Coolify: Your Own Heroku and Vercel on One Server (Linux, Windows, Mac)

What you get in one minute#

Coolify is an open-source, self-hosted alternative to Heroku, Vercel and Netlify: you install it on one Linux server, then deploy apps, databases and one-click services from a web dashboard.

You push code to Git, Coolify builds it, starts the container, puts a domain and an HTTPS certificate in front of it, and keeps the logs. Databases get scheduled backups, optionally to S3. People use it to stop paying per-app hosting bills and to keep their projects on a server they control.

Coolify itself runs on Linux only. Windows and Mac are where you sit: a browser for the dashboard and a terminal for SSH. If you only have a Windows or Mac machine, test it in a Linux virtual machine first (see "Before you start").

Which version? I looked for repeated "this release is broken" reports for v4.5.0 (3 days old when this was written). I found none: the newest issues are small bugs (empty disk chart, a Nginx version pin in the image). The release does change two things worth watching: secrets are now encrypted at rest, and environment variable escaping changed. So this guide uses the latest, v4.5.0. If you want the cautious choice, v4.4.7 is the other release the maintainers recommend, but older lines miss security fixes. More on that in the security section.

How it fits together#

You manage Coolify from a browser; Coolify builds your code and starts containers; its built-in Traefik proxy sends each domain to the right container and handles certificates.

Everything runs on the same server by default. You can add more servers later over SSH.

Before you start#

You need a fresh Linux server you can reach over SSH, and a Windows or Mac machine with a terminal.

Server (the only place Coolify runs):

• Debian or Ubuntu LTS (20.04, 22.04, 24.04) is the easy path. Other families (Red Hat types, SUSE, Arch, Alpine, 64-bit Raspberry Pi OS) are listed as supported too.
• 2 CPU cores, 2 GB RAM, 10 GB free disk. The docs say 1 core and 1 GB works for a start but is not recommended.
• Root access (or a sudo user). Use a fresh server: setup can install Docker and restart the Docker service.
• If Docker came from snap, remove it first. On non-LTS Ubuntu, use the manual install from the docs.

Your own machine:

• Windows: PowerShell 7 or Windows PowerShell. The OpenSSH client (ssh) is built into Windows 10 and 11.
• Mac: the built-in Terminal has ssh.
• No spare server? Use a Linux VM (VirtualBox, VMware, Multipass or similar) with a bridged network so you can reach port 8000 from your own machine. WSL2 is not mentioned in the official docs as a supported host, so treat it as untested (VERIFY before you rely on it).

Checklist:

• [ ] Server reachable: ssh root@<server-ip> works
• [ ] Ports 22, 80, 443 and 8000 allowed in the provider firewall
• [ ] A domain with DNS control (only needed for the HTTPS section)
• [ ] A password manager ready for the saved .env secrets

Tested on 2026-10-26: not run by DIY Lab Hub. Every command below was checked against the official Coolify docs and release notes of that date.

Step 1: Install Coolify on the server#

One command installs Docker if needed, downloads Coolify and starts it.

Linux#

Log in to the server and run the official installer:

ssh root@<server-ip>
curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash

The installer installs the latest stable release, which is v4.5.0 today. To pin it, pass the version (the maintainers use this form in their release notes):

curl -fsSL https://cdn.coollabs.io/coolify/install.sh | sudo bash -s 4.5.0

Want the admin account created for you, so the registration page is never open to the internet? Set the root user in the same command (docs, "Root user"):

env ROOT_USERNAME=RootUser \
[email protected] \
ROOT_USER_PASSWORD='<A_STRONG_PASSWORD>' \
bash -c 'curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash'

Check it worked. At the end the installer prints a "Congratulations" message with the dashboard link:

docker ps --format '{{.Names}} {{.Status}}'

You should see coolify, coolify-db, coolify-redis and later coolify-proxy running. (Container names from the official restore docs.)

