Your own Heroku or Vercel on a dedicated server — Dokploy is the open-source PaaS that replaces cloud platform subscriptions with a single dashboard you control. Point it at a Git repository or a Docker image, and it builds and deploys the application using Dockerfiles, Nixpacks, or Heroku/Paketo buildpacks. Traefik handles reverse proxying, routing, load balancing, automatic Let's Encrypt SSL, and HTTP/3. Databases — MySQL, PostgreSQL, MongoDB, MariaDB, libsql, and Redis — provision from the UI with automated backups to any S3-compatible destination. Complex multi-service applications deploy through native Docker Compose support, and multi-node scaling uses Docker Swarm. The web dashboard covers environment variables, volumes, resource limits, real-time CPU/memory/network monitoring, and deployment logs, with a CLI and REST API for automation. Deploy notifications go to Slack, Discord, Telegram, or email. One-click templates install common open-source tools, and a single control plane can manage deployments across multiple remote servers. Because everything is standard Docker, there is no lock-in: Dockerfiles, Compose files, and data volumes work anywhere else Docker runs. The push-to-deploy workflow of a $20/seat cloud PaaS, running on a dedicated VPS with guaranteed CPU, RAM, SSD, and full root access — no per-app, per-environment, or per-seat fees regardless of how many applications you deploy. 26,000+ GitHub stars.

The open-source PaaS with 55,000+ GitHub stars and the largest one-click service catalog in its class — Coolify gives you the Vercel push-to-deploy workflow on a dedicated server you control. Connect a GitHub, GitLab, Bitbucket, or Gitea repository and every push builds and deploys automatically via Nixpacks, a Dockerfile, or Docker Compose, with Traefik or Caddy reverse proxying, automatic Let's Encrypt certificates, and per-branch preview deployments with their own URLs. Databases — PostgreSQL, MySQL, MariaDB, MongoDB, Redis — provision in a few clicks, and a catalog of 280+ one-click service templates covers WordPress, n8n, Grafana, MinIO, Plausible, Ollama, and more. One dashboard manages the entire server, with Docker Swarm available for clustering multiple nodes. Backups go to any S3-compatible storage with one-click restore, and a full API supports CI/CD integration. All configuration lives on your own server, so resources keep running even if you stop using Coolify — no vendor lock-in by design. Running on a dedicated VPS with guaranteed CPU, RAM, and SSD, full root access via SSH and browser console. Apache 2.0 licensed.

With 83,000+ GitHub stars and $18.8M in Series A funding, OpenHands delivers the leading open-source platform for AI coding agents that scored 68.4% on SWE-bench Verified with Claude Opus 4.6, outperforming Devin 2.0's publicly reported 45.8%. The Agent Canvas web UI organizes work into persistent conversations where agents edit files, run shell commands, browse the web, and execute multi-step development tasks inside isolated Docker sandbox containers. The observe-plan-act loop drives agent behavior: the Python controller manages LLM abstraction via LiteLLM routing to 100+ providers including OpenAI, Anthropic, Google, DeepSeek, Qwen, Llama, and local Ollama models. Built-in skills for code review, Docker management, PRD generation, repo-rules enforcement, release notes, and test running attach to conversations automatically via auto-discovery or trigger-based activation. The Automations system schedules recurring agent tasks with configurable templates for CI workflows, dependency updates, and documentation generation. MCP server integration enables agents to access external tools and data sources. The REST API powers an OpenAI-compatible endpoint for connecting agents to chat UIs, IDEs, and voice platforms. GitHub, GitLab, Slack, and Jira integrations enable pull request reviews, issue resolution, and team notifications. The SDK provides Python and REST APIs for embedding agents in custom tools with local or cloud execution, custom agent behaviors, and Kubernetes deployment. On RepoCloud, deploy OpenHands on a dedicated VPS with Docker socket access, persistent project storage, root SSH access, and complete control over your AI development infrastructure, all under the MIT license.

