Self-hosted application platform
Deploy and operate applications on infrastructure you control
PortDock builds and runs applications, databases and services from Git or Docker on your own Linux servers — with automatic HTTPS, versioned releases, monitoring, security scanning and single sign-on in one platform.
- Open source under the Apache License 2.0
- No plans, seats or usage limits
- On-premises, in any cloud or air-gapped
- Git sources, including GitHub and Azure DevOps
- 6
- database engines with backups
- 8
- one-click services
- 13
- images in the Docker catalog
- 127
- security scanners on every deploy
- 3
- limits on servers, apps or users
- 0
Why PortDock
One platform for building, releasing and running software
The capabilities of a hosted PaaS — including those usually reserved for enterprise plans — on servers your organization already operates.
Everything in one place
Git deployments, Docker Compose stacks, managed databases, one-click services, domains with automatic HTTPS, metrics, alerts and backups — in a single binary with a modern interface.
Roll back in seconds
Every production deployment is kept as a version. Drag an older one onto Live and it is back — no rebuild, same variables.
Monorepos done right
A frontend and a backend in one docker-compose.yml deploy together, each service with its own domain and its own variables.
Built for teams
Project roles, protected environments, deployment approvals, SSO, LDAP / Active Directory, two-factor authentication and a full audit log.
Secure by default
Image vulnerabilities, static analysis of the code and a dynamic scan of the running app on every deploy — with reports you can download and policies that block.
An AI assistant built in
Ask about failing deployments, DNS or Docker in the corner of every page, with any model on OpenRouter.
Modules
One interface for the whole lifecycle
From the first commit to incident response. Every screen shown is the product itself, running with a demo organization.
Push to deploy, from any Git
Connect GitHub, Azure DevOps, GitLab, Gitea, Bitbucket or any Git URL. PortDock detects the build pack, builds, checks the health and moves traffic only when the new version is ready.
- Dockerfile, Nixpacks, Node.js, Bun, Python, Go, static sites, Docker Compose
- Pull request previews with their own domain
- Status on commits and pull requests, deploy hooks for any CI
- Zero-downtime rollouts, replicas, CPU and memory limits
How it works
From an empty server to production in three steps
No YAML to learn and no cluster to run. If it runs in Docker, it runs on PortDock.
- 01
Install PortDock
One command on a Linux server. The installer adds Docker if it is missing and starts the dashboard.
sudo bash install.sh - 02
Connect your code
Link GitHub or Azure DevOps from the settings, or paste any Git URL. The build pack is detected automatically.
git push origin main - 03
Operate in production
Every push is built, scanned and rolled out without downtime — with HTTPS, metrics, alerts and backups already on.
v42 live · https://shop.acme.example
Integrations
Works with the tools you already use
Standard Docker and Docker Compose underneath — nothing proprietary to migrate away from.
Git
- GitHub
- GitHub Enterprise
- Azure DevOps
- GitLab
- Gitea
- Forgejo
- Bitbucket
- Any Git URL
Databases
- PostgreSQL
- MySQL
- MariaDB
- SQL Server
- MongoDB
- Redis
- Valkey
- ClickHouse
Identity
- Microsoft Entra ID
- Okta
- Keycloak
- Authentik
- Active Directory
- OpenLDAP
- FreeIPA
Notifications
- Slack
- Microsoft Teams
- Discord
- Telegram
- Email (SMTP)
- Signed webhooks
- Syslog / SIEM
Security
- Trivy
- Semgrep
- OWASP ZAP
- Let's Encrypt
- AES-256-GCM
- SARIF
Infrastructure
- Docker
- Docker Compose
- Traefik
- Nixpacks
- Nexus
- Artifactory
- Harbor
- Amazon S3
- Cloudflare R2
- MinIO
Tour
Product tour
Screens from PortDock with a demo organization. Select an image to view it at full size.
AI assistant
An operations assistant built into the interface
Ask why a deployment failed, how to point a domain or what a Docker error means. Use any model on OpenRouter, with access control and a private history per user.
- Any model on OpenRouter, picked from the full catalog
- For everyone, only administrators or selected users
- Replies stream in with Markdown and code blocks
- The API key is stored encrypted
PortDock assistant
anthropic/claude-sonnetWhy did the last deployment of storefront fail?
