Levelrail

The lightweight, self-hosted alternative to Vercel, Netlify, Heroku, Railway, Coolify and Dokku.
Deploy on git push, with logs, metrics, HTTPS and one-click rollback, on your own servers. HTTPS is self-signed until you enable Let's Encrypt.
One Go binary · Docker runtime · agents instead of SSH · observability built in · no Kubernetes

Website · Docs · Install · Production ready · Compare · Guides · Roadmap · Changelog · Discussions · Discord

Levelrail is an open source (Apache 2.0) self-hosted PaaS: a Vercel and Heroku alternative that runs on any Linux server you own, from a small VPS to a rack (the one measured host is a 2 vCPU, 8 GB box). It turns plain servers into a private cloud with Git deploys (forge webhooks), HTTPS (self-signed by default, Let's Encrypt when enabled), databases with verified backups, metrics, logs and alerts, without Kubernetes and without the monitoring stack you would otherwise bolt on.

You need a Linux server (amd64 or arm64) with systemd and root. The installer adds Docker if it is missing.

curl -fsSL https://levelrail.com/install.sh | sudo sh

The last lines of output include the dashboard address and a one-time setup link:

Levelrail vX.Y.Z installed and running.

Open the dashboard:
  http://203.0.113.10:8080/login?setup=<token>

Open the setup link and choose a password. The first sign-in opens one screen that turns on a free certificate for <dashed-ip>.sslip.io with one click (no DNS needed) and deploys your first app.

On the server, the installer already put levelrail-cli in /usr/local/bin. Sign in once, then import a repository (levelrail-cli apps create --interactive asks for everything step by step):

levelrail-cli login --api-url http://<server-ip>:8080 --code ABCD-EF23
levelrail-cli import https://github.com/your-org/your-app --deploy

Prefer containers, a pinned version or a source build? See Installing. Want it as light as Dokku, or everything on? install.sh --profile minimal|standard|suite, see Server profiles. Coming from another platform? See Migrate to Levelrail: Coolify, Dokploy, CapRover, Dokku and compose files each get a dry run first, and the old server keeps serving.

After setup, the dashboard home shows a Connect your CLI card. Press Show my command, paste the line into your terminal, and the CLI signs in with a single-use code that expires in minutes (no password, no approval step):

logged in as "you@example.com"
token tk_9fQ2x saved to ~/.config/levelrail-cli/credentials under profile "default", expires 2027-01-18

Signing in with your password from a new device needs approval: the CLI prints the dashboard page to approve it on and the number to type. login --device also still works.

Without --deploy, import only prints the deployment plan. To see the app's address, run levelrail-cli open your-app. It prints the custom domain first, then the automatic URL.

Install the skill once, then ask your agent in plain words. It deploys, waits for the rollout to actually converge, reads the failure if there is one, and rolls back safely:

npx skills add https://github.com/glincker/levelrail --skill levelrail

Deploy this repo to my Levelrail and tell me when it is live.

The skill is also listed at skills.sh. Details: Agents.

More fixes: Troubleshooting. Full install options (Docker image, pinned version, source build): Installing. Deploy from a local project with levelrail-cli up: One command quickstart. Server profiles (install.sh --profile minimal|standard|suite): Server profiles. Migrating from another platform? levelrail-cli import platform coolify|dokploy|caprover --dry-run shows what would be created first, and the old server keeps serving. Full guide: Migrate to Levelrail. Publishing an open-source project? Add a one-click button to its README: Deploy to Levelrail button.

Install, then deploy

Gated deploy, one-step rollback

• Lightweight. About 200 MB of RAM and roughly 1.5% of one CPU idle, measured on a 2 vCPU, 8 GB Linux test box with no apps under load and the default feature set (one run, 2026-10-19). Numbers and method.
• Agents, not SSH. Each node runs a small agent that dials out over mTLS and talks to Docker's Engine API directly. No inbound ports, no shelling out to the docker CLI, no polling loops.
• Observability included. Per-node metrics at 15 second resolution, searchable logs, deploy markers, traces, SLO burn, alert inbox and an idle-footprint health page. No Grafana stack to install.
• Deploys that protect you. Readiness-gated rollouts, pinned images for rollback, canary releases that roll back on errors, deploy diffs, approvals and freezes.
• Secure by default. Hash-chained audit log you can verify, SSRF-guarded outbound calls, envelope-encrypted secrets with key rotation, scoped tokens, passkeys and TOTP 2FA, OAuth and OIDC sign-in, IAM policies, signed releases. SAML single sign-on and SCIM provisioning are available as a beta feature, off by default.
• Built for AI agents. An MCP server with over 240 tools in on-demand toolsets (small default list, about 2.4k tokens; see tool surface), a scoped-token permission model and an agent skill.

Single-server deployments are production ready today. Multi-node and a handful of newer features are labelled beta, and every label links to its evidence.

Most self-hosted platforms in this category manage servers by SSHing in and shelling out to the docker CLI, then parsing text, which tends to force polling loops. Levelrail uses a reverse-dialed agent and a level-triggered reconciler instead.

This is positioning, not a ranking, and every project here is worth using. Where Levelrail trails: it is the youngest project here, with fewer users and less production mileage, and its SAML single sign-on and SCIM provisioning are beta (details). Its template catalog (about 360 entries) is in the same range as Coolify's, but only a sample is deployed end to end (ADR 015). The full, sourced comparison is in Comparison.

