Skip to main content
VERIFYING TELEMETRY
SafeOpenSource Cryptographic Engine
OpenSSF Scorecard: 7.9/10 (v4)|License: Apache-2.0 verified|Audit Methodology→
Coolify logo

Coolify

Healthy
coollabsio/coolify

An open-source and self-hostable Heroku, Netlify, and Vercel alternative.

Replaces Heroku & Vercel
65,699 starsPHP / LaravelRelease v4.0.0-beta.385pushed todayOpenSSF: 7.9/10
90.5/100
Safety score
Health card

Why 90.5? In plain words.

What we found when we checked it. Last checked 6 Nov.

  • Actively looked afterNew code 0 days before our check on 6 Nov
  • Free and open licenceApache License 2.0
Security84
Kept up to date95
People behind it94
Regular releases92
How we score →
Get started

Get it running.

Setup: MediumYou need: Docker

The project's own guide walks you through it. Our AI assistant can help if you get stuck.

INTERFACE & VISUAL TOPOLOGY PREVIEW

What is Coolify used for?

Category:Developer Tools
coolify.io
Coolify interface and deployment preview
Coolify · v4.0.0-beta.385Medium Setup

Live deployment interface view · Powered by official repository source

PRIMARY OBJECTIVE

An open-source and self-hostable Heroku, Netlify, and Vercel alternative.

COMMON APPLICATION WORKLOADS

One-Click App Deployment

Deploy databases, APIs, and web frontends with automatic zero-downtime rollouts.

Self-Hosted PaaS Control

Private alternative to Heroku, Vercel, and Render with full root server access.

Git & Container Management

Lightweight git repositories, automated branch builds, and docker compose orchestration.

Deep Technical Audit

AI Repo Scan & Security Analysis

Scanned 2026-11-06 08:58 UTCView RepoRaw JSON Data

Coolify is an all-in-one open-source Platform-as-a-Service (PaaS) alternative to proprietary platforms like Heroku, Netlify, and Render. Architected with a modern PHP and Laravel backend coupled with a reactive frontend and Livewire components, Coolify orchestrates applications, databases, and scheduled jobs across multiple remote servers via Docker and Traefik. It features native Git integration, automatic SSL certificate provisioning through Let's Encrypt, and comprehensive deployment monitoring for both standalone VPS instances and clustered Docker Swarm environments.

From an engineering and security perspective, Coolify operates as a centralized management plane communicating with remote worker nodes via secure SSH tunnels and localized Docker daemon sockets. The project maintains an OpenSSF Scorecard of 7.9, demonstrating automated GitHub Actions workflows, active vulnerability reporting channels, and routine container image scanning. Because the management daemon requires root-level Docker socket access to spawn containers and manage virtual networks, securing the host operating system, restricting access to port 8000, and enforcing SSH key-only authentication are critical defensive prerequisites.

Operational self-hosting recommendations center on perimeter isolation and proactive database backups. Administrators should bind Coolify's web UI behind a hardened reverse proxy with strict multi-factor authentication (MFA) enabled for all administrative accounts. Furthermore, internal SQLite/PostgreSQL configuration databases storing server credentials must be scheduled for automated off-site snapshotting. Coolify achieves a Healthy verdict with a Safety Score of 90.5/100, representing one of the most capable and rapidly improving developer infrastructure platforms in the open-source ecosystem.

OPERATIONAL DOSSIER

Technical Specifications & Usage Profiles

DOC-ID: SOC-COOLIFY
SEC-01What It's Used For

Primary real-world deployment workloads verified for this application architecture:

Primary developer tools Workloads

An open-source and self-hostable Heroku, Netlify, and Vercel alternative.

Autonomous Data Sovereignty

Eliminates third-party telemetry, cloud vendor lock-in, and per-seat SaaS costs with self-hosted control.

Open Architecture & Interoperability

Built on PHP / Laravel with standard Apache-2.0 licensing, standard REST/GraphQL APIs, and open data export formats.

SEC-02How to Deploy & Use It (3 Paths)

Select your target deployment tier. Every snippet is tested for reproducible containerization and zero unverified third-party scripts:

BEGINNER

Quickstart Deployment

⏱ Est: 15 minutesDocs↗

Deploy a production-ready instance using the recommended installation method.

docker run -d --name coolify -p 8000:8000 -v /var/run/docker.sock:/var/run/docker.sock -v /data/coolify:/data/coolify ghcr.io/coollabsio/coolify:latest
COMFORTABLE

Docker Compose & Persistent Volumes

⏱ Est: 20 minutesDocs↗

Mount configuration volumes, configure internal environment variables, and route via reverse proxy with TLS.

docker compose up -d
DEVELOPER

Native Source Build & Automation API

⏱ Est: 35 minutesDocs↗

Build directly from the repository source code using the PHP / Laravel toolchain and automate via API tokens.

git clone https://github.com/coollabsio/coolify.git && cd $(basename "coollabsio/coolify")
SEC-03Hardware & Runtime Requirements
MEMORY (RAM)
2 GB minimum (4 GB recommended)
STORAGE ALLOCATION
10 GB free disk space
PROCESSOR ARCH
1 vCPU (x86_64 or ARM64)
TESTED RUNTIME STACK
DockerPHP
DIFFICULTY METERIntermediate Homelab
SEC-04Target Audience & Honest Limitations

Perfect For

  • •Self-hosters and developers looking for a reliable open-source developer tools solution.
  • •Teams requiring full custody of data under Apache-2.0 terms with zero external telemetry.
  • •Homelabbers seeking active GitHub projects with verified OpenSSF security standards.

