What Dokploy is: a self-hosted deployment platform for small teams

Dokploy is a self-hosted application deployment platform: you install it on your own server, connect it to your code repository, and from then on every push builds a Docker image and brings the application up, complete with a domain and an automatic HTTPS certificate. In short, it gives you a Heroku or Vercel style workflow on infrastructure you own.

Its appeal is that it fills a real gap. Running Docker by hand is tedious and error-prone; Kubernetes is heavy and needs dedicated people. Dokploy sits in between, automated enough that you stop memorising commands, simple enough that one person can still run it.

This article covers what Dokploy does, what sits inside it, who it suits, and the three things newcomers trip over when they take it into production.

What Dokploy does

Once installed on a Linux server, you work with Dokploy through a web interface. The main capabilities:

• Deploy from Git. Connect GitHub, GitLab, Gitea or Bitbucket. Every push to the chosen branch builds and replaces the running version.
• Run Docker Compose. Applications that already ship a compose file go in as they are, with no rewriting.
• Managed databases. Create PostgreSQL, MySQL, MariaDB, MongoDB or Redis from the interface, with scheduled backups.
• Domains and HTTPS. Point a domain at the server and the platform requests a Let's Encrypt certificate and renews it.
• Application templates. Install popular open-source software in a few clicks.
• Logs and monitoring. Read logs and watch CPU and memory per service without opening an SSH session.

What sits inside it

Dokploy does not reinvent the stack. It assembles familiar components and hides the awkward configuration.

The runtime layer is Docker in Swarm mode, so you can replicate services and roll updates without downtime. The routing layer is Traefik, which accepts requests from the internet, sends them to the right container and handles TLS certificates. Builds use Nixpacks or your project's own Dockerfile, whichever you prefer.

Understanding that architecture matters more than the interface, because when something breaks, what you open is a Traefik log or a Swarm service state, not a black box named Dokploy.

Who it suits, and who it does not

Dokploy fits teams that want control of their infrastructure without staffing an operations group. Concretely:

• Small product teams running a few dozen services on one or several VPS instances, wanting a consistent deployment process.
• Organisations whose data must stay in-country or inside the internal network rather than on a foreign platform.
• Test and staging environments that need to appear quickly, disappear quickly and cost little.

There are places where it is the wrong answer. If you need autoscaling across several clusters, fine-grained network policy between services, or you already have a team fluent in Kubernetes, Dokploy will feel like a jacket a size too small. If your application is a static site, static hosting is cheaper and lighter.

Compared with the alternatives

• Dokploy. Runs on Docker Swarm, easy to start, basic multi-server support. Suits small teams that want control of their infrastructure.
• Coolify. Same segment, runs on Docker, stronger on the number of integrations and ready-made service templates.
• CapRover. Also Docker Swarm, older, often picked for personal projects.
• Kubernetes. A different class: autoscaling, fine-grained network policy, many clusters. In exchange it effectively requires a dedicated operator.

This list is not there to crown a winner. The first three solve the same problem and differ mostly in interface taste and plugin ecosystem. Kubernetes belongs to a different class: far more capable, at an operational cost small teams often cannot pay.

Three things newcomers trip over

This section matters more than the feature list, because it is where a real system diverges from a demo.

Nobody is guarding the gate. Traefik is a router, not an application firewall. A default installation filters no malicious payloads, blocks no password guessing and applies no rate limits. Your application faces the internet directly. We wrote a separate guide on closing that gap: adding a WAF and IPS on a Dokploy server. For a fuller protective layer you can still run yourself, Orca WAAP is the next step.

Docker does not consult your firewall. Docker writes its own iptables rules, so a port you believe UFW has closed may still be open to the world. After installing, check from another machine which ports are actually listening instead of trusting a rule listing.

A backup counts only once you have restored it. The platform schedules database backups, but an untested backup is a belief, not a safeguard. Restore one onto an empty server at least once, and time it, because that number is your downtime on a bad day.

Is self-hosting the right call for a business

For many organisations in Vietnam the question goes beyond convenience. The Personal Data Protection Law places obligations on customer data, and some categories of data simply should not leave infrastructure the organisation controls. In that situation a deployment platform running on your own servers stops being a technical preference and becomes a way to meet a requirement.

In exchange you take on patching, monitoring and recovery. That is a genuine trade-off and deserves a clear-eyed decision rather than a slogan. We examined both directions in on-premise or cloud for data compliance.

How to start

You need a Linux server, roughly two cores and 2 GB of RAM for light use, a domain pointing at it, and ports 80 and 443 open. Installation is a single command, after which you create an administrator account in the web interface.

Before putting a real application on it, do three things in order: change the admin port and restrict who can reach the interface, put a filtering layer at the ingress, and run one restore drill. Those three take an afternoon and save you several sleepless nights later.

In summary

Dokploy is a tidy way to get a modern deployment workflow on infrastructure you own. It does not replace Kubernetes and it does not make your system secure by itself. What the platform handles is building, routing and certificates. Everything else, from the shield at the front door to the recovery procedure, remains the operator's job, and that is the part that decides how long the system survives.