Windows (PowerShell)#

Coolify does not install on Windows. You only need SSH. Run the installer on the server through SSH, in one line:

ssh root@<server-ip> "curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash"

Check it worked:

ssh root@<server-ip> "docker ps --format '{{.Names}} {{.Status}}'"

Mac (Terminal)#

Same commands as Linux, run from your Mac through SSH:

ssh root@<server-ip> "curl -fsSL https://cdn.coollabs.io/coolify/install.sh | bash"

Potential issue: if the install stops halfway, run the same command again. A stopped Docker daemon is handled by the installer in v4.5.0.

Step 2: Create the admin account and save the secrets#

Create the admin account straight away: whoever opens the registration page first becomes the admin, and that means root on your server.

Open http://<server-ip>:8000 in your browser (Windows, Mac or Linux all the same), fill in the registration form, and log in.

Now save the file that holds the encryption key. The docs are clear: without APP_KEY you cannot read your stored secrets after a restore.

Linux#

grep '^APP_KEY=' /data/coolify/source/.env

Copy the whole APP_KEY=... line into your password manager. Never paste it anywhere public.

Windows (PowerShell)#

ssh root@<server-ip> "grep '^APP_KEY=' /data/coolify/source/.env"

Mac (Terminal)#

Same command as the Windows one, in Terminal.

Step 3: Check the server and the proxy#

Coolify registers the server it runs on as localhost; the first thing to confirm is that the proxy is running.

Everything in this step happens in the browser, so it is the same on every system.

Linux#

Open the dashboard in any browser. Optional check on the server: docker ps --filter name=coolify-proxy.

Windows (PowerShell)#

Open the dashboard in Edge, Chrome or Firefox. Optional check: ssh root@<server-ip> "docker ps --filter name=coolify-proxy".

Mac (Terminal)#

Same as Linux: browser for the dashboard, and ssh root@<server-ip> "docker ps --filter name=coolify-proxy" for the optional check.

In the dashboard open Servers, then your server. The status should say the proxy is running. If it is stopped, click Start Proxy. Docs: Servers, "Add Server".

To add a second server later: Keys & Tokens > Private Keys > New private key > Generate ED25519, copy the public key into the other server's ~/.ssh/authorized_keys (chmod 700 ~/.ssh, chmod 600 ~/.ssh/authorized_keys), then Servers > New server > IP address or domain, choose the key and click Validate connection. Do not put a passphrase on the key: Coolify must use it without a prompt.

Step 4: Deploy your first app#

The quickest test uses a ready-made image, so nothing can go wrong with Git or builds.

Deploying is done in the dashboard, so the click path is the same on every system. The only difference is how you check the result.

Linux#

Check it worked: curl -I http://<generated-sslip-domain> should answer 200.

Windows (PowerShell)#

Check it worked: curl.exe -I http://<generated-sslip-domain> (use curl.exe, not the curl alias).

Mac (Terminal)#

Same commands as Linux.

1. Projects > New Project, give it a name.
2. Create New Resource > Docker Image, enter nginx:alpine.
3. Set Ports Exposes to 80, then Deploy.
4. Open the generated sslip.io URL. You should see the Nginx welcome page.

That sslip.io domain needs no DNS and is for testing only (official docs, "Deploy your first app").

Deploy from a Git repository#

1. Create New Resource, pick your Git source (public repo, GitHub App, GitLab, Bitbucket or Gitea; Gitea private repos are new in v4.5.0).
2. Choose the build pack. Nixpacks is now marked deprecated and Railpack is recommended in the v4.5.0 notes. A Dockerfile also works.
3. Set the port the app listens on, add environment variables, deploy.
4. Turn on auto-deploy so every push builds a new version.

Deploy a Docker Compose file#

Pick the Docker Compose build pack and paste a Compose file. No version: line, one example:

services:
  web:
    image: nginx:alpine
    restart: unless-stopped
    environment:
      - SERVICE_FQDN_WEB_80
    volumes:
      - web-data:/usr/share/nginx/html
volumes:
  web-data:

SERVICE_FQDN_WEB_80 is Coolify's magic variable that gives the web service a domain on port 80 (VERIFY the exact name in the current docs before relying on it; v4.5.0 notes mention SERVICE_FQDN_ and SERVICE_URL_ variables). Breaking change in v4.5.0: Compose files with scale or replicas above 1 are rejected.

