{
  "slug": "dokploy",
  "repo": "dokploy/dokploy",
  "name": "Dokploy",
  "tagline": "Effortless deployment and management of applications, databases, and Docker Swarm clusters.",
  "category": "developer-tools",
  "license_spdx": "Apache-2.0",
  "stars": 38275,
  "contributors": 58,
  "last_push_days": 0,
  "latest_release": "v0.9.18",
  "safety_score": 86,
  "verdict": "healthy",
  "risk_reasons": [
    "Active developer activity and positive OpenSSF Scorecard evaluation."
  ],
  "scorecard": 7.7,
  "components": {
    "security_health": 80,
    "maintenance": 92,
    "community": 86,
    "releases": 88
  },
  "language": "TypeScript",
  "self_host_difficulty": "Medium",
  "install_commands": {
    "docker": "docker run -d --name dokploy -p 3000:3000 -v /var/run/docker.sock:/var/run/docker.sock -v dokploy-data:/etc/dokploy --restart unless-stopped dokploy/dokploy:latest"
  },
  "ai_report": "Dokploy is a lightweight, open-source deployment manager and PaaS alternative designed to streamline application delivery, database provisioning, and Docker Swarm management. Engineered entirely in modern TypeScript with a Node.js runtime and Next.js interface, Dokploy integrates Traefik as its default reverse proxy for automated SSL termination and dynamic traffic routing. The platform enables developers to deploy raw Docker Compose stacks, multi-language Git repositories via Nixpacks or Dockerfiles, and managed databases with push-to-deploy Git hooks.\n\nDokploy's security posture is built upon role-based workspace management, encrypted credential storage, and automated Traefik middleware enforcement. The codebase registers an OpenSSF Scorecard rating of 7.7, benefiting from automated code scanning with CodeQL and dependabot dependency tracking. However, because Dokploy interfaces directly with /var/run/docker.sock to provision and tear down worker containers, any potential vulnerability in the administrative API could lead to container escape or host compromise. The development team has consistently shown high responsiveness to security issues, rapidly patching reported authorization edge cases.\n\nWhen self-hosting Dokploy in production, operators should isolate the management interface on private VPN subnets (such as WireGuard or Tailscale) or protect it behind an identity-aware proxy with hardware MFA tokens. Volume mounts for /etc/dokploy should reside on encrypted, snapshot-backed block storage to ensure zero downtime recovery of Traefik configs and deployment manifests. Dokploy earns a Healthy verdict and an 86/100 Safety Score, offering a modern, minimal, and resource-efficient PaaS tailored for lean development teams.",
  "scanned_at": "2026-11-06T08:58:12.201Z",
  "website_url": "https://dokploy.com",
  "ai_report_status": "approved",
  "created_at": "2026-10-01T12:00:00.000Z",
  "updated_at": "2026-10-01T12:00:00.000Z",
  "setup_steps": {
    "status": "none",
    "steps": [],
    "source_url": "https://github.com/dokploy/dokploy#readme",
    "model": "ag/gemini-3.8-flash-high",
    "written_at": "2026-11-05T17:49:31.161Z",
    "reason": "no self-host instructions in the README"
  },
  "archived": false,
  "unlisted": false
}