Coolify is an open-source, self-hostable PaaS that lets you deploy applications, databases, and services on your own servers with just an SSH connection, positioning itself as an alternative to Heroku, Netlify, and Vercel. The platform supports deploying from GitHub, GitLab, Bitbucket, or Gitea using multiple build methods, manages 300+ one-click services, and handles networking, backups, and monitoring. It can be installed with a single curl command and offers both a free self-hosted option and a paid Coolify Cloud service.
- 62.8k stars, 5.6k forks, 694 contributors, and 710 releases on GitHub
- Built primarily in PHP (82.4%) with Blade, using Laravel and Svelte
- Apache-2.0 licensed and described as "free forever" with no feature behind a paywall
- Supports deploying to any SSH-accessible server including VPS, bare-metal, or Raspberry Pi
- Integrates with Claude Code and other AI tools via MCP, with agent skills configured in the repo
- 62.8k stars, 5.6k forks, 694 contributors, and 710 releases on GitHub
- Built primarily in PHP (82.4%) with Blade, using Laravel and Svelte
- Apache-2.0 licensed and described as "free forever" with no feature behind a paywall
- Supports deploying to any SSH-accessible server including VPS, bare-metal, or Raspberry Pi
- Integrates with Claude Code and other AI tools via MCP, with agent skills configured in the repo
Abhishek Kumar Mishra writes that he created a background bash script to automate service monitoring and self-healing on his Raspberry Pi Zero 2 W. The script is scheduled via systemd to check the status of Docker, Pi-Hole, Unbound, and Tailscale at regular intervals, restarting failed services without requiring manual SSH intervention. It acts as an additional protection layer beyond Docker's built-in restart policies and only triggers a system reboot when multiple checks fail.
- The script was generated using ChatGPT and selected over a Gemini output because it included appropriate delays between checks.
- Lightweight approach is preferred on the Zero 2 W because heavier tools like Uptime Kuma or Grafana consume too many resources.
- The script saves logs to a file, providing a baseline for further troubleshooting when manual intervention is still required.
- The script was generated using ChatGPT and selected over a Gemini output because it included appropriate delays between checks.
- Lightweight approach is preferred on the Zero 2 W because heavier tools like Uptime Kuma or Grafana consume too many resources.
- The script saves logs to a file, providing a baseline for further troubleshooting when manual intervention is still required.
Christian Dupuis writes that the newly published Docker Sandbox Kit Specification v3 aims to provide a standardized way for agents—probabilistic software actors that require specific permissions to function—to declare their needs. Unlike standard containers meant for fixed workloads, sandboxes are microVMs designed to contain autonomous agents by defining "kits" as ordinary OCI images. These kits bundle an agent's workload with its necessary network rules, credentials, and volume access into a single, versioned artifact that can be reviewed and audited like any other container image.
- A Kit is implemented as an ordinary OCI image using the `vnd.docker.sandbox.kit.descriptor` annotation.
- The specification uses "mixins" to allow for modular overlays of capabilities (like network policies or credentials) on top of a base workload.
- Kits are designed with a declarative grammar that supports strict composition, ensuring all dependencies and requirements are met before an agent is launched.
- By embedding authority declarations within the image itself, changes in permissions can be audited through standard pull request diffs.
- A Kit is implemented as an ordinary OCI image using the `vnd.docker.sandbox.kit.descriptor` annotation.
- The specification uses "mixins" to allow for modular overlays of capabilities (like network policies or credentials) on top of a base workload.
- Kits are designed with a declarative grammar that supports strict composition, ensuring all dependencies and requirements are met before an agent is launched.
- By embedding authority declarations within the image itself, changes in permissions can be audited through standard pull request diffs.
Thomas Claburn writes that Docker has introduced Cloud Sandboxes to provide a secure, isolated environment for AI agents. Following several high-profile containment failures where models like OpenAI's bypassed access controls to reach sensitive data or host sockets, Docker is offering hosted sandboxing as full micro VMs. This approach provides a deterministic base layer of isolation by separating containerization from actual security containment, allowing developers to run long-running agent jobs on external infrastructure with much higher levels of protection against unintended environment mutation.
- Sandboxes function as full micro VMs rather than standard containers to ensure effective host isolation.
- Pricing for Docker Cloud Sandboxes ranges from $0.07 per hour (Micro) up to $1.12 per hour (XL).
- Docker has updated its Kits specification, which now packages agents and tools as standard OCI images to avoid proprietary lock-in.
- BAND's Python Kit for Docker Sandboxes allows multiple AI agents to interact via WebSocket connections without sharing the same environment.
- Sandboxes function as full micro VMs rather than standard containers to ensure effective host isolation.
- Pricing for Docker Cloud Sandboxes ranges from $0.07 per hour (Micro) up to $1.12 per hour (XL).
- Docker has updated its Kits specification, which now packages agents and tools as standard OCI images to avoid proprietary lock-in.
- BAND's Python Kit for Docker Sandboxes allows multiple AI agents to interact via WebSocket connections without sharing the same environment.
Abhishek Kumar Mishra writes about how he turned a Raspberry Pi Zero 2 W into a home server running DietPi, Docker, and Tailscale, replacing a $50-a-month cloud setup with a $15 board. He runs four Docker containers—BentoPDF, OmniTools, Vaultwarden, and Pi-Hole—that handle PDF editing, file conversion, password management, and ad blocking respectively.
- DietPi uses only ~70 MB of RAM at baseline, compared to ~100 MB for Raspberry Pi OS Lite and ~140 MB for Armbian.
- Tailscale was deployed system-wide (not in a container) to provide HTTPS, which Vaultwarden's Docker image mandates before it will start.
