What is Levelrail and who is it for

[thegdsks]

Levelrail is an open source, self-hosted deployment platform (Apache 2.0) that turns one or more Linux servers into a private cloud: push to git, get a running app with TLS, logs, metrics and rollback.

TL;DR

• License: Apache 2.0, one edition, no license key and no paid tier.
• Runtime: a single Go binary for the control plane, plus Docker on each server. No Kubernetes.
• Install: curl -fsSL https://levelrail.com/install.sh | sudo sh
• Target scale: 3 to 50 services on 1 to 10 machines.
• What sets it apart: agents dial out to the control plane over mutual TLS, so extra nodes need no inbound ports. A level-triggered reconciler drives every deploy. Logs and metrics are built in and stay on each node.

Tip

If Levelrail looks useful, a star on https://github.com/glincker/levelrail helps other self-hosters find it.

Contents: What is Levelrail | Try it in two commands | Quick facts | How it works | What can it deploy | Who it is for | How a deploy flows | vs Coolify, Dokploy, Heroku, Vercel | Is it free | What you need | Footprint | Get help | FAQ

What is Levelrail

Levelrail is a self-hosted PaaS, a Heroku alternative and Vercel alternative that runs on servers you own or rent. You install one control plane and point it at a git repository or a Docker image. It builds the app, deploys it with Docker, puts TLS in front and keeps an eye on it. I built it for people who run a handful to a few dozen services and would rather have a dashboard, a CLI and an API than a pile of SSH sessions, or a bill that grows with every side project.

How do I install it? Try it in two commands

On a Linux server (amd64 or arm64, systemd, root, ports 80 and 443 open):

curl -fsSL https://levelrail.com/install.sh | sudo sh

The installer checks the host, installs Docker if it is missing, verifies the release checksum, starts a levelrail systemd service and waits for it to report healthy. It ends by printing the dashboard URL, a one-time setup token link for your first admin account, and a reminder to back up master.key. Open the link, choose a password, and a setup wizard walks you through server checks, an optional domain and your first app.

Then deploy from a repository (replace the placeholder with your own repo URL):

levelrail-cli import https://github.com/YOUR-ORG/YOUR-APP --deploy

Leave off --deploy and the command prints the deployment plan (build method, port, environment, volumes, warnings) and creates nothing, so you can look first. Once it is running, check on it:

levelrail-cli apps status web
levelrail-cli apps logs web --follow

Status lists each reconciler condition with a reason string, so a failing deploy tells you why instead of spinning. The full walkthrough is the quickstart.

Note

Want only the CLI on your laptop? curl -fsSL https://levelrail.com/install-cli.sh | sh. It talks to the control plane over HTTPS, with no SSH key and no inbound port.

Before you start

• A Linux server with 1 vCPU and 1 GB of RAM or more
• Ports 80 and 443 reachable from the internet
• A domain (optional, sslip.io hostnames work without DNS)
• About ten minutes

Quick facts

Field	Value
Name	Levelrail
Category	Self-hosted deployment platform (PaaS), open source
License	Apache 2.0
Language	Go (control plane, agent, CLI); React and TypeScript dashboard
Runtime	Docker Engine, driven through its API
Install method	install.sh (systemd), Docker image on ghcr.io, or build from source
Supported OS	Linux, amd64 or arm64, with systemd. Tested in CI on Ubuntu 24.04 and Debian 12
Databases	Managed Postgres, MySQL, MariaDB, MongoDB, Redis, Valkey, ClickHouse and others
Ingress	Caddy embedded in the control plane, automatic TLS
State	Embedded SQLite in WAL mode
Source repository	https://github.com/glincker/levelrail
Documentation	https://docs.levelrail.com
Machine-readable docs	https://docs.levelrail.com/llms.txt
Latest release	github.com/glincker/levelrail/releases/latest

How does Levelrail work

There are a few moving parts, and they are the same whether you run one box or ten.

flowchart LR
  subgraph CP["Control plane (one Go binary)"]
    API["HTTP API<br/>dashboard, CLI, MCP"]
    REC["Reconciler<br/>desired vs observed"]
    DB[("SQLite, WAL mode<br/>desired state")]
    CADDY["Embedded Caddy<br/>ingress + auto TLS"]
    API --> DB
    REC --> DB
  end
  subgraph N1["Node 1"]
    A1["levelrail-agent"]
    D1["Docker Engine API"]
    L1[("Node-local logs<br/>and metrics")]
    A1 --> D1
    A1 --> L1
  end
  subgraph N2["Node 2"]
    A2["levelrail-agent"]
    D2["Docker Engine API"]
    L2[("Node-local logs<br/>and metrics")]
    A2 --> D2
    A2 --> L2
  end
  A1 -. "dials out, mutual TLS, gRPC" .-> REC
  A2 -. "dials out, mutual TLS, gRPC" .-> REC
  USER(["Visitors"]) --> CADDY
  CADDY --> D1

Loading

• Agents dial out. Each agent connects to the control plane with mutual TLS and streams Docker events up, so extra nodes need no inbound ports. It talks to the Docker Engine API directly and never shells out to the docker CLI.
• A reconciler, not a script. Desired state lives in the database. A level-triggered loop moves each node toward it and writes a status condition with a reason after every pass. A deploy counts as healthy only once the new container's readiness probe passes.
• Embedded parts. SQLite state, Caddy ingress with automatic certificates and the dashboard all ship inside the control plane.
• Observability stays on the node. Each node keeps its own logs and 15 second metrics, and the control plane queries them when you ask.
• Rollback targets are pinned. Garbage collection cannot remove an image you might need to roll back to.

