_commands": {
    "docker": "docker run -d --name coolify -p 8000:8000 -v /var/run/docker.sock:/var/run/docker.sock -v /data/coolify:/data/coolify ghcr.io/coollabsio/coolify:latest"
  },
  "ai_report": "Coolify is an all-in-one open-source Platform-as-a-Service (PaaS) alternative to proprietary platforms like Heroku, Netlify, and Render. Architected with a modern PHP and Laravel backend coupled with a reactive frontend and Livewire components, Coolify orchestrates applications, databases, and scheduled jobs across multiple remote servers via Docker and Traefik. It features native Git integration, automatic SSL certificate provisioning through Let's Encrypt, and comprehensive deployment monitoring for both standalone VPS instances and clustered Docker Swarm environments.\n\nFrom an engineering and security perspective, Coolify operates as a centralized management plane communicating with remote worker nodes via secure SSH tunnels and localized Docker daemon sockets. The project maintains an OpenSSF Scorecard of 7.9, demonstrating automated GitHub Actions workflows, active vulnerability reporting channels, and routine container image scanning. Because the management daemon requires root-level Docker socket access to spawn containers and manage virtual networks, securing the host operating system, restricting access to port 8000, and enforcing SSH key-only authentication are critical defensive prerequisites.\n\nOperational self-hosting recommendations center on perimeter isolation and proactive database backups. Administrators should bind Coolify's web UI behind a hardened reverse proxy with strict multi-factor authentication (MFA) enabled for all administrative accounts. Furthermore, internal SQLite/PostgreSQL configuration databases storing server credentials must be scheduled for automated off-site snapshotting. Coolify achieves a Healthy verdict with a Safety Score of 90.5/100, representing one of the most capable and rapidly improving developer infrastructure platforms in the open-source ecosystem.",
  "scanned_at": "2026-11-06T08:58:11.469Z",
  "website_url": "https://coolify.io",
  "ai_report_status": "approved",
  "created_at": "2026-10-01T12:00:00.000Z",
  "updated_at": "2026-10-01T12:00:00.000Z",
  "setup_steps": {
    "status": "none",
    "steps": [],
    "source_url": "https://github.com/coollabsio/coolify#readme",
    "model": "ag/gemini-3.8-flash-high",
    "written_at": "2026-11-05T17:49:28.876Z",
    "reason": "no self-host instructions in the README"
  },
  "archived": false,
  "unlisted": false
}