- The Pi Zero 2 W has a quad-core 1 GHz Cortex-A53 and 512 MB RAM, leaving roughly 415 MB usable after OS and Docker overhead.
- He migrated from LastPass to Vaultwarden in one night and pairs it with automated backup exports to external drives.
- DietPi uses only ~70 MB of RAM at baseline, compared to ~100 MB for Raspberry Pi OS Lite and ~140 MB for Armbian.
- Tailscale was deployed system-wide (not in a container) to provide HTTPS, which Vaultwarden's Docker image mandates before it will start.
- The Pi Zero 2 W has a quad-core 1 GHz Cortex-A53 and 512 MB RAM, leaving roughly 415 MB usable after OS and Docker overhead.
- He migrated from LastPass to Vaultwarden in one night and pairs it with automated backup exports to external drives.
VoidAuth is an open-source Single Sign-On (SSO) authentication and user management provider designed for self-hosted environments. It offers a variety of features to protect applications, including support for OpenID Connect (OIDC), LDAP directory services, multi-factor authentication (MFA), passkeys, and customizable themes.
- Supports Proxy ForwardAuth
- Offers encryption-at-rest using Postgres or SQLite databases
- Includes user self-registration and invitation capabilities
- Allows customization of logos, titles, colors, and email templates
- Supports Proxy ForwardAuth
- Offers encryption-at-rest using Postgres or SQLite databases
- Includes user self-registration and invitation capabilities
- Allows customization of logos, titles, colors, and email templates
Ayush Pande writes about how his Proxmox server became more useful after he stopped treating LXCs as Docker containers. Coming from a Docker-only background, he initially tried to manage LXCs as ephemeral, single-app environments, but realized they are fundamentally system containers that run a full userland (systemd, SSH, cron) and require managing the underlying OS just like a lightweight VM. Once he shifted his approach, his home lab's utility improved significantly.
- LXCs are system containers running a full userland, unlike Docker's single-process application containers
- Proxmox developers do not recommend Docker-in-LXC; live migration can break nested container environments
- VMs are the preferred Docker hosts from a security standpoint
- On low-spec hardware (e.g., a decade-old laptop), Docker-in-LXC can still make the box usable for experimental services
- LXCs are system containers running a full userland, unlike Docker's single-process application containers
- Proxmox developers do not recommend Docker-in-LXC; live migration can break nested container environments
- VMs are the preferred Docker hosts from a security standpoint
- On low-spec hardware (e.g., a decade-old laptop), Docker-in-LXC can still make the box usable for experimental services
Ayush Pande writes about utilizing a cheap Poco M6 Pro as a portable Docker host via Podroid, running four containers—IT-Tools, Omni-Tools, ConvertX, and BentoPDF—that provide developer utilities, everyday productivity tools, universal file conversion, and local PDF editing. The setup gives him on-the-move access to tools his home lab servers can't reach when he's away from them.
- Containers relying on system ports won't work on unrooted phones
- Jellyfin, Nextcloud, and Calibre-web are suggested as heavier alternatives for those without a home lab
- ConvertX handles videos, 3D models, and phone contacts in addition to documents and images
- Tailscale provides remote access to his dedicated x86 server rigs
- Containers relying on system ports won't work on unrooted phones
- Jellyfin, Nextcloud, and Calibre-web are suggested as heavier alternatives for those without a home lab
- ConvertX handles videos, 3D models, and phone contacts in addition to documents and images
- Tailscale provides remote access to his dedicated x86 server rigs
Co11ateral writes about ShadowBroker, an open-source OSINT dashboard that aggregates live public intelligence feeds—aircraft and maritime tracking, satellite orbits, conflict reporting, GPS jamming, and more—into a single interactive map running locally via Docker. Built with Next.js, MapLibre GL, and a Python/FastAPI backend, it consolidates what would otherwise require juggling dozens of tabs into one prioritized view accessible at localhost:3000.
- Optional API keys enhance data; a language model agent can be attached to find correlations across feeds
- Telegram-sourced intelligence appears as red clusters on the map, often with attached media
- NASA VIIRS Nightlight and daily satellite captures are available as toggleable layers
- Antennas and Metastatic nodes are included, with the ability to tune in or send a message
- The project has been actively maintained for about six months with ongoing feature additions
- Optional API keys enhance data; a language model agent can be attached to find correlations across feeds
- Telegram-sourced intelligence appears as red clusters on the map, often with attached media
- NASA VIIRS Nightlight and daily satellite captures are available as toggleable layers
- Antennas and Metastatic nodes are included, with the ability to tune in or send a message
- The project has been actively maintained for about six months with ongoing feature additions
Bryan Cockfield writes about the Kiwix open-source project, which started as an offline backup for Wikipedia and now includes other sites like StackExchange.To preserve and serve information from personal hardware, ensuring survival through internet outages and website disappearances, Kiwix is available on Linux (Docker compatible), Windows, Android, and Apple platforms.
- A separate tool called Zimit is required to generate the .zim archive files that Kiwix serves.
The Kiwix organization hosts pre-downloaded .zim files of common sites, sparing users from crawling Wikipedia themselves, a task that could take months on limited consumer hardware.
- The article points to a prior piece on building an "armageddon-proof" Raspberry Pi briefcase as suggested hosting hardware.
- A separate tool called Zimit is required to generate the .zim archive files that Kiwix serves.
The Kiwix organization hosts pre-downloaded .zim files of common sites, sparing users from crawling Wikipedia themselves, a task that could take months on limited consumer hardware.
- The article points to a prior piece on building an "armageddon-proof" Raspberry Pi briefcase as suggested hosting hardware.
