You have a repo that builds fine on your laptop, a VPS with Docker, and a gap in the middle where someone still SSHs in, runs a script, prays, and updates DNS by hand. Coolify and Dokploy solved that for a lot of people — but if you want push-to-deploy, automatic TLS, and a control plane you can run as a desktop app or on a always-on box, Openship (~15k stars, Apache-2.0) is worth a serious look.
Openship is a self-hosted deployment platform with CI/CD baked in: point it at a GitHub repo, a local folder, or an artifact, and it detects the stack, builds a Docker image (or bare release), runs the app behind loopback, then lets an OpenResty edge terminate TLS and route your domain. Webhooks re-run the pipeline on push. Same idea as "mini-Heroku on your metal," but with a polished dashboard, CLI, desktop app, and an SDK if you want to script deploys.
Three ways to run the control plane
The README is explicit about this, and it matters for how you self-host:
Solo / no always-on server: the desktop app (macOS, Windows, Linux AppImage) runs Openship locally while it's open. You connect to a remote server over SSH or Openship Cloud and deploy from there — nothing public on your laptop.
Team or push-to-deploy: install the CLI (curl -fsSL https://get.openship.io | sh or npm i -g openship, Node 22+), run openship for the wizard or openship up --public-url https://openship.example.com for headless setup. Login is required on a self-hosted instance; you create the admin during setup.
Linux + Docker → Compose mode (default on openship up): Postgres, Redis, API, dashboard, and a containerized OpenResty edge on :80/:443. Apps you deploy can live on the same machine, with Let's Encrypt via HTTP-01. Bare mode (macOS/Windows or Linux without Docker) is a lighter always-on process that orchestrates deploys out to SSH targets or Cloud — like the desktop app, but always on.
You can also skip the CLI and use docker/docker-compose.yml from the repo (images on ghcr.io/oblien/*). The API container mounts the host Docker socket so it can build and run your apps — powerful, but only on hosts you trust.
What happens when you deploy
The pipeline is opinionated in a good way:
- Detect — reads
package.json, lockfiles, framework config, optionalopenship.jsonordocker-compose.ymlto infer build/start commands and port - Build — on the target or orchestrator; config is snapshotted so rollbacks replay the same commands
- Run — container on loopback or supervised host process (not a random public port)
- Route + TLS — edge writes the vhost and fetches a cert; DNS/cert issues show as "action required" instead of killing a good deploy
- Webhook — GitHub push retriggers the pipeline; monorepos only rebuild what changed
Beyond apps: managed Postgres/MySQL/Mongo/Redis, workers, storage, scheduled backups, built-in SMTP with DKIM/SPF/DMARC (no Mailgun required for basic outbound), CDN-style edge caching, live build logs and metrics. There's an MCP surface for AI agents and a REST API — only opted-in routes become tools, with permission checks on every call.
Why self-host Openship instead of a SaaS PaaS?
No platform tax on your own iron. Self-hosting is free in their model — you're paying for the VPS and your time, not per-seat deploy fees.
Your repos and env vars stay on infrastructure you name. For agencies shipping client apps from Canadian boxes, that's easier to explain than "we use Vendor X's US control plane."
Standard Docker output. You're not locked into a proprietary runtime; containers can move if you outgrow one provider.
Compose mode fits a single strong VPS. If you already run Coolify or Dokku elsewhere, Openship isn't a drop-in replacement — it's a different UX (desktop + wizard + edge mail/CDN story). Pick one control plane per machine unless you enjoy port 80 fights.
What to plan for
Hardware: Compose mode with local builds wants a real VPS — think 4 GB RAM minimum, more if you build Node monorepos on-box. Edge + Postgres + Redis + concurrent builds add up fast.
Security: Docker socket access from the API is root-equivalent on the host. Harden SSH, firewall everything except 80/443, and don't co-locate untrusted tenants on the same Openship host.
DNS: Automatic certs need correct A/AAAA records before the edge can finish TLS. Openship separates "app is up" from "domain is green," which saves you from failed deploys when Cloudflare is still propagating.
Host operations: Raw Compose without openship up skips the container→host SSH channel; advanced host terminal/port scans need extra setup documented in their troubleshooting guide. Day-one deploys work without it.
Who it's for
Freelancers who want Heroku-like flows on a Canadian VPS, small teams that need a shared dashboard and GitHub webhooks, and homelabbers who'd rather click "deploy" than maintain a bash script per project. Skip it if you only need static files (use nginx or a static host) or if you're allergic to running a control plane plus databases on the same box as production apps.
We host the underlying machines — you bring the domain and repo. Docker hosting in Canada with snapshots and firewall baselines pairs well with Compose-mode Openship. Tell us how many projects you deploy and whether builds run on the VPS or remotely and we'll size the server before you hand Openship the Docker socket.