• Deploys: Push to your git host (GitHub, GitLab, Bitbucket, Gitea webhooks), deploys start from a forge webhook (a native git push remote is beta and off by default), preview environments per pull request (stable on GitHub, beta on GitLab and Bitbucket), framework presets (Next.js, Go, React, Spring Boot and more), Dockerfile, Compose or image deploys, canary and blue-green rollouts. Readiness-gated cutover is live-tested with zero failed requests on a single node; multi-node is beta. Deploying apps
• Domains and TLS: Embedded Caddy ingress. The default certificate is internal (self-signed). Public Let's Encrypt is one toggle and was verified in one live run; renewal and DNS-01 wildcards are unverified. Custom certificates can be uploaded. Per-app abuse protection. Domains
• Databases: Postgres, MySQL, MariaDB, MongoDB, Redis, KeyDB, Dragonfly and ClickHouse with scheduled backups, Postgres point-in-time recovery, restore, and password rotation. Databases
• One search for everything: Cmd+K across apps, databases, nodes, templates and actions, filtered by what you may do. Search
• Servers: Add nodes with a one-time token, WireGuard mesh, zones and failure-domain spreading, placement what-if. Multi-node
• Templates: about 360 one-click services, with a smoke test that brings up the top 50 (48 pass today, status). Catalog
• Identity and access: Password, passkeys, TOTP, OAuth with 20 providers plus generic OIDC, IAM policies, teams, a hash-chained audit log with CSV export. SAML single sign-on and SCIM provisioning are beta and off by default. Identity and access, SAML and SCIM
• Plugins: A signed plugin marketplace with one-click install, dashboard panels and first-party alert channels. Plugins
• Automation: One HTTP API behind the dashboard, a CLI and an MCP server. AI never sits in the reconciliation path. CLI, AI control
• Pipelines, previews, cost budgets, sleep when idle, status pages and more. See Product tour.

The control plane at a glance	Pick a framework preset and the build settings fill in	Install a known service from the template catalog
Live deploys	Load balance across replicas with health checks	Every app, its health, and its last deploy

More screenshots (41 screens, shown in your GitHub theme, dark or light)

Per-app metrics, with deploy markers on every chart.	Search and tail container logs without installing anything.
Deploy history, with promote and logs for each release.	Deployments across the whole control plane.
Nodes the control plane places apps and databases on.	Health and footprint
A public status page for your apps.	A pipeline run with its stages, jobs, and live log.
Report deploys back to GitHub Actions.	Build speed: how long builds take and what they cost.
Build cache: rebuilds reuse unchanged layers.	Deploy strategy, health checks, and rollout behavior.
Where an app's code comes from.	Environment variables, with secrets masked.
Resource limits per app.	A guided checklist from install to your first deploy.
First-run setup, step by step.	One database, its connection details, and its state.
Connection details and password rotation for a database.	Verified backups
Backups with a history you can restore from.	Connect an S3-compatible bucket for backups and archives.
Archive logs to a bucket on a schedule.	Domains, certificates, and where each one routes.
Private networks decide which apps can reach each other.	Add a server from a cloud provider.
Each app's overview in one place.	Security center
Master and per-app encryption key status and rotation.	Add, test and remove passkeys, synced or device-bound.
Sign in the CLI from your own machine, with tokens you can revoke.	Automatic cleanup of old images, containers, and logs.
Opt in to beta features one at a time.	Plugin marketplace
Manage the plugins you have installed and their permissions.	Spot misconfigured settings and fix them with one click.
Instance name, dashboard URL and defaults.	Your account, your password, your sessions.
See every sign-in and change made to your account.	One search across apps, databases, nodes and actions.
One search for everything

All captured from a real running control plane. Walk through them in the Product tour.

Step by step walkthroughs, each tested against a real install:

Maintain an open-source app? Let people run it on their own server in a few clicks.

Copy-paste snippets and the four badge styles: Deploy button and the Brand kit.

• Agent skill: skills/levelrail/SKILL.md teaches a coding agent to deploy, wait, diagnose and roll back safely.
• MCP server: levelrail-mcp exposes the same API and permission model. Start in read-only mode. See MCP and AI control.
• Repo guide: AGENTS.md for working in this codebase, and llms.txt as the index. Docs for LLMs: llms.txt and llms-full.txt.

• GitHub Discussions for questions, ideas and show and tell, and Issues for bugs.
• GLINR Discord: live chat with the maintainers, in the #levelrail forum channel.
• support@levelrail.com for direct help, and the Security policy to report a vulnerability privately.
• Contributing: dev loop, tests and commit conventions. Build from source needs Go 1.26 or newer and Docker: see Installing.

If Levelrail saves you a weekend, a star on GitHub helps other self-hosters find it. Bug reports and honest feedback help even more.

Apache 2.0, see LICENSE.

Levelrail is built by Gagan Deep Singh, founder of GLINR STUDIOS and theSVG. Sister projects: theSVG (brand icon library), theauth (open-source auth for AI agents and humans) and AskVerdict AI. Say hello at thegdsks.com.

_{Powered by GLINR STUDIOS · icon from theSVG}