DeepSeek Harness gained over 60,000 GitHub stars within hours of its August 2026 launch, establishing itself as the first fully modular open-source agent runtime where literally every component is a swappable plugin. Built on the Cordis framework—a programming paradigm for spatiotemporal composability—dsh decomposes the entire agent stack into independently replaceable pieces: model adapters for DeepSeek, Anthropic, OpenAI, AWS Bedrock, Azure, and Google Gemini; tool registries covering bash execution, file system operations, web search, subagent delegation, and todo management; plus session stores, sandboxes, approval policies, orchestration loops, and the user interface itself. Four operating modes serve different workflows: Standard provides the full toolset, Code mode uses model-generated code to compose multi-round tool calls, Minimal strips down to a shell and editor for benchmarking, and Creator mode lets developers inspect the running runtime and test Cordis plugins in memory. The kernel handles plugin mounting, unmounting, and dependency resolution while typed events and services coordinate between components. Profiles and bundles allow the same codebase to produce entirely different products—a terminal coding agent, a browser-based workspace, a headless automation service, or an ACP/JSON-RPC endpoint—by swapping YAML configuration layers. Session history is stored as an append-only event stream for full trajectory replay, and project-level hooks on agent lifecycle events enable fine-grained behavioral customization. MCP client integration connects to external tool servers, while Agent Client Protocol enables programmatic orchestration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Teams that cannot send messages through someone else's cloud run Mattermost - the open-core, self-hosted alternative to Slack. It provides public and private channels, threaded discussions, unlimited search history, file sharing with previews, one-to-one audio calls, and screen sharing, with desktop clients for Windows, macOS, and Linux plus iOS and Android apps. Messages support full Markdown, which suits engineering conversations with code blocks and logs. Playbooks turn repeatable processes such as incident response and release management into checklist-driven workflows with automated triggers and retrospectives. Integration is a core strength: prebuilt connectors for GitHub, GitLab, Jira, ServiceNow, and PagerDuty, plus webhooks, slash commands, bots, a REST API, and a plugin marketplace with 700+ entries - together making it a working surface for ChatOps rather than just a chat room. Playbooks add keyword and event triggers, task assignment, status broadcasting, and post-incident retrospectives, so operational knowledge is not trapped in individuals' heads. The server is a single Go binary backed by PostgreSQL, with React clients, released monthly under MIT license and deployable fully air-gapped - which is why governments and defense organizations run it inside closed networks, and why the same control applies to any team with confidentiality requirements. The compiled Team Edition is free for unlimited users with no message history cutoff, so costs stay flat as the team grows.

