coollabsio/coolify
An open-source, self-hostable PaaS alternative to Vercel, Heroku & Netlify that lets you easily deploy static sites, databases, full-stack applications and 280+ one-click services on your own servers.
How coolify is put together
Coolify is a self-hostable PaaS (Heroku/Netlify alternative) that manages servers, applications, and databases over SSH/Docker. The core is a PHP/Laravel monolith (app/, routes/, config/, artisan) using Livewire + Alpine.js + Tailwind for the UI, with Vite for asset bundling. A companion Node.js service (docker/coolify-realtime) provides WebSocket-based browser terminals backed by node-pty, authenticating clients by forwarding Laravel session/XSRF cookies to the main app at /terminal/auth. Asynchronous work (deployments, checks, cleanups) runs through queued Laravel jobs, and infrastructure is defined via multiple docker-compose variants.
Languages
Frameworks
Datastores
Infrastructure
Major components
Laravel application core
HTTP/API surface, business logic, models, and orchestration of servers, applications, services, and databases.
Job/queue subsystem
Queued jobs such as ApplicationDeploymentJob, cleanup jobs, DNS/Traefik/update checks executed asynchronously.
coolify-realtime terminal server
Node.js WebSocket server (/terminal/ws) that authenticates via Laravel cookies, spawns PTY sessions with node-pty, and relays terminal I/O.
Frontend SPA-style UI
Livewire/Alpine/Tailwind interface including embedded Monaco editor and xterm.js terminal client (resources/js).
Event system
Domain events (ApplicationStatusChanged, ProxyStatusChanged, ServerValidated, etc.) broadcast on resource state changes.
Server connectivity helpers
SSH multiplexing/retry helpers and SSL helper for executing commands and managing certs on managed servers.
Service template catalog
JSON/YAML templates (templates/service-templates.json) defining deployable one-click services.
API and webhook layer
routes/api.php, routes/webhooks.php, and routes/ai.php expose programmatic control and inbound webhook endpoints.
A focused bug-fix week that repaired deployment behaviors, database backups, and team deletion rules, plus two new service templates.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A focused bug-fix week that repaired deployment behaviors, database backups, and team deletion rules, plus two new service templates.
Week of 2026-08-17
The busiest week in the stretch, with over 160 commits fixing Docker cleanup, proxies, DNS validation, and adding a copy button for environment variables.
Week of 2026-08-10
A large release week (versions 4.3.4–4.3.7) centered on interface polish, dropdown and table fixes, and database backup reliability.
Week of 2026-08-03
Big capability additions this week: cross-server migration of servers and resources, uploadable profile avatars, and a new Celld service template, wrapped in heavy UI polish.
Week of 2025-12-22
A quiet holiday week with a single small change enabling Docker installation on Alpine Linux.
Over the past few weeks the Coolify team shipped a steady stream of fixes and polish across deployments, databases, teams, and the user interface, alongside several new one-click service templates like Obsidian LiveSync and HashiCorp Vault. A major theme was reliability — restoring broken features (backup archives, deployment log links, proxy networks after reboots) and tightening security around tokens and permissions. The interface also got significant attention, with copy buttons for environment variables, project icons, avatars, cross-server migration tools, and mobile-friendly layouts.
Week by week
2026-08-24A focused bug-fix week that repaired deployment behaviors, database backups, and team deletion rules, plus two new service templates.latest6 changes
Fix
Custom Docker options now apply with custom container names
Deployments using a custom container name no longer lose their custom Docker settings.
Fix
Deployment log links restored
Clicking through to the source commit from deployment logs works again.
Fix
PostgreSQL backup archives fixed
Custom PostgreSQL backup archives can be restored without errors.
Fix
Teams can be deleted with shared Git sources or keys
Deleting a team no longer gets blocked by system-wide Git sources or unused private keys.
Fix
GitHub tokens better hidden
Security improvements redact dotted GitHub tokens and keep wide data tables contained on screen.
Feature
New Vault and Obsidian templates
One-click service templates were added for HashiCorp Vault and Obsidian LiveSync (CouchDB).
2026-08-17The busiest week in the stretch, with over 160 commits fixing Docker cleanup, proxies, DNS validation, and adding a copy button for environment variables.6 changes
Fix
Proxy networks survive host reboots
After a server restarts, project networks are correctly restored so apps stay reachable.
Feature
Asynchronous DNS validation
Domain ownership checks now run in the background instead of blocking you.
Fix
Safer magic link sign-in
Signing in via email links now requires an explicit confirmation step.
Fix
Preview environments cleaned up fully
Deleting a preview also removes its persistent storage volumes.
Feature
Copy button for environment variables
A shared copy-to-clipboard button was added to environment variable pages and used everywhere.
Fix
Team deletions made safer
Only owners can delete teams, and membership/source deletions happen atomically to avoid half-finished states.
2026-08-10A large release week (versions 4.3.4–4.3.7) centered on interface polish, dropdown and table fixes, and database backup reliability.6 changes
Chore
Releases 4.3.6 and 4.3.7 shipped
Several version bumps packaged up the week's fixes into new releases.
Fix
Database SSL startup fixed
Databases with SSL certificates start reliably because the certificate setup no longer consumes the wrong input stream.
Fix
S3 connections tested with current values
Testing an S3 storage connection now uses what's actually typed in the form, not stale saved data.
Fix
PostgreSQL custom-format backups allowed safely
Database dumps share a common compression approach so custom backups work without corruption.
Feature
Project icons shown across the app
Project icons now appear on dashboard cards and project views for easier visual identification.
Fix
Sentinel won't restart after being disabled
Turning off the monitoring agent no longer triggers an unwanted restart loop.
2026-08-03Big capability additions this week: cross-server migration of servers and resources, uploadable profile avatars, and a new Celld service template, wrapped in heavy UI polish.6 changes
Feature
Cross-instance server migration
You can move servers between Coolify instances instead of rebuilding them from scratch.
Feature
Cross-server resource migration
Individual resources can be moved between servers (currently developer-only while it matures).
Feature
Uploadable profile avatars
Users can now upload profile pictures stored locally or on S3.
Feature
New Celld service template
A one-click template was added for Celld, which runs Deno Durable Objects applications.
Chore
Cloudflared security update
The bundled cloudflared tool was bumped to 2026.7.3, closing two critical security vulnerabilities.
Feature
Unified backups page
Database and storage backups are now managed together on a single page.
2025-12-22A quiet holiday week with a single small change enabling Docker installation on Alpine Linux.1 change
Feature
Docker install support on Alpine
Coolify's installer can now set up Docker on Alpine-based servers.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 99 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
POST /livewire/update (handled by app/Http/Middleware/CheckForcePasswordReset.php)
An attacker or a non-compliant user with a flagged account retains full interactive control of the instance (token minting, settings changes, deployments) without ever completing the mandatory password reset.
Fix: Scope the exemption to the ForcePasswordReset component only: in the livewire/update branch, decode the request snapshot and allow it through only when the component name is App\Livewire\ForcePasswordReset (plus logout and two-factor-challenge), rather than exempting the whole endpoint.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required