The build stopped at npm ci: package-lock.json doesn't match package.json (react-dom 19.3.0 was added without updating the lock file).
Run npm install locally, commit package-lock.json and push — PortDock will deploy it automatically. Your live version keeps running meanwhile.
Comparison
PortDock vs. a hosted PaaS
The convenience of Heroku, Vercel or Render — with the control and the cost of your own infrastructure.
| Hosted PaaS | PortDock | |
|---|---|---|
| Where your apps and data live | The provider's cloud | Your servers, any provider or on-premises |
| Cost | Per app, per seat, per GB | Free — you pay only for your servers |
| Limits | Plan limits on apps, builds, bandwidth | None |
| Databases | Paid add-ons | Included, with backups to your own S3 |
| SSO, LDAP, audit log | Usually enterprise plans | Included |
| Security scans | Extra products | Trivy, SAST and DAST included |
| Vendor lock-in | Provider-specific configuration | Standard Docker and Docker Compose |
If you know Coolify, Dokploy or CapRover, PortDock will feel familiar — with versions and drag-and-drop rollback, a domain and variables per Compose service, deployment approvals, SSO / LDAP, security scans and an AI assistant included.
Enterprise
The controls regulated organizations require
Identity, access and audit controls that banks, public institutions and large companies ask for — built in, documented and available in every installation.
Single sign-on
OpenID Connect with PKCE: Entra ID, Okta, Google, Keycloak, Authentik.
LDAP / Active Directory
LDAPS or StartTLS, nested groups, required and admin groups.
Two-factor authentication
TOTP with recovery codes and an organization-wide policy.
Approvals
Protected environments and the four-eyes principle for production.
Audit and SIEM
Every action logged, exported to CSV / JSON and streamed to your SIEM.
Security gates
Deployments blocked on critical vulnerabilities or high SAST findings.
Air-gapped friendly
Corporate proxy, Nexus mirrors, scanner images from your own registry.
Data sovereignty
Everything stays on your servers, backups go to your own S3.
FAQ
Frequently asked questions
Is PortDock really free?
Yes. PortDock is open source under the Apache-2.0 license, with no plans, no license keys and no limits on servers, applications or users. You pay only for the servers you run it on.
What do I need to run it?
A Linux server (Ubuntu or Debian recommended) with ports 80 and 443 free for the HTTPS proxy. The installer adds Docker if it is missing. Remote servers are connected over SSH.
Does it work in a corporate network without internet?
Yes. PortDock supports an HTTP(S) proxy with NO_PROXY, a Docker Hub mirror on Nexus, Artifactory or Harbor, npm / PyPI / Go / Maven mirrors, a mirror of the Trivy database and scanner images from your own registry.
How does a rollback work?
Every successful production deployment is kept as a numbered version. Drag an older version onto Live, or press Roll back: the image is started again with the current variables, and the running version stops only when the old one is healthy.
Can I deploy Docker Compose projects and monorepos?
Yes. A docker-compose.yml deploys as one application, with a domain and variables per service. Watch paths let each application of a monorepo deploy only when its own folder changes.
Which security scans are included?
Trivy scans images for known vulnerabilities, Semgrep analyses the source right after the checkout (SAST), and OWASP ZAP scans the running application (DAST). Every scan has HTML, CSV and JSON reports plus the tool's own report, and a deployment can be blocked by policy.
Does PortDock use Kubernetes?
No. PortDock uses Docker and Docker Compose with the Traefik proxy, which keeps it simple to run and debug. An application can run on several servers; databases and services run on one server each.
Where is my data stored and how is it protected?
On your servers. PortDock keeps its state in SQLite with secrets encrypted with AES-256-GCM, SSH keys encrypted and host keys pinned. Database backups can be uploaded to your own S3 storage.
How are updates installed?
From the interface, with one click. PortDock backs up its database and key, recreates itself with the new version and rolls back automatically if it doesn't start. Your applications keep running throughout.
Evaluate PortDock on your own infrastructure
Installation takes a few minutes on any Linux server. No licence key or registration is required.
$ git clone https://github.com/gavrilencu/PortDock.git portdock$ cd portdock$ sudo bash install.sh