Point Openship at a GitHub repo, local folder, or prebuilt artifact and it detects your stack, builds a Docker container, provisions databases, configures domains with automatic Let's Encrypt TLS, and routes traffic through an OpenResty edge layer on ports 80 and 443. Already past 10,000 stars since launching in March 2026, it turns any Linux VPS into a managed application host. Language support covers Node.js, Python, Go, Rust, PHP, Ruby, Java, .NET, Docker, and monorepo projects with push-to-deploy CI/CD, pull request preview environments on unique subdomains, staging/production flows, and one-click rollbacks. Integrated backend services include managed Postgres, MySQL, MongoDB, Redis, persistent volumes, WebSocket proxying, object storage, and worker processes, all provisioned from the dashboard without compose files. A built-in SMTP server handles transactional email with automatic DKIM, SPF, and DMARC configuration, eliminating external email services. The edge layer serves HTTP/3 with Brotli compression, configurable cache rules, and instant purging. Real-time monitoring streams build logs, container metrics, visitor geography, and per-status-code analytics at 1.4 microsecond overhead with zero database writes. Scheduled backups cover databases and volumes with one-click restore and export. Three interfaces (web dashboard, desktop app for macOS/Windows/Linux, and the openship CLI) drive the same API, plus a Model Context Protocol endpoint for AI integration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Archestra delivers the enterprise AI infrastructure layer that organizations need when managing multiple LLM providers, MCP servers, and AI agents across teams becomes unmanageable. The LLM gateway routes requests across Anthropic, OpenAI, Azure, Bedrock, and DeepSeek with virtual API keys, per-team cost limits, and dynamic model routing — giving every developer one token for Claude Code, Cursor, or Codex while finance tracks spend per department. The MCP gateway authenticates tool calls with OAuth 2.1 and On-Behalf-Of tokens so each tool executes as the calling user, not a shared service account, eliminating credential sprawl. The private MCP registry lets teams publish custom tool servers with approval flows promoting servers from dev through staging to production, each environment maintaining its own credentials and network egress policies. The Kubernetes operator manages MCP server lifecycle — deploying containers, scaling, health-checking, and routing gateway traffic to local servers automatically. The agent runtime supports scheduled triggers, email and webhook invocations, sub-agent delegation, reusable skills, and sandboxed code execution with a K8s-native filesystem. Deterministic guardrails including Dual-LLM verification and Lethal Trifecta protections prevent dangerous tool calls before execution. Built-in OpenTelemetry traces and Prometheus metrics provide full observability without additional tooling. Docker deployment exposes the Admin UI on port 3000 and API on port 9000 with a single command. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Backed by the Linux Foundation with contributions from AWS, Cisco, IBM, Microsoft, Red Hat, and Shell, Agentgateway is the first data plane built from the ground up for AI agent workloads — providing a unified Rust-based proxy that handles conventional HTTP and gRPC traffic alongside MCP tool servers, A2A agent communication, and LLM inference endpoints through a single deployment. The LLM gateway routes requests to OpenAI, Anthropic, Gemini, AWS Bedrock, and other providers through an OpenAI-compatible unified API with per-tenant budget controls, spend tracking, prompt enrichment, load balancing across multiple model endpoints, and automatic failover when providers experience outages. The MCP gateway federates multiple tool servers behind one endpoint, supporting stdio, HTTP/SSE, and Streamable HTTP transports with built-in OAuth authentication compliant with the MCP auth specification, integrating Auth0 and Keycloak out of the box. OpenAPI integration exposes existing REST APIs as MCP-native tools without code changes, enabling legacy services to participate in agent workflows. Policy-based RBAC controls which agents access which tools, while OpenTelemetry integration provides distributed tracing across agent communication chains. Deploy as a standalone binary with flat YAML configuration or on Kubernetes using the built-in controller with Gateway API support for declarative infrastructure-as-code management. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 43,000 GitHub stars and adoption by companies including Nasdaq, Samsung, and Expedia, Kong Gateway is the world's most deployed open-source API gateway, processing billions of API requests daily across hybrid-cloud and multi-cloud architectures. Built on the battle-tested NGINX engine with OpenResty's LuaJIT runtime, Kong delivers sub-millisecond proxy latency while supporting REST, gRPC, GraphQL, WebSocket, SOAP, and Kafka protocols. The plugin architecture includes authentication via JWT, Basic Auth, HMAC, key authentication, OAuth 2.0, and LDAP, alongside rate limiting with configurable windows per consumer, IP address, or API key. The AI Proxy plugin provides a universal LLM API that routes across OpenAI, Anthropic, Google Gemini, AWS Bedrock, Azure AI, Databricks, Mistral, and Hugging Face through a single standardized interface, while MCP proxy capabilities convert REST APIs into MCP tools and provide traffic governance for AI agents. Kong supports declarative configuration via YAML for GitOps workflows, a RESTful Admin API for dynamic configuration, and decK CLI for version-controlled infrastructure-as-code management. Upstream health checking with active and passive probes enables automatic failover, and the ring balancer distributes traffic across upstream targets with consistent hashing, round-robin, or least-connections algorithms. The Kong Plugin Hub hosts over 100 community and official plugins covering logging, monitoring, transformation, security, and traffic control. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 14,000 GitHub stars and a growing global network of security deployments, CrowdSec turns every attack on any participating server into protection for the entire community. The security engine operates as a combined IDS/IPS and WAF, analyzing log sources from Nginx, Apache, SSH, WordPress, and over 50 other services to detect brute force attacks, port scans, web vulnerability exploitation, and credential stuffing in real time. When one server detects a new threat, the attacker's IP is shared through the community blocklist, proactively protecting thousands of other installations before the attacker can reach them. The built-in WAF powered by Coraza v3 inspects HTTP requests at the application layer, validates against OpenAPI schemas, and applies custom rules with flexible AND/OR condition mixing for precise threat detection. Bot detection serves challenge pages with client fingerprinting to distinguish legitimate traffic from automated scrapers and scanners. Remediation components block malicious IPs at multiple infrastructure layers including iptables, nftables, Nginx, HAProxy, Cloudflare, and AWS Security Groups through the detect-here-remedy-there architecture. The scenario-based detection system ships with default rules for common attack patterns and supports custom scenarios written in YAML with an expressive filter language. A centralized console provides real-time visualization of alerts, threat intelligence analysis, and management of multiple distributed security engines. GDPR compliant by design, all log analysis happens locally and raw logs never leave your infrastructure. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

