{"id":2923,"date":"2026-10-29T09:28:18","date_gmt":"2026-10-29T09:28:18","guid":{"rendered":"https:\/\/hostry.com\/blog\/?p=2923"},"modified":"2026-10-29T09:28:20","modified_gmt":"2026-10-29T09:28:20","slug":"coolify-vs-dokploy-vs-caprover","status":"publish","type":"post","link":"https:\/\/hostry.com\/blog\/coolify-vs-dokploy-vs-caprover\/","title":{"rendered":"Coolify vs Dokploy vs CapRover: Which Self-Hosted PaaS to Pick"},"content":{"rendered":"\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"892\" height=\"508\" src=\"https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-b2_main.png\" alt=\"Coolify vs Dokploy vs CapRover: three self-hosted PaaS dashboards compared on one Linux VPS\" class=\"wp-image-2919\" srcset=\"https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-b2_main.png 892w, https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-b2_main-300x171.png 300w, https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-b2_main-450x256.png 450w, https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-b2_main-768x437.png 768w\" sizes=\"auto, (max-width: 892px) 100vw, 892px\" \/><\/figure>\n\n\n\n<pre class=\"wp-block-preformatted\" style=\"font-size:14px\"><em><strong>Coolify vs Dokploy is a close call on one VPS: Coolify is fully Apache 2.0 and fits solo developers who want automatic panel updates, while Dokploy suits teams that may grow into a Docker Swarm cluster. CapRover is the pick for the smallest server and the simplest setup if you can live with one shared password and paid-only 2FA.<\/strong><\/em><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Each of these panels installs in a few commands, and each dashboard can run any container as root, so the choice is a security decision as much as a feature one. Each needs a <strong><a href=\"https:\/\/hostry.com\/products\/vps\/\">Linux KVM VPS with full root access<\/a><\/strong> and ports 80 and 443 to itself. Commands and table cells below were checked against the docs and GitHub repositories on October 29, 2026.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What a self-hosted PaaS does (and when Docker Compose is enough)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A <strong>self-hosted PaaS<\/strong> is a <strong>Heroku alternative<\/strong> that runs on your own server. A Git push triggers a Docker image build, swaps the running container and routes traffic through a reverse proxy that renews Let&#8217;s Encrypt certificates on its own. The same dashboard creates database containers and holds environment variables and logs.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"800\" src=\"https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-architecture-v2.png\" alt=\"Self-hosted PaaS on a VPS: git push triggers a build, a reverse proxy with Let's Encrypt routes HTTPS to app and database containers, backups go to S3 storage\" class=\"wp-image-2921\" srcset=\"https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-architecture-v2.png 1200w, https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-architecture-v2-300x200.png 300w, https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-architecture-v2-1024x683.png 1024w, https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-architecture-v2-450x300.png 450w, https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-architecture-v2-768x512.png 768w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/><figcaption>Everything except the backup bucket runs on the one VPS, and the dashboard is reached through an SSH tunnel until it has its own HTTPS domain.<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">For one or two services that change a few times a year, a <span class=\"highlighted\">docker-compose.yml<\/span> plus Caddy or Traefik is lighter and has less to patch. A PaaS earns its RAM when you <strong>deploy Docker apps on a VPS<\/strong> several times a week, host projects for other people or want pull-request previews, which Coolify and Dokploy have built in. Dokploy&#8217;s docs advise against previews on public repositories, since outsiders could then trigger builds on your server.