Coolify keeps volumes itself. If you want a data folder you can see and back up, use a bind mount to a folder such as $HOME/docker_volumes/<app>/data on the server (Docs: "Bind mounts"). Create the folder first.

One-click services and databases#

• Create New Resource > Services lists the 300+ one-click apps (Umami is the docs' first example). Coolify fills in passwords and domains.
• Create New Resource > Databases offers PostgreSQL, MySQL, MariaDB, MongoDB, Redis, Dragonfly, KeyDB and ClickHouse. A database is not exposed to the internet unless you ask for a public port.

Step 5: Add a domain and automatic HTTPS#

Point a DNS record at the server, add the domain in the app, redeploy: Coolify's proxy gets the certificate.

The DNS record is made at your domain provider; the checks differ per system.

Linux#

dig +short app.<your-domain>

Windows (PowerShell)#

Resolve-DnsName app.<your-domain>

Mac (Terminal)#

Same commands as Linux (dig is built in).

1. DNS: create an A record app.<your-domain> pointing to the server IP.
2. Open the app > Domains > Add domain, choose https, enter app.<your-domain>, set the port if needed.
3. Redeploy. Ports 80 and 443 must be open, because the certificate challenge uses port 80.

Check it worked:

curl -I https://app.<your-domain>

Run it in Linux or Mac Terminal; on Windows use PowerShell 7's curl.exe -I https://app.<your-domain>. Expect a 200 (or the app's own redirect).

Put the dashboard itself on a domain too: Settings > General > URL https://coolify.<your-domain>. After it works through the proxy you can close ports 8000, 6001 and 6002 (official firewall docs). If the dashboard sits behind Cloudflare or another proxy that talks HTTP to Coolify, turn off "Redirect HTTP to HTTPS" or you get a redirect loop.

Put it behind HTTPS with Traefik#

Coolify already ships Traefik (the coolify-proxy container), so you rarely write labels yourself. Skip this section if you use the Domains field above. It is for people on a server with a domain who want custom routing.

The proxy listens on 80 and 443, uses the letsencrypt certificate resolver and keeps its main file at /data/coolify/proxy/docker-compose.yml. Edit it in the dashboard under Servers > your server > Proxy > Configuration, because edits made only on disk can be overwritten.

For a Compose app where you manage labels yourself (manual label mode), the labels look like this (VERIFY the entrypoint and network names on your server before use):

services:
  web:
    image: nginx:alpine
    restart: unless-stopped
    labels:
      - traefik.enable=true
      - traefik.http.routers.web.rule=Host(`app.<your-domain>`)
      - traefik.http.routers.web.entryPoints=https
      - traefik.http.routers.web.tls=true
      - traefik.http.routers.web.tls.certresolver=letsencrypt
      - traefik.http.services.web.loadbalancer.server.port=80
    networks:
      - coolify
networks:
  coolify:
    external: true

Docs for custom middlewares, basic auth and an Authentik forward-auth setup are under Proxy > Traefik. Caddy is also supported as the proxy.

Step 6: Databases with S3 backups#

A backup schedule lives on the database; a copy goes to S3 if you add storage.

Backups are configured in the dashboard on every system; the restore check is a database connection from your own machine.

Linux#

Check it worked: in the database's Backups tab the newest entry shows Success. List files on the server with ls -lh in the folder Coolify names there.

Windows (PowerShell)#

Same dashboard click path. To look at the server side: ssh root@<server-ip> "docker ps --format '{{.Names}}'".

Mac (Terminal)#

Same commands as Linux.