With over 14,000 GitHub stars and enterprise adoption by security-conscious organizations, Coder transforms how development teams provision, manage, and secure their coding environments. Every workspace is defined as a Terraform template, meaning infrastructure engineers can standardize development environments across EC2 instances, Kubernetes pods, Docker containers, or any combination, while developers get self-service provisioning that launches in seconds rather than days of manual setup. The WireGuard-based networking layer establishes encrypted tunnels between developer machines and remote workspaces, providing low-latency access without exposing ports or configuring VPN concentrators. Automatic idle detection shuts down unused workspaces after configurable periods, directly reducing cloud compute costs for organizations running hundreds of developer environments. The Coder Agents feature introduces native AI coding capabilities where the agent loop executes entirely within the control plane on self-hosted infrastructure, keeping LLM API credentials out of individual workspaces and eliminating credential exfiltration risks. Centralized model governance allows platform teams to approve specific AI providers and models, set per-user spend limits, and maintain complete audit logs of all prompts, tool calls, and agent activity. IDE integration supports VS Code through a dedicated extension, JetBrains IDEs via Gateway and Toolbox plugins, and browser-based code-server for web access. The template registry provides pre-built configurations for common development stacks. DevContainer support builds environments from standard devcontainer.json specifications. Deploy on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Deployment decoupled from release: Unleash, the most popular open-source feature management platform on GitHub, is a Node.js server backed by PostgreSQL. Ship code dark, then control who sees it through activation strategies: gradual percentage rollouts, targeting by user ID, IP, hostname, or application name, custom constraints against your own context fields, and scheduled or time-limited releases. Strategies stack - a flag activates if any strategy matches - and strategy variants layer A/B versions on top of the on/off decision. Each flag carries per-environment configurations, so a feature can run at 100% in staging while canarying at 5% in production. Backend SDKs (Node.js, Java, Go, Python, Ruby, .NET, PHP, Rust, and more) fetch configuration and evaluate flags locally, so a flag check adds zero network latency to request paths; frontend SDKs for React, Vue, Svelte, iOS, Android, and Flutter evaluate through a proxy layer. Flag hygiene is built in: flags are typed (release, experiment, operational, kill-switch, permission) with expected lifetimes, and Unleash marks overdue flags as potentially stale and surfaces unknown flags your SDKs request but that don't exist. Self-hosting via Docker keeps flag data, targeting rules, and evaluation infrastructure entirely on your side.