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Coolify vs Dokploy vs CapRover at a glance<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Release tags and rounded template-repository counts as of October 29, 2026:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Feature<\/th><th>Coolify<\/th><th>Dokploy<\/th><th>CapRover<\/th><\/tr><\/thead><tbody><tr><td>License<\/td><td>Apache 2.0<\/td><td>Apache 2.0, except code in <span class=\"highlighted\">\/proprietary<\/span> folders (source-available DSAL)<\/td><td>Apache 2.0; paid Pro add-on<\/td><\/tr><tr><td>Latest release<\/td><td>v4.5.3, Oct 28, 2026<\/td><td>v0.30.10, Oct 22, 2026<\/td><td>v1.15.5, Oct 23, 2026<\/td><\/tr><tr><td>Runs on<\/td><td>Docker; Swarm deprecated, removal planned for v5<\/td><td>Docker Swarm (single node by default)<\/td><td>Docker Swarm<\/td><\/tr><tr><td>Proxy and TLS<\/td><td>Traefik (default) or Caddy, automatic Let&#8217;s Encrypt<\/td><td>Traefik, Let&#8217;s Encrypt per domain<\/td><td>NGINX with Certbot (Let&#8217;s Encrypt)<\/td><\/tr><tr><td>Git deploys<\/td><td>GitHub App, GitLab, Bitbucket, Gitea, webhooks<\/td><td>GitHub, GitLab, Bitbucket, Gitea<\/td><td>Webhook per app, or <span class=\"highlighted\">caprover deploy<\/span> from the CLI<\/td><\/tr><tr><td>Docker Compose<\/td><td>Yes (Compose build pack)<\/td><td>Yes, native<\/td><td>Supported subset, marked experimental<\/td><\/tr><tr><td>After a bad deploy<\/td><td>Manual rollback to an older image still on the server<\/td><td>Automatic Swarm rollback if health checks fail (needs a <span class=\"highlighted\">\/health<\/span> endpoint); manual registry-based rollback<\/td><td>One-click rollback to an earlier image version<\/td><\/tr><tr><td>One-click templates<\/td><td>350+<\/td><td>580+<\/td><td>360+<\/td><\/tr><tr><td>Database backups to S3<\/td><td>Scheduled: PostgreSQL, MySQL, MariaDB, MongoDB, ClickHouse, SQLite<\/td><td>Scheduled, to S3 destinations; volume backups too<\/td><td>No; only CapRover&#8217;s own config is backed up<\/td><\/tr><tr><td>More than one server<\/td><td>Remote servers over SSH; multi-server deploys need an external load balancer<\/td><td>Remote deploy and build servers over SSH; Swarm nodes<\/td><td>Swarm worker nodes<\/td><\/tr><tr><td>Users and 2FA<\/td><td>Teams with roles; TOTP 2FA<\/td><td>Owner, admin and member roles; TOTP 2FA and passkeys<\/td><td>One dashboard password; 2FA only in Pro<\/td><\/tr><tr><td>Dashboard port before a domain is set<\/td><td>8000 (plus 6001, 6002)<\/td><td>3000<\/td><td>3000<\/td><\/tr><tr><td>Official minimum<\/td><td>2 CPU cores, 2 GB RAM, 10 GB disk<\/td><td>2 GB RAM, 30 GB disk<\/td><td>No fixed figure; docs warn 512 MB may fail during builds<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">All three list Ubuntu 24.04 among tested systems. Two CapRover rows are easy to miss: its Compose support covers only a subset of the specification, and it has no scheduled database backups, so you schedule dumps for its databases yourself.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Which one should you pick?<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Solo developer with a few side projects<\/strong>: Coolify, because everything is Apache 2.0 and updates can run unattended.<\/li><li>A small agency can use Coolify teams or Dokploy roles. Dokploy&#8217;s separate build servers help when client builds stall live sites, though its SSO and audit logs need a commercial agreement in production.<\/li><li><strong>Smallest footprint<\/strong>: CapRover, on 1-2 GB with swap, for a handful of apps you deploy from the CLI.<\/li><li><strong>Outgrowing one server<\/strong>: Dokploy, because Swarm is its native mode and it adds remote deploy and build servers over SSH. Coolify is dropping Swarm in v5 and points you to multi-server deployments behind an external load balancer.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If Coolify vs Dokploy is still a toss-up, decide by node count. On a fresh 4 GB VPS today we would install Coolify, for its license and because its installer can create the admin account up front; Dokploy wins once you expect a second or third node within the year.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"800\" src=\"https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-cards.png\" alt=\"Coolify, Dokploy and CapRover compared as cards: orchestration, proxy, minimum RAM and best fit\" class=\"wp-image-2922\" srcset=\"https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-cards.png 1200w, https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-cards-300x200.png 300w, https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-cards-1024x683.png 1024w, https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-cards-450x300.png 450w, https:\/\/hostry.com\/blog\/wp-content\/uploads\/2026\/10\/paas-cards-768x512.png 768w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">When not to self-host a PaaS<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Skip it if nobody will apply panel updates within days of an advisory; both Coolify and Dokploy shipped critical fixes in 2026. Skip it for a single static site that a Compose file already serves, and for data whose only copy would sit on the panel&#8217;s VPS. If you need mailboxes, DNS zones and FTP accounts for customers instead of app deploys, a hosting control panel is the better tool; see our guide to <strong><a href=\"https:\/\/hostry.com\/blog\/selection-of-control-panel-for-vps\/\">choosing a control panel for a VPS<\/a><\/strong>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How much VPS do Coolify, Dokploy and CapRover need?