1. S3 Storage: add a bucket (Cloudflare R2, Amazon S3 and other S3-compatible providers are covered in the docs). Use a key limited to that bucket.
2. Open your database > Backups > + Add, set a cron expression, save.
3. Pick the S3 storage so each backup is uploaded.

Backups run on the database's server and only while the database is running. PostgreSQL, MySQL, MariaDB, MongoDB, ClickHouse and SQLite are supported; Redis, Dragonfly and KeyDB are not. In v4.5.0 the S3-only volume backup crash is fixed (issue #12303) and PostgreSQL backups set PGPASSWORD.

Security and testing#

Coolify holds SSH keys to your servers, so a hole in it is a hole in everything. Treat it like a bastion host.

• Update first. From July 2026 the project published about 20 advisories against v4 betas and early v4.0: command injection and remote code execution (for example CVE-2026-42204, CVE-2026-34597, CVE-2026-42143), cross-team access flaws that exposed SSH keys (CVE-2026-34592, CVE-2026-57498, rated critical), unauthenticated deployment triggers (CVE-2026-41896) and WebSocket/terminal access flaws (CVE-2026-34047, CVE-2026-34048, both critical). The fixes landed by 4.0.0-beta.474. Anything older is unsafe. List: github.com/coollabsio/coolify/security/advisories.
• v4.4.7 and v4.5.0 add more fixes (PHP 8.4.27 for CVE-2026-109618 and CVE-2026-109619, Sentinel 1.1.2 for CVE-2026-111943, Node.js and cloudflared updates). The v4.4.7 notes say the old lines get security releases (v4.0.1, v4.1.3, v4.2.1, v4.3.24) and that the minor releases carry other fixes too, so move to the newest line.
• Keep the dashboard off the public internet. Close 8000, 6001 and 6002 once the domain works. Better still, reach it through an SSH tunnel and keep the domain private:

ssh -L 8000:localhost:8000 -L 6001:localhost:6001 -L 6002:localhost:6002 root@<server-ip>

Then open http://localhost:8000. Same command works in Windows PowerShell and Mac Terminal. (Tunnel for 6001 and 6002 is how I read the firewall docs; VERIFY the live terminal and update widgets still work.)

• Firewall. Use the provider firewall: SSH only from your own address, 80 and 443 open. Docker bypasses ufw for published ports, which is why the docs point to a provider firewall or ufw-docker.
• SSH keys. ED25519, no passphrase for Coolify's own key, keep the private key only in Coolify. Prefer a non-root user once you are set up (docs: "Non-root User").
• Two factors and SSO. Turn on 2FA on the admin account. v4.5.0 adds passkey sign-in. Authentik, GitHub, GitLab and others are supported as login providers.
• API tokens. Since v4.5.0 a token needs the deploy ability for risky actions. Give each integration only what it needs.
• Secrets. Keep the APP_KEY copy in a password manager; .env files that hold secrets should be chmod 600.

Status checks:

docker ps --format '{{.Names}} {{.Status}}'
docker logs coolify --tail 100

Troubleshooting#

Known bugs#

Taken from the GitHub issue tracker on 2026-10-26, none of them blocks an install:

• Disk usage chart stays on "Loading disk metrics..." or empty (#12315, #12292).
• The Files tab shows "This folder is empty" for containers without a shell (#12305).
• The v4.5.0 production image still pins Nginx 1.31.2-r1 (#12311).
• A PayloadCMS build fails after switching to Railpack (#12314). Try your old build pack if a build breaks.

Updates and backups#

Back up first, then update. Test the restore once, before you need it.

Update#

Dashboard: Settings > Updates. You can click Check now and then update, or enable Automatic updates and set the frequency. The default update schedule is daily at midnight (0 0 * * *), the version check runs hourly, and the dashboard is offline for under a minute. If the dashboard settings cannot be saved, set AUTOUPDATE in /data/coolify/source/.env. v4.5.0 also makes an automatic Coolify database backup before an update.

Auto-update is a trade-off: it keeps you patched, but it can also install a release that breaks. A weekly schedule is a calm middle. Downgrading is possible but only from the terminal (docs: "Downgrade Coolify").

