Self-hosted PaaS: running applications on your own hardware
A self-hosted PaaS does what Heroku or Vercel do, on hardware you own. A VPS, an office server, a mini PC at home. Your data and the applications you install stay on your machine.
What separates these products
They all install applications. The difference is what happens after the install:
- Creating a database and connecting it to the app
- A domain and an HTTPS certificate
- Signing in without a separate account per app
- Backup schedules and storage
- Addresses and credentials between apps
Most products automate the install and leave the rest to you.
The products
- Coolify — Open source. Docker. The largest one-click catalog. Compare
- Dokploy — Open source. Docker Swarm. Runs your Compose files. Compare
- CapRover — Open source. Docker Swarm. Many templates, long track record. Compare
- OpenShift — Red Hat's Kubernetes platform. Assumes a cluster and a team to run it.
- tidoly — Commercial. Kubernetes (k3s). Catalog entries install with their connections configured.
How a deploy works, and what happens when a machine fails
Coolify builds on a webhook, then connects to your server over SSH and runs the container there. There is no orchestrator underneath, so a container does not move to another machine if one fails. Several servers are managed one by one.
Dokploy and CapRover use Docker Swarm. If a node drops out, its containers start again on another node.
tidoly deploys through GitOps on Kubernetes (k3s). The deployed state is recorded in git, and workloads move when a node fails.
How tidoly works
Each catalog entry declares the resources it needs. On install, the platform creates and connects them.
- Database — Created, user issued, credentials injected. Nobody sees the password.
- Domain — Enter one. Ingress and TLS are configured, including renewal.
- Sign-in — The OIDC client is created and callback URLs are set.
- App-to-app — Defined as types. When an address or credential changes, dependents are updated.
- Object storage and VPN — S3-compatible storage (SeaweedFS) and a private network (headscale) are catalog entries like any other, and they arrive connected. No external bucket, no key exchange.
- Backups — Scheduled at install time. Storage included.
- MCP — Generated per installed app, so an AI agent can work with repositories, issues and dashboards.
This layer is called application dependency resolution. Standards such as servicebinding.io sit below it and define how credentials reach a workload. The two can meet later.
It replaces a stack, not a product
Running services on your own hardware normally means choosing, wiring and maintaining all of this separately.
- The server — VPS, dedicated, or hardware you already own
- Running Kubernetes — installation, upgrades, node management
- Deploying apps — finding a Helm chart or Operator, filling in values, keeping them current
- A management console — something in the Rancher family
- Observability — collecting metrics and building dashboards
- Networking and certificates — ingress, domains, TLS issuance and renewal
- Sign-in — wiring each app's own auth into OIDC
- An app catalog — what to install at which version, and what happens on the next update
Good products exist for every one of these. The problem is that choosing them and joining them up is entirely a person's job. Change one and the rest move with it, and someone who understands those links has to stay around.
tidoly goes in that seat — it folds the list above into one install and one screen. The server stays yours; what we replace is the work of joining things on top of it.
So read the table below as "how much of this stays a person's job" rather than "which product is better".
Self-hosting platforms compared
| Feature | tidoly | Coolify | Dokploy | CapRover | OpenShift |
|---|---|---|---|---|---|
| Runs on | Kubernetes (k3s) | Docker | Docker Swarm | Docker Swarm | Kubernetes |
| Deploying your own app | Built-in pipeline (GitOps) | SSH + Docker | Swarm | Swarm | S2I / BuildConfig |
| Scale | Add nodes | Managed separately | Swarm | Swarm | Cluster required |
| Needs a dedicated engineer (infrastructure skills) ¹ | No | Yes | Yes | Yes | Yes |
| Open source | No | Yes | Yes | Yes | No ² |
| Install an app from a catalog | Yes | Yes | Yes | Yes | Yes |
| Create a database | Yes | Yes | Yes | Yes | Yes |
| └ credentials delivered to the app | Yes | No | No | No | No ³ |
| └ app updated when credentials change | Yes | No | No | No | No |
| Scheduled backups | Yes | Yes | Yes | No | Yes |
| └ configured when the app is installed | Yes | No | No | No | No |
| └ backup storage included | Yes | No | No | No | No |
| Domain with automatic HTTPS | Yes | Yes | Yes | Yes | Yes |
| Private network (VPN) connected for you ⁶ | Yes | No | No | No | No |
| Sign-in configured for installed apps | Yes ⁴ | No | No | No | No |
| App-to-app links maintained | Yes | No | No | No | No |
| Upgrades prepared by the platform | Yes ⁵ | No | No | No | No |
| Workloads moved if a node fails | Yes | No | Yes | Yes | Yes |
| MCP for AI agents | Yes | Yes | Yes | No | No |
Based on each project's public documentation, 21 August 2026.
- ¹ The three Docker-based products do not use Kubernetes, but the work does not disappear with it: databases, backups, sign-in, certificates and upgrades are configured by a person. The rows below are that list. OpenShift adds running the cluster.
- ² OKD is open source. OpenShift is a subscription product.
- ³ A different layer. servicebinding.io and the Service Binding Operator (archived June 2024) define how credentials reach a workload. This row asks the step before that: does the catalog declare what the app needs, and does the platform create it and connect it?
- ⁴ Argo CD, Grafana and Gitea today. More as the catalog grows.
- ⁵ The new version arrives with its upgrade plan. An administrator approves before it is applied.
- ⁶ The others have VPN templates too. Installing one leaves you the keys, peers and endpoints. On tidoly the VPN is connected when it is installed. Tunnelling, for publishing without a fixed IP, is a separate paid option.
What the difference comes down to
All five install applications on hardware you own. Your data and the applications you install stay on your machine.
The difference is what happens next: databases, sign-in, backups, app-to-app links, upgrades. tidoly configures these automatically. The others are configured by you.
If you need open source, or the largest catalog, choose Coolify or Dokploy. tidoly is commercial and offers a trial.