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">On RAM, Coolify vs Dokploy is a tie on paper: the published <strong>Coolify VPS requirements<\/strong> and Dokploy&#8217;s both start at 2 GB RAM for the panel alone, and apps, databases and builds come on top. For scale, the Coolify docs describe a maintainer&#8217;s 2 vCPU \/ 4 GB server whose images are all built elsewhere; it averages 2.6 GB in use. That server runs 16 static sites, about two dozen small Rust services, PostgreSQL and two Valkey instances. Dokploy says its panel uses about 250 MB when it only manages remote servers. Our sizing:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>2 vCPU \/ 2 GB<\/strong>: the floor for Coolify or Dokploy. Enough to learn the panel and run one or two small apps.<\/li><li><strong>4 vCPU \/ 4 GB<\/strong>: where we would start for real projects that build on the same server.<\/li><li>CapRover can begin smaller, on 1 GB with a swap file, which its docs suggest when builds run out of memory.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Coolify&#8217;s docs separate what can run from what they recommend. It can start on 1 core and 512 MB, but the docs do not recommend that; if cost is the concern they suggest 1 core and 1 GB, upgrading as the server slows down. The 2 GB figure is the official minimum, and it is the one we size from.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The 2 GB tier we recommend for Coolify or Dokploy starts at $7\/mo (2 vCPU) in the <strong><a href=\"https:\/\/hostry.com\/services\/vps\/\">Hostry VPS catalog<\/a><\/strong> at the time of writing. The 4 GB tier (4 vCPU) starts at $20\/mo, and a 1 GB plan for CapRover at $6\/mo (1 vCPU), with prices varying by location. Check the disk too, since Dokploy asks for 30 GB. Resources can be scaled up later, so starting at 2 GB and moving to 4 GB when builds slow down works.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Run one PaaS per server.<\/strong> All three bind ports 80 and 443, and the Dokploy installer exits if anything already listens on 80, 443 or 3000. Building in CI and deploying a finished image, which all three support, keeps build spikes off a small box.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Install on Ubuntu 24.04: Coolify, Dokploy and CapRover<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Start from a fresh server and <strong><a href=\"https:\/\/hostry.com\/blog\/secure-new-linux-vps-first-30-minutes\/\">secure the new Linux VPS first<\/a><\/strong>: sudo user, SSH keys, UFW, Fail2ban and automatic updates. Wherever <span class=\"highlighted\">deploy<\/span> (the sudo user), <span class=\"highlighted\">203.0.113.10<\/span> (the server IP) or <span class=\"highlighted\">example.com<\/span> appears in a command, put in your own value. One trap applies to all three: Docker writes its own iptables rules, so a port a container publishes stays reachable even when UFW denies it, as the Docker, Coolify and Dokploy docs all warn. Block dashboard ports in your VPS control panel firewall or with <span class=\"highlighted\">ufw-docker<\/span>, and test from another machine.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Coolify<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">By default, Coolify manages even its own server over SSH as root, using a key it creates during installation. If you disabled root login completely, allow key-only root login before you install, which is the setting the Coolify docs ask for:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo sed -i 's\/^PermitRootLogin no$\/PermitRootLogin prohibit-password\/' \/etc\/ssh\/sshd_config.d\/00-hardening.conf\nsudo sshd -t &amp;&amp; sudo systemctl reload ssh<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:14px\"><strong>Install with the admin account already created<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The docs warn that whoever opens the registration page first becomes admin, with root on the server. The installer can create that account up front:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code> sudo env ROOT_USERNAME=admin \\\nROOT_USER_EMAIL=you@example.com \\\nROOT_USER_PASSWORD='Change-Me-2026!' \\\nbash -c 'curl -fsSL https:\/\/cdn.coollabs.io\/coolify\/install.sh | bash'<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Use a real email address and your own password of at least 8 characters with upper and lower case, a digit and a symbol. If either fails validation, the installer skips the account and the registration page stays open.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The command starts with a space on purpose: Ubuntu&#8217;s default <span class=\"highlighted\">~\/.bashrc<\/span> sets <span class=\"highlighted\">HISTCONTROL=ignoreboth<\/span>, so bash does not save it, password included, to history.