More in Architecture.

What can Levelrail deploy

Git repositories (GitHub, GitLab, Bitbucket, Gitea), Dockerfiles, built images, Docker Compose files, static sites, docker run commands, and a catalog of 311 service templates. Builds use BuildKit with Railpack auto-detection, and managed databases run next to your apps. Expand a group below for the feature map.

Deploys and domains

Capability	In one line
Import anything	Repo, image, compose or Dockerfile, with a plan preview first. Importing apps
Strategies	Rolling, recreate and blue-green, gated on readiness. Zero-downtime deploys
Previews	An environment per pull request. Previews
Git providers	Verified webhooks from four providers. Git integrations
Domains and TLS	Embedded Caddy, automatic certificates, one-click HTTPS on sslip.io hostnames. Domains and ingress
App spec	One small app.yaml with a JSON Schema. App spec reference

Databases and templates

Capability	In one line
Managed engines	Postgres, MySQL, MongoDB, Redis and more from one command. Managing databases
Backups	Scheduled, verified, S3 compatible, with restore. Backups and storage
Templates	311 catalog entries. Template catalog

Observability and safety

Capability	In one line
Metrics and logs	Per-app charts with deploy markers, full-text log search. Observability
Rollback	Redeploy exactly a past image, pinned by digest. Rollback
Approvals and freezes	Protected environments and freeze windows. Deploy safety
Secrets	Envelope encryption with key rotation. Security
Sleep when idle	Stop idle apps, wake on first request. Sleep when idle
Status page	Opt-in public status page. Status page

Teams and automation

Capability	In one line
Sign-in and IAM	Passwords, TOTP, passkeys, OAuth, roles and per-app policies. Identity and access
Audit log	Sensitive requests recorded and exportable. Teams and roles
Pipelines	CI/CD runs with approvals. Pipelines
Platform as code	Export, plan and apply configuration. Platform as code
MCP server	AI assistants act under the same permissions. MCP tool surface

Note

Every feature carries a maturity label (stable, beta or behind a flag) and the test evidence behind it. Maturity labels change as features get tested, so the live page is the source of truth. See feature status.

Who is Levelrail for

You are	What you run	What you get
A solo founder with side projects	A handful of apps and a database or two on one cheap VPS	A dashboard instead of SSH sessions, git push deploys, automatic HTTPS, scheduled database backups, and apps that sleep when idle so a small box carries more projects
A small team replacing Heroku or Vercel bills	Production apps, staging, preview environments, a few teammates	Previews per pull request, deploy approvals and freeze windows, roles and API tokens, SSO sign-in, alerting, and a flat cost that is just your servers
A homelab or agency running 10 client apps	Many small apps across a few machines, handed between people	Projects and organizations, per-app access policies, an audit log, a public status page, scheduled maintenance windows, and a template catalog for the usual self-hosted services

How a deploy flows

sequenceDiagram
  autonumber
  actor You
  participant CP as Control plane
  participant Agent as Node agent
  participant Docker as Docker Engine
  participant Caddy as Embedded Caddy
  You->>CP: Push to git, or levelrail-cli import --deploy
  CP->>CP: Record desired state in SQLite
  CP->>Agent: Build and start request
  Agent->>Docker: Create new container
  loop Until ready
    Agent->>Docker: Readiness probe
  end
  Agent-->>CP: New container is ready
  CP->>Caddy: Cut traffic to the new container
  Agent->>Docker: Drain and stop the old container
  CP-->>You: Condition updated, logs and metrics live

Loading

If the new container never becomes ready, the old one keeps serving and the condition says why. A rollback is the same flow pointed at an older, pinned image.

How is Levelrail different from Coolify, Dokploy, Heroku, and Vercel

Coolify has the broadest one-click catalog and manages servers over SSH. Dokploy builds on Docker Swarm, as does CapRover. Dokku is hard to beat for one box and git push, and Kamal is minimal and has no control plane. Heroku and Vercel are hosted services you rent per seat or per usage, while Levelrail runs on your own servers with no usage meter.

Levelrail makes different choices (an outbound agent, a reconciler, observability in the core), and it is the youngest project of the group. The comparison page lays out the differences and leaves the decision to you. There are also switching guides for Heroku, Vercel and Coolify.