Engineers who have outgrown Duplicati or rsync scripts tend to appreciate Kopia's design: encrypted, compressed, content-deduplicated snapshots in Go, stored in a repository on any storage you control - S3, Google Cloud Storage, Azure Blob, Backblaze B2, SFTP, WebDAV, or a plain filesystem. Encryption is mandatory and end-to-end: every block is encrypted client-side with AES-256-GCM or ChaCha20-Poly1305 using keys derived from your repository password, and even file names never leave the machine in plaintext. Blocks are packed into 20-40 MB blobs with random names, so the storage provider learns nothing about content or structure. Deduplication is automatic and content-based - identical data across files, snapshots, and even multiple machines backing up to the same repository is stored once. Policies govern everything per-directory: compression choice, retention (hourly through annual), scheduling, and ignore rules. Incremental snapshots are point-in-time records you can mount and browse like a filesystem. This deployment runs the Kopia repository server with its web UI, centralizing backups from multiple client machines over an authenticated API - each client connects with the server URL and certificate fingerprint, and users only see their own snapshots. Error correction, high-latency-tolerant caching, and both CLI and GUI round it out.

Adopted by over 3,400 companies and backed by 34,000 GitHub stars, Backstage is the open-source developer portal framework created by Spotify and now hosted by the Cloud Native Computing Foundation. The centralized Software Catalog registers every service, library, data pipeline, website, and ML model in your organization using YAML metadata files stored alongside code in GitHub, GitHub Enterprise, or GitLab, tracking ownership, lifecycle status, and dependency relationships across your entire ecosystem. Software Templates provide self-service infrastructure provisioning where developers fill out a form and Backstage automatically scaffolds new repositories, CI/CD pipelines, and cloud resources following your organization's standardized best practices. TechDocs renders Markdown documentation directly alongside the services it describes using a docs-like-code approach powered by MkDocs, with the TechDocs Addon Framework for extending the reading experience. The Search Platform indexes content across the catalog, TechDocs, Confluence, and Stack Overflow through configurable search backends. Kubernetes monitoring built specifically for service owners rather than cluster admins displays pod health, logs, and deployment status across any cloud provider or managed Kubernetes service. The plugin ecosystem includes over 230 open-source integrations covering CI/CD systems like GitHub Actions and GitLab Pipelines, monitoring platforms like Datadog and Grafana, cloud providers including AWS and Azure, plus specialized plugins for security scanning, cost management, API documentation, PagerDuty incident management, and Lighthouse website auditing. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

With over 15,000 GitHub stars and nearly nine years of active development, CapRover is the self-hosted PaaS that replaces Heroku's pricing with your own infrastructure while keeping the deploy-and-forget simplicity. The web dashboard manages application lifecycle from deploy through scaling — configure custom domains, environment variables, persistent volumes, instance counts, and nginx templates without touching config files or SSH. The CLI tool enables scriptable deployments with a single command from your terminal or CI/CD pipeline, while webhook-based deployment triggers automated builds from Git pushes. The one-click app marketplace provides over 100 pre-configured services including WordPress, Ghost, PostgreSQL, MySQL, MongoDB, Redis, Grafana, Portainer, and dozens more, each deployed as a Docker container with volumes and environment variables preconfigured. Automatic HTTPS provisions and renews Let's Encrypt certificates for every custom domain with one-click HTTP-to-HTTPS redirects. Under the hood, Docker Swarm orchestrates containers across multiple nodes for horizontal scaling and load balancing, while nginx handles routing with fully customizable EJS-generated configuration templates per application. Deployment supports four methods: CLI push, tarball upload through the web UI, Docker image reference, and Git repository connection. The build system supports Dockerfiles, captain-definition files with build packs, and direct Docker image pulls. NetData integration provides real-time server monitoring dashboards. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