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once the script prints its &#8220;Congratulations&#8221; message, copy <span class=\"highlighted\">\/data\/coolify\/source\/.env<\/span> somewhere safe off the server: its <span class=\"highlighted\">APP_KEY<\/span> encrypts values in Coolify&#8217;s database, and a restore fails without it. The full requirement list is on the <strong><a href=\"https:\/\/coolify.io\/docs\/start-with-self-hosted\" target=\"_blank\" rel=\"noopener\">Coolify self-hosted installation page<\/a><\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:14px\"><strong>First login through a tunnel, then a domain<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh -N -L 8000:127.0.0.1:8000 -L 6001:127.0.0.1:6001 -L 6002:127.0.0.1:6002 deploy@203.0.113.10<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Run it on your own computer, open <span class=\"highlighted\">http:\/\/localhost:8000<\/span> (6001 carries live updates, 6002 the web terminal) and turn on 2FA in your profile. Then point an A record for <span class=\"highlighted\">coolify.example.com<\/span> at the server and enter <span class=\"highlighted\">https:\/\/coolify.example.com<\/span> in <strong>Settings \u2192 General \u2192 URL<\/strong>. When that loads over HTTPS, the docs allow you to close 8000, 6001 and 6002 to the public. For the first app, add an A record for <span class=\"highlighted\">app.example.com<\/span>, create a resource from your repository through the GitHub App, enter <span class=\"highlighted\">https:\/\/app.example.com<\/span> under <strong>Domains<\/strong> and redeploy; the proxy requests the certificate.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Dokploy install<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The script refuses to run without root, installs Docker if it is missing, initializes a single-node Docker Swarm and starts Dokploy, its PostgreSQL database and Traefik:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -sSL https:\/\/dokploy.com\/install.sh | sudo sh<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The <strong><a href=\"https:\/\/docs.dokploy.com\/docs\/core\/installation\" target=\"_blank\" rel=\"noopener\">Dokploy installation guide<\/a><\/strong> sends you to port 3000 for the first visit; we prefer a tunnel, <span class=\"highlighted\">ssh -N -L 3000:127.0.0.1:3000 deploy@203.0.113.10<\/span>, then <span class=\"highlighted\">http:\/\/localhost:3000<\/span>. Create the admin account at once, then enable 2FA or a passkey under <strong>Settings \u2192 Profile<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Point <span class=\"highlighted\">dokploy.example.com<\/span> at the server and set it with a Let&#8217;s Encrypt certificate under <strong>Settings \u2192 Web Server<\/strong>. Once the panel answers over HTTPS (not before, or you lock yourself out), remove the direct port:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo docker service update --publish-rm \"published=3000,target=3000,mode=host\" dokploy<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For the first app, create a project and an application from a GitHub repository (connect GitHub under Git providers). On <strong>Domains<\/strong> enter <span class=\"highlighted\">app.example.com<\/span> and the container port, switch HTTPS on, choose <span class=\"highlighted\">letsencrypt<\/span> as the certificate, then deploy.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">CapRover<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">CapRover expects Docker 25 or newer already installed and warns against the snap package. Docker&#8217;s own apt repository for Ubuntu works:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo apt update\nsudo apt install ca-certificates curl\nsudo install -m 0755 -d \/etc\/apt\/keyrings\nsudo curl -fsSL https:\/\/download.docker.com\/linux\/ubuntu\/gpg -o \/etc\/apt\/keyrings\/docker.asc\nsudo chmod a+r \/etc\/apt\/keyrings\/docker.asc\nsudo tee \/etc\/apt\/sources.list.d\/docker.sources &lt;&lt;EOF\nTypes: deb\nURIs: https:\/\/download.docker.com\/linux\/ubuntu\nSuites: $(. \/etc\/os-release &amp;&amp; echo \"${UBUNTU_CODENAME:-$VERSION_CODENAME}\")\nComponents: stable\nArchitectures: $(dpkg --print-architecture)\nSigned-By: \/etc\/apt\/keyrings\/docker.asc\nEOF\nsudo apt update\nsudo apt install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Without changes, CapRover starts with the password <span class=\"highlighted\">captain42<\/span>. Its best-practice page suggests setting your own at install time with <span class=\"highlighted\">DEFAULT_PASSWORD<\/span>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo docker run -p 80:80 -p 443:443 -p 3000:3000 -e ACCEPTED_TERMS=true -e