Is Levelrail free

Yes. It is Apache 2.0 open source with a single edition: no license key, no enterprise tier, no usage meter. The only cost is the servers you already rent. See pricing.

What do I need to run it

A Linux server (Ubuntu 24.04 and Debian 12 are tested), root access, ports 80 and 443 reachable, and about ten minutes. One vCPU, 1 GB of RAM and 10 GB of disk will boot it. Two vCPU, 2 GB and 20 GB is more comfortable once you build images. Docker is installed for you if missing. Details: what you need and installing.

How much does it use when idle

scripts/bench-idle.sh builds the control plane, boots it in dev mode in a throwaway data directory, creates N apps through the HTTP API and stops each one, then waits 5 seconds, samples the process's CPU time across a 60 second idle window and reads RSS at the end. On an Apple M4 Max with a dev build and a loopback client:

Apps	RSS (MB)	CPU (%)
0	67.7	0.03
100	82.6	0.30
500	90.8	1.60

Listing apps takes 0.14 ms at p50 with none and 3.69 ms at p50 with 500. The apps in the run are suspended and run no containers, so real workloads add Docker event, probe and metrics load that it does not measure. Full method: performance.

How do I get help or contribute

• Star the repo: github.com/glincker/levelrail
• Docs: docs.levelrail.com, with a machine-readable index for AI tools at llms.txt
• Questions and show and tell: Discussions, or the #levelrail forum on the GLINR Discord
• Bugs: issues, ideally from a real workload
• Code: pick a good first issue after reading CONTRIBUTING.md. Open an issue first for anything beyond a small fix, use conventional commits, and keep each pull request to one logical change.
• Releases: github.com/glincker/levelrail/releases

FAQ

Quick answers first, with a link to the full page for each. Tap a question to expand it.

Topic	Short answer	Read more
Price	Free, Apache 2.0, one edition	LICENSE
Install	One command, Linux amd64 or arm64	Installing
Orchestration	Reconciler over the Docker Engine API, no Kubernetes	Comparison
More servers	Outbound mTLS agents, no inbound ports	Multi-node
Maturity	Stable and beta labels with evidence	Feature status

What is Levelrail?

An open source, self-hosted deployment platform that turns Linux servers into a private cloud: git deploys, automatic TLS, logs, metrics and rollback.

Start with the quickstart.

Is it a Heroku or Vercel alternative?

Yes, for apps you can run in Docker. You get git deploys, preview environments, custom domains and rollback on your own servers instead of a per-seat hosted plan. Coming from Vercel? See migrating from Vercel.

Does it use Kubernetes?

No. A level-triggered reconciler drives the Docker Engine API, state lives in SQLite, and Caddy is embedded for ingress. See the comparison for how that differs from Coolify, Dokploy and others.

How much does it cost?

Nothing. Apache 2.0, a single edition, no paid tier. You pay for your servers.

What do I need to install it?

A Linux server (amd64 or arm64) with systemd, root access and ports 80 and 443 reachable. The installer sets up Docker if it is missing.

curl -fsSL https://levelrail.com/install.sh | sudo sh

Details: installing.

Does it support more than one server?

Yes. Extra nodes run levelrail-agent, which dials out to the control plane over mutual TLS, so those nodes need no inbound ports. Multi-node is labeled beta in feature status.

Guides: multi-node quickstart and multi-node.

Which databases can it run?

Managed Postgres, MySQL, MariaDB, MongoDB, Redis, Valkey, ClickHouse and more, with scheduled, verified backups to S3 compatible storage.

See managing databases, backups and storage and prove your backups work.

Is there a template catalog?

Yes, a large catalog of one-click services. Only a sample is deployed by end-to-end tests, so treat the rest as likely to work from their Compose structure.

Browse the template catalog.

Where are my secrets stored?

In the control plane database, encrypted with AES-256-GCM using per-owner data keys wrapped by a master key. The master key lives in master.key (or APP_MASTER_KEY) and is never part of a control plane backup, so back it up separately. Agents receive decrypted values only at container-create time and never write them to disk.

Read environment and secrets and security.

Can I save money on idle apps?

Yes. Apps can sleep when idle and wake on the next request. See sleep when idle.

Can AI assistants use it?

Yes, through an MCP server that exposes the same API and permission model. AI stays out of the reconcile path. See MCP and AI control.

How does it compare with Coolify and Dokploy?

All three are self-hosted PaaS options with different designs: Coolify uses SSH, Dokploy uses Docker Swarm, and Levelrail uses outbound agents and a reconciler. The comparison page covers what each is good at, and the long form is in the comparison discussion.

Your turn

One command gets you a running platform:

curl -fsSL https://levelrail.com/install.sh | sudo sh

Deploy one real app, then tell us in the comments what worked and what did not. I read every reply. If you like where this is going, a star on https://github.com/glincker/levelrail is the easiest way to say so. The quickstart is the place to begin.