Back up the instance#

Settings > Backup: first visit, click Configure backup (daily by default). Click Back up now and wait for the status Success. Download a copy to your own machine. The backup holds only Coolify's own database, not your apps' data, and it does not include the APP_KEY, so you need both.

Restore test (do this once)#

1. Create a throwaway database in Coolify, add a few rows, run a backup.
2. Create a second throwaway database and restore that backup into it (docs: Databases > "Restore a Database").
3. Connect and count the rows. Same count means the backup is real.
4. Delete both throwaway databases.

To restore the whole instance, the docs list what you need: the .dmp backup file, the saved APP_KEY, and SSH access. On the same server the first steps are docker ps --filter name=coolify-db to confirm the database container runs, then docker stop coolify coolify-redis; follow the current "Restore Coolify" page for the exact restore command rather than a copy from here.

Schedule: the instance and database backups run inside Coolify, so you need no cron or Task Scheduler on Windows or Mac. Just keep your copy of APP_KEY current.

Performance and resources#

I did not measure this myself. The official docs give one real example: a Hetzner CAX11 (2 vCPU, 4 GB RAM, 40 GB disk) runs 16 static sites, 9 Rust API services, 5 full-stack Rust apps, bots, workers, 2 Valkey databases and 1 PostgreSQL database, using about 2.6 GB RAM and 60-70% CPU on average.

• Builds are the heavy part. If builds make the server unresponsive, add a dedicated build server (server role "Builds only").
• Watch docker stats and the Metrics page (new fleet metrics in v4.5.0).
• Automated Docker cleanup is in the server settings; turn it on so old images do not fill the disk.

FAQ#

Can I run Coolify on Windows or Mac? Not directly. It needs a Linux server. Run it on a VPS or a Linux VM and use your Windows or Mac machine for the browser and SSH.

Is it safe to expose the dashboard? Only after updating to a patched version, with 2FA and a domain over HTTPS. Safer: keep it private and use an SSH tunnel.

Do I have to use Traefik? No. Traefik is the default and Caddy is supported. A custom proxy is possible but then you handle routing and certificates yourself.

What happens to my apps if Coolify is down? They keep running. The restore docs say deployed resources and the proxy keep running while you restore the control plane.

Should I turn on automatic updates? For a hobby server, yes, weekly. For anything people depend on, check the release notes and update by hand after a backup.

Sources#

• Coolify install and requirements: coolify.io/docs/get-started/installation (read 2026-10-26)
• Deploy your first app: coolify.io/docs/deploy-your-first-app (read 2026-10-26)
• Add server: coolify.io/docs/core/infrastructure/servers/add-server (read 2026-10-26)
• Firewall: coolify.io/docs/knowledge-base/server/firewall (read 2026-10-26)
• Domains: coolify.io/docs/core/networking/domains (read 2026-10-26)
• Traefik overview: coolify.io/docs/knowledge-base/proxy/traefik/overview (read 2026-10-26)
• Instance settings: coolify.io/docs/core/instance-management/instance-settings (read 2026-10-26)
• Update Coolify: coolify.io/docs/core/instance-management/update (read 2026-10-26)
• Back up Coolify: coolify.io/docs/core/backup-and-recovery/instance-backup (read 2026-10-26)
• Restore Coolify: coolify.io/docs/core/backup-and-recovery/instance-restore (read 2026-10-26)
• Database backups: coolify.io/docs/databases/backups (read 2026-10-26)
• Release v4.5.0: github.com/coollabsio/coolify/releases/tag/v4.5.0 (2026-10-23)
• Release v4.4.7: github.com/coollabsio/coolify/releases/tag/v4.4.7 (2026-10-21)
• Security advisories: github.com/coollabsio/coolify/security/advisories (read 2026-10-26)
• Install script: cdn.coollabs.io/coolify/install.sh

Checked against the official docs and GitHub on 2026-10-26.