DEFAULT_PASSWORD='Change-Me-Too-2026' -v \/var\/run\/docker.sock:\/var\/run\/docker.sock -v \/captain:\/captain caprover\/caprover<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Before the setup wizard, create a <strong>wildcard A record<\/strong>, <span class=\"highlighted\">*.apps.example.com<\/span> pointing to 203.0.113.10. CapRover does not officially support proxied DNS such as Cloudflare&#8217;s orange cloud. Then, on your own computer with Node.js installed:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>npm install -g caprover\ncaprover serversetup<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Enter <span class=\"highlighted\">apps.example.com<\/span> as the root domain. The wizard forces HTTPS for <span class=\"highlighted\">captain.apps.example.com<\/span> and sets a new password, as the <strong><a href=\"https:\/\/caprover.com\/docs\/get-started.html\" target=\"_blank\" rel=\"noopener\">CapRover getting-started guide<\/a><\/strong> describes; after that, CapRover&#8217;s firewall notes say port 3000 can be closed. To deploy, create an app called <span class=\"highlighted\">hello<\/span> and run <span class=\"highlighted\">caprover deploy<\/span> in a repository with a <span class=\"highlighted\">captain-definition<\/span> file; only the current Git commit is sent, so uncommitted files never reach the server. That JSON file declares <span class=\"highlighted\">&#8220;schemaVersion&#8221;: 2<\/span> and tells CapRover how to build, through a <span class=\"highlighted\">dockerfilePath<\/span>, inline <span class=\"highlighted\">dockerfileLines<\/span>, a built-in <span class=\"highlighted\">templateId<\/span> or an <span class=\"highlighted\">imageName<\/span> to pull, as the <strong><a href=\"https:\/\/caprover.com\/docs\/captain-definition-file.html\" target=\"_blank\" rel=\"noopener\">captain-definition reference<\/a><\/strong> shows. Enable HTTPS for <span class=\"highlighted\">hello.apps.example.com<\/span> in the app&#8217;s HTTP settings.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to secure and maintain the PaaS dashboard<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Each panel controls the Docker socket, so treat its dashboard as a root shell. All three shipped releases in the second half of October 2026. Coolify&#8217;s <strong><a href=\"https:\/\/github.com\/coollabsio\/coolify\/security\/advisories\" target=\"_blank\" rel=\"noopener\">GitHub security advisories<\/a><\/strong> run to dozens in 2026, with a batch of high and critical fixes in late June and early July. On October 21, v4.4.7 and backports for every v4 line patched PHP2Shell, two critical PHP remote code execution flaws (CVE-2026-109618 and CVE-2026-109619). <strong><a href=\"https:\/\/github.com\/Dokploy\/dokploy\/security\/advisories\" target=\"_blank\" rel=\"noopener\">Dokploy&#8217;s advisories<\/a><\/strong> include a set of high and critical ones published on July 21, 2026. CapRover has no published GitHub advisories, which does not by itself prove it has fewer bugs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Several of the 2026 titles describe a logged-in user with a lower role reaching root on the host. <strong>Give panel accounts only to people you would trust with root<\/strong>, and keep to this routine:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>Keep dashboard ports closed to the public once the panel has an HTTPS domain.<\/li><li>Turn on 2FA for every account (CapRover needs Pro for it).<\/li><li><strong>Update on a schedule.<\/strong> Coolify has an <strong>Automatic updates<\/strong> option in its settings; Dokploy updates with <span class=\"highlighted\">curl -sSL https:\/\/dokploy.com\/install.sh | sudo sh -s update<\/span>; CapRover shows available versions in <strong>Settings<\/strong>. Updating the panel does not update the PHP or Node.js runtimes inside your own app images.<\/li><li>Send database backups to an S3-compatible bucket off this server and restore one into a scratch database each month; as Coolify&#8217;s docs note, a successful backup only proves a file was created.<\/li><li>Back up the panel itself: Coolify&#8217;s <span class=\"highlighted\">.env<\/span>, Dokploy&#8217;s <strong>Web Server \u2192 Backups<\/strong> (database plus <span class=\"highlighted\">\/etc\/dokploy<\/span> to S3) or CapRover&#8217;s settings archive. Our post on <strong><a href=\"https:\/\/hostry.com\/blog\/the-crucial-importance-of-backup\/\">backup retention basics<\/a><\/strong> has more on keeping copies.<\/li><li>When the budget allows, keep a production customer database off the PaaS host.<\/li><\/ol>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Footprint and setup effort at a glance<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The table sums up footprint and setup effort for Coolify vs Dokploy vs CapRover; the one DNS item to arrange early is CapRover&#8217;s wildcard record.