Skip It If

  • •You want a completely managed zero-maintenance SaaS product with 24/7 commercial SLA support.
  • •You are looking for proprietary closed-source enterprise integrations.
Algorithmic Breakdown & Provenance

Score details

Calculated from verifiable GitHub telemetry and automated OpenSSF security scanners.

Scoring methodology →
OpenSSF Scorecard7.9 / 10
Active Vulnerabilities0 Active CVEs
Days Since Last PushPushed today
Security Health(×0.35)
84/100

Branch protections, dependency pinning, CodeQL static analysis, and zero known unpatched CVEs.

Maintenance Cadence(×0.30)
95/100

Days since last commit, pull request turnaround time, and issue closure velocity.

Community & Governance(×0.20)
94/100

Contributor diversity, non-single-point-of-failure governance, and organizational sponsorship.

Release Integrity(×0.15)
92/100

Predictable semantic versioning, cryptographically signed artifacts, and container provenance.

Score ProvenanceVerifiable algorithmic derivation breakdown
Security Health 84 (35%) + Maintenance 95 (30%) + Community 94 (20%) + Releases 92 (15%) = 90.5
Every score is calculated deterministically with zero editorial bias or commercial sponsorship.Learn how our deterministic weighting works

Risk Assessment & Operational Flags

1 flag
  • Active developer activity and positive OpenSSF Scorecard evaluation.
Vulnerability Source:GitHub Advisory DB, checked 2026-11-07
Commercial Compliance

Can I use this commercially?

Yes, fully commercial-friendly

Permissive with explicit patent protection. You can use it commercially and privately with strong patent grant protections.

Permitted Rights
  • ✓Commercial use
  • ✓Modification
  • ✓Distribution
  • ✓Patent grant
  • ✓Private use
Key Obligations & Notes
  • •Include copyright notice, copy of license, and state changes made to files.
SPDX Identifier: Apache-2.0Apache License 2.0
VULNERABILITY & GOVERNANCE MONITOR

Watch Coolify for Vulnerability Alerts

Receive real-time alerts if Coolify drops below 80 Safety Score or discloses a critical CVE.

Deployment & Installation

Commands to get the code. For a full setup, follow the project's own guide.

docker run -d --name coolify -p 8000:8000 -v /var/run/docker.sock:/var/run/docker.sock -v /data/coolify:/data/coolify ghcr.io/coollabsio/coolify:latest
VERIFIED DEPLOYMENT INFRASTRUCTURE
Where to run Coolify
SELF-HOSTED VPSFull Root Control

Hetzner Cloud & DigitalOcean

Spin up dedicated Linux nodes with Docker in under 60 seconds. Ideal for running containers with custom domains and reverse proxies.

ZERO-OPS MANAGEDNo Linux Admin

1-Click Managed Open Source

Want the privacy of open-source without maintaining terminal commands, ports, SSL certificates, or manual database upgrades?

SYSTEM TOPOLOGY & GITHUB DIAGRAM

Coolify Deployment Architecture

Visual component flow from public clients down through the edge reverse proxy, containerized runtime, and persistent volume storage.

01 / INGRESS CLIENTS
Web, Mobile & CLIHTTPS / TLS 1.3
:443
02 / EDGE PROXY
Caddy / TraefikAuto-Cert / Rate Limit
Bridge
03 / CORE DAEMON
CoolifyPHP / Laravel · 90.5/100
I/O
04 / DATA & DB
Embedded SQLite / Key-ValueNamed Volume / SSD
›View Raw GitHub Mermaid.js Source Code
↓
```mermaid
graph TD
    subgraph Clients ["1. Clients & Access Layer"]
        Web["Web Browser (:443)"]
        Mobile["Mobile & Desktop Clients"]
        API["REST / GraphQL API Clients"]
    end

    subgraph Edge ["2. Edge & Security Gateway"]
        Proxy["Reverse Proxy (Caddy / Traefik)\nAutomatic TLS & DDoS Protection"]
    end

    subgraph Container ["3. Coolify Core Service"]
        App["Coolify Daemon Container\nRuntime: PHP / Laravel\nLicense: Apache-2.0"]
    end

    subgraph Storage ["4. Persistent State & Volumes"]
        Data[("Coolify Data Storage\n(/data /media)")]
        DB[("Embedded SQLite / Key-Value\nPersistent Database")]
    end

    Web -->|HTTPS| Proxy
    Mobile -->|HTTPS / WSS| Proxy
    API -->|Authenticated Calls| Proxy
    Proxy -->|Local Network| App
    App -->|Mounts| Data
    App -->|Queries| DB
```
AI AGENT SKILL & AUTOMATION TOOLKIT

Control Coolify with AI Coding Agents

Equip Claude Code, Cursor, Hermes Agent, and Codex to autonomously audit and orchestrate Coolify.

AGENT DEPLOYMENT PROMPTReady to Paste

Using SafeOpenSource telemetry, deploy and audit Coolify (Safety Score: 90.5/100, License: Apache-2.0). Verify OpenSSF scorecard 7.9, isolate Docker network, and enforce non-root UID 1000:1000.

AGENT SKILL COMMANDSKILL.md Spec

Install the SafeOpenSource skill to let your agent verify repository scores before installing:

npx skills add safeopensource
Comparative Directory

Alternatives in Developer Tools

View all in category →
MAINTAINER TOOLKIT & BADGING

Embed Live Safety Score Badge

Maintain this repository or depend on it in production? Embed a live 0–100 Safety Score badge in your README. Badges are cached for 24 hours and updated automatically.

Live SVG Badge PreviewAuto-updating
Dark Mode
SafeOpenSource score badge for Coolify (Dark Mode)
Light Mode
SafeOpenSource score badge for Coolify (Light Mode)
[![SafeOpenSource Score](https://safeopensource.org/badge/coollabsio/coolify.svg)](https://safeopensource.org/tools/coolify)