With over 46,000 GitHub stars and one of the largest communities in data engineering, Apache Airflow is the workflow orchestration platform that lets teams define, schedule, and monitor complex data pipelines as Python code through directed acyclic graphs. Airflow 3.x introduced a modernized architecture with a task execution API, the Language Task SDK for writing task implementations in Java and Go alongside Python, asset-based partitioning with FanOutMapper and FixedKeyMapper for data-driven scheduling, a first-class state store for tasks and assets, pluggable retry policies, and a redesigned React-based web UI built on FastAPI. The provider ecosystem ships 80+ packages covering AWS, Google Cloud, Azure, Snowflake, Databricks, Apache Spark, Apache Kafka, PostgreSQL, MySQL, MongoDB, Slack, HTTP, SSH, Docker, Kubernetes, and dozens more, enabling a single deployment to orchestrate jobs across multi-cloud and on-premises infrastructure. The scheduler supports cron expressions, timetable plugins, data-aware scheduling triggered by asset events, and dynamic task generation through Python loops and conditionals. Built-in operators include BashOperator, PythonOperator, DockerOperator, KubernetesPodOperator, and sensor operators that poll external systems. The web UI provides DAG visualization with Gantt charts, grid views, and graph views, task instance logs, SLA monitoring, connection and variable management, and role-based access control. Deployment options include standalone mode, Docker Compose with CeleryExecutor or KubernetesExecutor, Helm charts for Kubernetes, and managed cloud services. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache License 2.0 licensed.

Trusted by millions of engineers and deployed on over 80,000 GitHub stars worth of community confidence, Netdata delivers true real-time monitoring at per-second granularity — 10-60x faster than Prometheus, Datadog, or any conventional monitoring stack that averages away the transient anomalies lasting 2-10 seconds where most production incidents originate. A single installation command deploys the agent with zero configuration, automatically discovering every running process, container, systemd service, network connection, disk, and application on the host within seconds. Unsupervised machine learning trains multiple models per metric directly at the edge, detecting anomalies without thresholds, baselines, or manual tuning. The distributed Parent-Child architecture scales horizontally from a single Raspberry Pi to fleets exceeding 100,000 nodes while maintaining sub-2-second visualization latency and storing metrics at approximately 0.5 bytes per sample through tiered compression. Native network monitoring provides live topology maps, NetFlow and sFlow analytics, SNMP device polling across 200+ profiles, and trap handling — capabilities that typically require a separate NPM product. Hundreds of pre-configured alerts cover systems and applications out of the box, with AI-powered root cause analysis surfacing correlated metrics through natural language via MCP-compatible AI assistants. The agent supports Linux, macOS, FreeBSD, Kubernetes, and Docker with eBPF-based kernel observability requiring no application instrumentation. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPL v3+ licensed.

Moneat is the open-source observability platform that unifies error tracking, session replay, performance monitoring, logging, uptime checks, synthetics, product analytics, and AI observability into a single self-hosted application — replacing Sentry, Datadog, and Statuspage with one deployment. The Sentry SDK compatibility layer accepts data from @sentry/browser, @sentry/node, @sentry/react, @sentry/nextjs, sentry-sdk for Python, sentry-kotlin, sentry-java, sentry-android, sentry-cocoa, sentry-go, sentry-ruby, and Sentry.NET by updating one DSN endpoint. Datadog Agent compatibility redirects existing fleets by setting dd_url, and native OpenTelemetry OTLP ingestion accepts logs, traces, and metrics from any exporter or Collector. Error monitoring groups exceptions with smart deduplication, session replay records DOM-based user interactions linked to errors, distributed tracing visualizes transaction and span breakdowns with live service maps, and continuous profiling renders flamegraphs in pprof, JFR, and Sentry formats. Uptime monitoring runs HTTP, TCP, and ping checks with public status pages, while synthetics executes API tests, multi-step workflows, SSL checks, and DNS probes. Custom dashboards support drag-and-drop widgets with Grafana import, product analytics provides funnels and retention cohorts, release tracking surfaces crash-free rates with source map upload, and AI observability traces LLM calls end to end. Built on Kotlin and Java with ClickHouse for analytical storage, PostgreSQL for relational data, and Redis for caching, deployment uses Docker Compose with an interactive installer automating secrets and service orchestration. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.