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Item<\/th><th>Coolify<\/th><th>Dokploy<\/th><th>CapRover<\/th><\/tr><\/thead><tbody><tr><td>VPS we would start on<\/td><td>2 vCPU \/ 2 GB, 4 GB if building locally<\/td><td>2 vCPU \/ 2 GB, 4 GB if building locally<\/td><td>1 vCPU \/ 1 GB with swap<\/td><\/tr><tr><td>Hostry price at the time of writing<\/td><td>From $7\/mo (2 GB) or $20\/mo (4 GB)<\/td><td>From $7\/mo (2 GB) or $20\/mo (4 GB)<\/td><td>From $6\/mo (1 GB)<\/td><\/tr><tr><td>DNS before first HTTPS app<\/td><td>One A record per hostname<\/td><td>One A record per hostname<\/td><td>Wildcard A record required<\/td><\/tr><tr><td>Steps to first deploy<\/td><td>SSH tweak, one install command, domain<\/td><td>One install command, domain, remove port 3000<\/td><td>Docker install, run container, wildcard DNS, CLI wizard<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">What to do next<\/h2>\n\n\n\n<ol class=\"wp-block-list\"><li>Install the panel on a throwaway VPS first, deploy one real app and run a full restore before you move anything that matters.<\/li><li><strong>Watch the project&#8217;s GitHub repository<\/strong> with <strong>Custom \u2192 Security alerts<\/strong> so new advisories reach your inbox.<\/li><li>Create a separate S3 access key that can reach only the backup bucket, so a compromised panel cannot wipe your other storage.<\/li><\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Is Dokploy open source?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Mostly. Code outside the <span class=\"highlighted\">\/proprietary<\/span> folders is Apache 2.0. The proprietary part includes SSO, SCIM, audit logs, custom roles, whitelabeling and license keys, and its license allows production use only under a commercial agreement with Dokploy, while development and testing use is free. In a Coolify vs Dokploy choice, that matters mainly if you need SSO or audit logs.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Do I need a domain for Coolify, Dokploy or CapRover?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Not for testing. Coolify can generate <span class=\"highlighted\">sslip.io<\/span> hostnames from the server IP and Dokploy offers free <span class=\"highlighted\">traefik.me<\/span> ones, but both are HTTP only by default. CapRover runs without a domain but cannot enable HTTPS. For anything public, use your own domain.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can Coolify run on a 1 GB VPS?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It can, for trying the panel. The catch is building: the docs warn that builds running next to Coolify on a small server can make it unresponsive. On 1 GB, deploy prebuilt images from a registry and move to 2 GB before you build from source on the server.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is CapRover still maintained?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. Version 1.15.0 shipped in August 2026, five point releases followed by October 23, and commits kept landing after that.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Settled on Coolify, Dokploy or CapRover?<\/strong> <strong><a href=\"https:\/\/hostry.com\/products\/vps\/\">Deploy a Hostry KVM VPS<\/a><\/strong> in one of 18+ locations close to your users, and pick its starting size from the footprint table depending on whether your builds run on the server.<\/p>\n<!-- AddThis Advanced Settings generic via filter on the_content --><!-- AddThis Share Buttons generic via filter on the_content -->","protected":false},"excerpt":{"rendered":"<p>Coolify, Dokploy and CapRover all turn a Linux VPS into a git-push deployment platform with automatic HTTPS. Here is how they differ, what size of ser&#8230;<\/p>\n","protected":false},"author":1,"featured_media":2920,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1,78],"tags":[],"class_list":["post-2923","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-virtual-private-server","category-apps"],"read_time":10,"_links":{"self":[{"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/posts\/2923","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/comments?post=2923"}],"version-history":[{"count":1,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/posts\/2923\/revisions"}],"predecessor-version":[{"id":2924,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/posts\/2923\/revisions\/2924"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/media\/2920"}],"wp:attachment":[{"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/media?parent=2923"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/categories?post=2923"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostry.com\/blog\/wp-json\/wp\/v2\/tags?post=2923"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}