Platform capabilities

Every module, every option — from the first deployment to single sign-on. All of it included, for every team.

Deployments

From your repository or registry to a running, healthy container — automatically.

Sources: GitHub (GitHub App), Azure DevOps, GitLab, Gitea / Forgejo, Bitbucket, any Git URL, Docker images and Docker Compose
Build packs: Dockerfile, Nixpacks, Node.js, Bun, Python, Go, static sites and shell scripts — detected automatically
Push-to-deploy with webhooks, pull request previews with their own domain, deploy hooks for any CI
Deployment status on commits and pull requests (GitHub, Azure DevOps)
Zero-downtime rollouts: traffic moves only after the health check passes
Pre- and post-deploy commands, replicas, CPU and memory limits
Watch paths for monorepos, several servers per application, dedicated build servers
Private registries: Docker Hub, GHCR, GitLab, Amazon ECR, Harbor, Quay and any OCI registry

Every release kept, every rollback instant.

Every production deployment becomes a numbered version (v1, v2…)
The live version and the last 5 are kept for 15 days, older ones removed automatically
Roll back by drag and drop or in two clicks — no rebuild, current variables
The old version stops only once the new one is healthy; approvals apply
Docker Compose applications keep the image of every service and the compose file

Traefik with automatic certificates, configured for you.

Automatic Let's Encrypt certificates, renewal and an expiry watchdog every 6 hours
Wildcard certificates with DNS-01: Cloudflare, Route 53, Azure DNS, Google Cloud DNS, DigitalOcean, Hetzner, OVH, GoDaddy, RFC 2136…
Uploaded certificates (corporate CA, EV / OV) distributed to every proxy
HTTP → HTTPS and www redirects, a port and a path per domain, search indexing control
DNS checks against the server's IP, with Cloudflare proxy detection
Changes applied in seconds, without a redeploy

Managed databases with real backups, and ready-made services.

PostgreSQL, MySQL, MariaDB, Microsoft SQL Server, MongoDB, Redis, Valkey and ClickHouse
Online backups following each engine's documentation: manual, scheduled or all at once
Restore in one click, after an automatic safety backup
Retention and upload to S3 (AWS, Cloudflare R2, Backblaze B2, MinIO)
Access from outside by domain or public IP
SQL console in the browser for PostgreSQL, MySQL, MariaDB, SQL Server and ClickHouse — read-only for members
13 one-click services (n8n, WordPress, Gitea, Grafana, Vaultwarden, MinIO…) and a catalog of 127 Docker images

Variables and settings that are safe and easy to change.

Environment variables encrypted with AES-256-GCM, for the build and the runtime
Variables per Docker Compose service, with the values of docker-compose.yml shown and overridable
Apply new variables with a restart, without a rebuild
Separate variables for pull request previews

Your whole fleet, from one dashboard.

The local server and remote servers over SSH, with encrypted keys and host key pinning
One-click setup: Docker, the network and the Traefik proxy
Containers, images and volumes of every server in one view, with CPU, memory and the resource they belong to
Web terminal, live logs, start / stop / restart, images, volumes, networks and prune
Live topology map with crash-loop detection, in the style of Argo CD

Know before your users do.

CPU, memory, disk, network and load history for servers and every resource
Alert rules with a duration and a severity
Notifications by email, Slack, Microsoft Teams, Discord, Telegram or signed webhook
Alerts for deployments, backups, certificates, servers and updates

Monitors for everything that must stay up.

Monitors for sites and APIs: status code, keyword, response time and TLS certificate expiry
Incidents opened and resolved automatically, with notifications
A public status page at /status with 90 days of uptime

Three scanners, one policy, reports for every deploy.

Vulnerability scanning of images with Trivy, optionally blocking on critical or high findings
Static analysis of the source with Semgrep (SAST), right after the checkout
Dynamic scan of the running application with OWASP ZAP (DAST)
Reports for every scan: HTML, CSV, JSON, SARIF and the ZAP report, one by one or as a ZIP
A ZIP with every report of a deployment, from its page

The right people, with the right rights.

Owner, admin and member roles, plus viewer, developer and maintainer per project
Protected environments and deployment approvals (four-eyes principle)
Two-factor authentication with recovery codes and an organization-wide policy
Single sign-on (OIDC) and LDAP / Active Directory
Audit log with CSV / JSON export and SIEM streaming (webhook or syslog), API tokens

Made for networks behind a proxy, or without internet.

HTTP(S) proxy with user and password for PortDock, builds and containers
NO_PROXY with names, domains, IP addresses and CIDR ranges
Docker Hub mirror (Nexus, Artifactory, Harbor) applied to each server's daemon without stopping containers
npm, PyPI, Go and Maven mirrors for builds, and a mirror of the Trivy database
A per-application choice: follow the setting, always use the proxy or never

The details that make it pleasant every day.

One-click updates from GitHub releases, with a backup and automatic rollback
AI assistant with any model on OpenRouter, a private history per user and access control
Interface in English, Romanian and Russian, with a light and a dark theme
Command palette (Ctrl K), real-time interface and a full-width responsive layout
REST API with tokens and a single binary with the interface embedded

Installation takes a few minutes on any Linux server. No licence key or registration is required.

Shell

$ git clone https://github.com/gavrilencu/PortDock.git portdock$ cd portdock$ sudo bash install.sh